Function at 0x180004de0
Capabilities:
Accept command line arguments
Authenticate hmac
Check os version
Parse credit card information
Terminate process
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x498
mov eax, dword [rsp + 0x78]
xor r10d, r10d
mov ebp, dword [rsp + 0x78]
mov dword [rsp + 0x40], r10d
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x60], rbp
mov r11d, 0x48
mov rbx, qword [0x18002e008]
xor edx, edx
mov eax, 0x398
movabs rcx, 0x4d53fe2a3f867323
div rbx
mov rdi, rax
add dil, bl
and ebx, 0x11c
xor dil, 0x7e
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x58], rdi
xor esi, esi
movsxd rax, esi
cmp rax, rbx
jb 0x1800060e5
xor esi, esi
movsxd rax, esi
mov dword [rsp + 0x44], esi
cmp rax, rbx
jb 0x180005a83
cmp dil, 0x5d
jne 0x180004e8d
and dword [rsp + 0x40], 0
xor esi, esi
mov dword [rsp + 0x44], esi
jmp 0x180004ec6
mov rbp, qword [rsp + 0x60]
jmp 0x180004e1e
cmp dil, 0x3e
je 0x180006214
cmp dil, r11b
jne 0x180004ebc
mov r9, rbx
mov qword [rsp + 0x20], rbx
mov r8, rbx
mov rdx, rbx
mov rcx, r11
call fcn.180004de0
mov dil, al
mov qword [rsp + 0x58], rdi
jmp 0x180004ec6
cmp dil, 0x54
jb 0x18000620e
mov eax, 0x39
cmp rbx, rax
jb 0x180006085
cmp rbx, 0x100
jne 0x180004ee9
xor eax, eax
mov qword [rsp + 0x70], rax
jmp 0x180005000
cmp rbx, 0x26
jb 0x18000622b
cmp rbx, 0x61
jae 0x180004f0a
movzx edx, dil
mov r8d, ebx
mov rcx, rbx
call fcn.180003298
jmp 0x180004f47
cmp rbx, 0x28
ja 0x180004f33
movzx r8d, dil
mov r9, rbx
mov qword [rsp + 0x20], r8
mov rdx, rbx
mov rcx, rbx
call fcn.180004de0
mov dl, al
mov qword [rsp + 0x58], rdx
jmp 0x180005a76
cmp rbx, 0x3a
jne 0x180004f4e
movzx ecx, dil
xor edx, edx
mov eax, 0x2d3
div rcx
mov dl, al
jmp 0x180005005
cmp rbx, 0x4a
jne 0x180004f62
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180005000
cmp rbx, 0x59
jae 0x180004f90
movzx ecx, dil
mov r9d, ecx
mov qword [rsp + 0x20], rbx
mov r8d, ecx
mov edx, ecx
call fcn.180004de0
movzx edx, al
mov ebx, 0x205
sub rbx, rdx
mov qword [rsp + 0x68], rbx
jmp 0x180005005
mov eax, 0x4f
cmp rbx, rax
je 0x18000620e
cmp rbx, 0x18
jae 0x180004fb8
movzx edx, dil
mov r9d, edx
mov qword [rsp + 0x20], rbx
mov r8d, edx
jmp 0x180004f1f
cmp rbx, 0x5d
jne 0x180004fcd
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
mov qword [rsp + 0x68], rbx
jmp 0x180005000
cmp rbx, 0x44
jae 0x180005000
xor edx, edx
movzx eax, dil
div rbx
mov rcx, rax
movabs rax, 0x1485f0e0acd3b68d
mul rcx
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 8
mov qword [0x18002e018], rcx
mov rdx, qword [rsp + 0x58]
mov cl, bl
sub cl, dl
sub cl, 0x23
xor cl, 0x23
cmp rbx, 0x5b
je 0x180006207
cmp rbx, 0x100
jne 0x180005033
xor eax, eax
cmp cl, 0xa3
cmovne eax, ebp
mov ebp, eax
mov qword [rsp + 0x60], rbp
jmp 0x18000506b
mov r8d, 0x1c
cmp rbx, r8
jne 0x18000504e
mov edx, r8d
mov ecx, r8d
call fcn.180006240
jmp 0x180004f27
mov r10d, dword [rsp + 0x40]
mov r11d, 0x48
mov r9, qword [rsp + 0x4d8]
cmp rbx, 0x63
jb 0x180004e1e
mov r11d, 0x3ad
mov ebx, r11d
mov qword [rsp + 0x68], rbx
cmp cl, 0x1b
ja 0x180005088
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov ebx, eax
jmp 0x180005092
cmp cl, 0x41
jne 0x1800050c8
mov ebx, 0x3e3
mov qword [rsp + 0x68], rbx
xor r9d, r9d
mov cl, bl
add cl, cl
mov dword [rsp + 0x48], r9d
sub cl, 0x55
mov dil, cl
sub cl, 0x4e
xor dil, 0x62
or dil, cl
mov qword [rsp + 0x58], rdi
cmp dil, 0xf7
jne 0x180005119
and dword [rsp + 0x78], r9d
jmp 0x180005178
cmp cl, 0xa3
jne 0x1800050d7
mov dword [rsp + 0x50], 0xa0713d40
jmp 0x180005097
mov r10d, dword [rsp + 0x40]
mov r9, qword [rsp + 0x4d8]
cmp cl, 0x3b
jb 0x180004e18
cmp cl, 0x4e
je 0x180006202
cmp cl, 0x36
jb 0x180006169
mov eax, 6
cmp cl, al
jne 0x180005097
mov r8d, r11d
mov edx, eax
mov ecx, eax
call fcn.180003298
jmp 0x180004f27
cmp dil, 0x27
jae 0x180005132
lea rax, [rbx + 0xad]
xor rax, rbx
mov qword [0x18002e018], rax
jmp 0x180005178
cmp dil, 0x46
jbe 0x18000620e
cmp dil, 0x16
jb 0x1800060ce
mov eax, 0x11
cmp dil, al
jb 0x18000620e
lea ecx, [rax + 0x3e]
cmp dil, cl
jb 0x180006077
cmp dil, 0x44
jae 0x18000517d
mov edx, ebx
mov rcx, rbx
call fcn.180006240
mov r9d, dword [rsp + 0x48]
mov rbx, rax
mov ecx, 0x4f
mov r10d, dword [rsp + 0x40]
add rbx, 0xfffffffffffffed2
mov rsi, qword [rsp + 0x70]
mov r8, qword [rsp + 0x4c0]
movzx eax, dil
xor rbx, rax
mov qword [rsp + 0x68], rbx
mov eax, r9d
cmp rax, qword [rsp + 0x4c8]
jae 0x180005f39
mov rax, qword [0x18002e008]
test esi, esi
jne 0x1800059a1
mov rdi, qword [0x18002e008]
xor edx, edx
mov eax, 0x128
div rdi
mov eax, 0x36f
movzx esi, dx
imul esi, eax
or si, di
mov bpl, sil
or bpl, 0xcf
cmp bpl, 0xff
jne 0x18000526d
mov edx, 0x3d
lea r8d, [rdx - 0x21]
cmp si, dx
jae 0x180005214
movzx esi, di
lea edx, [r8 - 0xb]
xor si, dx
lea ecx, [rax + 0x7f]
or si, cx
mov r11d, 0xfb7b
jmp 0x18000527e
mov eax, 0x2f
cmp si, ax
ja 0x18000522d
add rdi, 0xfffffffffffffe0f
and edi, 0x26b
jmp 0x180005273
cmp si, r8w
jb 0x1800060c0
mov eax, 0x48
cmp si, ax
jb 0x1800061e2
mov eax, 0xc
cmp si, ax
ja 0x180005312
mov r8d, edi
mov edx, 0xff
mov rcx, rdi
call fcn.180003298
mov bpl, dil
movzx esi, ax
and bpl, 0xac
mov r8d, 0x1c
mov r11d, 0xfb7b
mov edx, 0x11
movabs r9, 0x4d53fe2a3f867323
cmp rdi, r9
jne 0x180005511
cmp si, r8w
jbe 0x180006053
cmp si, r11w
jne 0x1800052c4
cmp bpl, 0x5f
jb 0x180005a65
cmp bpl, 0xff
jne 0x18000546d
mov rax, qword [rsp + 0x60]
mov eax, eax
add qword [rsp + 0x80], rax
mov r11d, 0x48
mov eax, 0x2ed
movzx ebx, bpl
xor bx, ax
movabs rax, 0x4d53fe2a3f867323
cmp rdi, rax
jne 0x180005591
imul r8d, dword [rsp + 0x50], 0x41c64e6d
xor edx, edx
movzx ecx, bpl
movzx eax, bx
div rcx
add r8d, 0x3037
add r8d, eax
mov dword [rsp + 0x50], r8d
jmp 0x1800057fc
mov r11d, 0xfb7b
cmp si, r11w
jne 0x18000541a
cmp rdi, 7
je 0x180005897
mov eax, 0x30
cmp rdi, rax
jae 0x180005348
mov edx, edi
mov ecx, r11d
call fcn.180006240
mov rbp, rax
jmp 0x18000526d
cmp rdi, 2
jae 0x180005373
mov r9, r11
mov qword [rsp + 0x20], 0xff
mov r8, rdi
mov edx, 0xff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_HeapQueryInformation]
movsxd rdi, eax
jmp 0x18000526d
cmp rdi, 0x25
je 0x1800061db
mov eax, 0x4d
cmp rdi, rax
jae 0x180005398
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movzx esi, ax
jmp 0x18000526d
cmp rdi, 0x54
je 0x1800061d4
cmp rdi, 0x63
jb 0x1800061d4
cmp rdi, 0xe
jbe 0x18000610d
movabs rax, 0x4d53fe2a3f867323
cmp rdi, rax
jne 0x1800053d7
mov rax, qword [rsp + 0x60]
add r9d, eax
mov dword [rsp + 0x48], r9d
jmp 0x1800052ba
cmp rdi, 3
jae 0x1800053e7
mov edi, 0x180
jmp 0x1800052c4
cmp rdi, 0x1b
je 0x180006046
cmp rdi, 0x43
jae 0x18000540b
mov edx, edi
mov ecx, 0xff
call fcn.180006240
mov rdi, rax
jmp 0x18000526d
cmp rdi, 0x47
je 0x180005915
jmp 0x180005279
cmp si, cx
jae 0x180005444
movzx ebx, si
mov r8d, edi
mov ecx, ebx
mov edx, 0xff
call fcn.180003298
mov edi, eax
xor edx, edx
mov eax, ebx
div rdi
or al, 0xb3
mov bpl, al
jmp 0x18000526d
mov eax, 0x30
cmp si, ax
je 0x180006226
mov eax, 0x10
cmp si, ax
ja 0x180005279
movzx edx, si
mov rcx, rdi
call fcn.180006240
jmp 0x18000543c
cmp bpl, 0x51
jae 0x180005497
movabs rax, 0x4d53fe2a3f867323
mov r9, r11
mov r8, rax
mov rcx, rax
mov edx, r11d
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdi, rax
jmp 0x1800052c4
cmp bpl, 0x58
jbe 0x180006202
cmp bpl, 0x3e
je 0x180006202
cmp bpl, 0x64
je 0x1800061ee
cmp bpl, dl
ja 0x1800054c2
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x18000548f
cmp bpl, 0x1b
je 0x1800061ee
cmp bpl, 0xe
jb 0x1800058ac
cmp bpl, 0x36
jb 0x1800052c4
cmp bpl, 0x4a
jbe 0x180005a76
cmp bpl, 0x18
jne 0x1800054fd
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov edi, eax
jmp 0x1800052c4
cmp bpl, 2
ja 0x1800052c4
mov ecx, r11d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x39
cmp rdi, rcx
jb 0x1800061fd
cmp rdi, 5
je 0x180005904
cmp rdi, rcx
jne 0x18000553d
call qword [sym.imp.KERNEL32.dll_GetLastError]
add bpl, 0xf
jmp 0x1800052c4
cmp rdi, 0x25
je 0x1800058f7
mov r11d, 0x48
cmp rdi, r11
jb 0x1800052ca
mov r10d, dword [rsp + 0x40]
mov r9, qword [rsp + 0x4d8]
cmp rdi, 0x5b
jb 0x180004e86
cmp rdi, 0x3e
je 0x180006214
cmp rdi, 0xb
jne 0x1800052ca
mov qword [str.m2e], 0xfffffffffffffe7f
jmp 0x1800052ca
cmp rdi, 0x5c
jb 0x18000615d
cmp rdi, 0x19
jae 0x1800055e1
movabs rax, 0x8f0063c018f0063d
mov rcx, rdi
mul rdi
mov rax, rdi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 9
imul rax, rax, 0x291
sub rcx, rax
movzx eax, bpl
xor rax, 0x8e
or rcx, rax
mov qword [section..data], rcx
jmp 0x180005639
mov ecx, 0x2f
cmp rdi, rcx
jae 0x180005617
movzx ecx, bpl
mov r9, rdi
mov edx, ecx
mov qword [rsp + 0x20], rdi
mov r8, rdi
call fcn.180004de0
mov rbx, rax
mov edi, 0x16b
movzx eax, ax
mov r11d, 0x48
sub rdi, rax
jmp 0x180005639
cmp rdi, 0x49
jae 0x180005643
xor edx, edx
movzx ecx, bx
mov eax, 0xbeaaf
div rcx
mov rax, rdx
xor edx, edx
div rcx
mov qword [str.m2e], rax
movabs rax, 0x4d53fe2a3f867323
cmp rdi, r11
jbe 0x1800060c0
cmp rdi, 0x64
je 0x1800060c0
cmp rdi, 0x55
jb 0x1800061f8
cmp rdi, 0x16
jae 0x1800057ab
movzx ecx, bx
mov r8, rdi
mov r9d, ecx
mov qword [rsp + 0x20], rdi
mov rdx, rdi
call fcn.180004de0
mov bpl, al
mov r11d, 0x48
mov rsi, qword [rsp + 0x70]
mov r8d, dword [rsp + 0x50]
mov eax, 0x82
movzx r9d, di
or r9w, bx
or r9w, ax
mov eax, 0x73b3
cmp r9w, ax
jne 0x1800056d3
movzx eax, bpl
mov ecx, 0x41c64f6c
sub ecx, eax
movzx eax, bx
imul eax, edi
imul r8d, ecx
sub r8d, eax
sub r8d, 0x7ba57151
mov dword [rsp + 0x50], r8d
xor edx, edx
movzx ecx, bpl
mov eax, 0xc2
div rcx
mov eax, 0x39
and dl, bl
cmp bx, ax
jbe 0x180005974
mov eax, 0x4d
cmp bx, ax
je 0x180005a76
mov eax, 0x31
cmp bx, ax
jbe 0x180006226
cmp bx, 0x4e
jb 0x1800061f3
mov eax, 0x1d
cmp bx, ax
jb 0x1800061f3
lea ecx, [rax + 0x32]
cmp bx, cx
jb 0x180005987
cmp bx, 0x17
jb 0x18000605c
mov r10d, 0x212
cmp bx, r10w
jne 0x1800058cb
cmp rdi, 0x5b
je 0x180006135
movabs rax, 0x4d53fe2a3f867323
cmp rdi, rax
je 0x180005941
cmp rdi, 0x42
je 0x1800058be
cmp rdi, 0xd
je 0x1800061f3
cmp rdi, 0x3e
jb 0x18000592f
cmp rdi, r11
jae 0x180005987
movzx r9d, r9w
mov r8, rdi
movzx edx, dl
mov ecx, r10d
mov qword [rsp + 0x20], r9
call fcn.180004de0
jmp 0x18000588d
cmp rdi, 7
jae 0x1800057ca
movzx eax, bpl
or rax, rdi
or rax, 0x215
mov qword [0x18002e008], rax
jmp 0x180005689
cmp rdi, 0x16
jne 0x1800057da
mov edi, 0xd10
jmp 0x180005689
cmp rdi, 0x53
je 0x180005a70
cmp rdi, 0x45
jne 0x1800057f2
mov bpl, 0x2e
jmp 0x180005689
cmp rdi, rax
jne 0x180005822
mov r8d, dword [rsp + 0x50]
xor edx, edx
movzx ecx, bx
mov eax, 0x242
div rcx
xor edx, edx
lea rcx, [rax + 0x63]
mov eax, r8d
div rcx
mov rsi, rdx
mov qword [rsp + 0x70], rdx
jmp 0x180005693
cmp rdi, 0x36
jne 0x180005851
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
movzx ecx, bl
movzx eax, bpl
imul ecx, eax
mov al, cl
add al, al
add cl, al
lea ebp, [rcx*2 - 0x16]
jmp 0x180005683
cmp rdi, 6
jne 0x18000586f
movzx edx, bpl
mov rcx, rdi
mov qword [rsp + 0x20], rdx
mov r8d, edx
movzx r9d, bx
jmp 0x18000567b
cmp rdi, 2
ja 0x180005689
movzx r8d, bpl
mov r9, rdi
movzx edx, bpl
movzx ecx, bx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov r9d, dword [rsp + 0x48]
jmp 0x180005925
mov edx, 0xff
mov r8d, 7
mov rcx, r11
call fcn.180003298
jmp 0x180005910
movzx ecx, bpl
mov r8, r11
mov edx, r11d
call qword [sym.imp.KERNEL32.dll_HeapSize]
jmp 0x180005910
mov ecx, 0x42
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800058f0
mov eax, 0x30
cmp bx, ax
jne 0x180005965
movzx r9d, r9w
mov r8d, eax
movzx edx, dl
mov rcx, rdi
mov qword [rsp + 0x20], r9
call fcn.180004de0
mov r9d, dword [rsp + 0x48]
jmp 0x18000591a
mov ecx, 0x25
call qword [sym.imp.KERNEL32.dll_InitializeSListHead]
jmp 0x180005910
movzx ecx, bpl
mov edx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov r9d, dword [rsp + 0x48]
mov rsi, qword [rsp + 0x70]
mov rax, qword [0x18002e008]
test esi, esi
jne 0x180005982
mov ecx, 0x4f
jmp 0x1800051c2
movzx eax, dl
sub rax, 0x30f
mov qword [str.m2e], rax
jmp 0x180005987
movzx ecx, dl
mov eax, 0x12b
xor edx, edx
div rcx
mov ecx, 0x4f
mov eax, r8d
add rcx, rdx
xor edx, edx
div rcx
mov qword [rsp + 0x60], rdx
jmp 0x180005982
cmp bx, 0x2d
ja 0x180005987
movzx eax, r9w
jmp 0x18000622e
movzx edx, bx
mov r8d, edi
movzx ecx, bx
call fcn.180003298
mov ecx, 0x4f
mov r9d, dword [rsp + 0x48]
mov r10d, dword [rsp + 0x40]
mov r8, qword [rsp + 0x4c0]
test esi, esi
je 0x1800051a2
mov rax, qword [0x18002e018]
mov r11d, 0x800000ff
mov eax, dword [rsp + 0x44]
inc eax
movzx esi, al
mov dword [rsp + 0x44], esi
mov eax, dword [rsp + rsi*4 + 0x90]
add r10d, eax
and r10d, r11d
mov dword [rsp + 0x40], r10d
jge 0x1800059e1
dec r10d
or r10d, 0xffffff00
inc r10d
mov dword [rsp + 0x40], r10d
movzx ecx, al
movsxd rdx, r10d
mov byte [rsp + 0x4c], cl
mov eax, dword [rsp + rdx*4 + 0x90]
mov dword [rsp + rsi*4 + 0x90], eax
mov dword [rsp + rdx*4 + 0x90], ecx
mov edx, dword [rsp + rsi*4 + 0x90]
add edx, ecx
and edx, r11d
jge 0x180005a18
dec edx
or edx, 0xffffff00
inc edx
mov rsi, qword [rsp + 0x70]
mov r8, qword [rsp + 0x4c0]
mov r11, qword [rsp + 0x4d0]
movsxd rcx, edx
mov eax, r9d
inc r9d
mov dword [rsp + 0x48], r9d
mov dl, byte [rsp + rcx*4 + 0x90]
mov ecx, dword [rsp + 0x78]
xor dl, byte [rax + r8]
mov byte [rcx + r11], dl
inc ecx
dec esi
mov dword [rsp + 0x78], ecx
mov qword [rsp + 0x70], rsi
mov ecx, 0x4f
jmp 0x1800051a2
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_EncodePointer]
jmp 0x180005a76
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9, qword [rsp + 0x4d8]
mov r10d, dword [rsp + 0x40]
movsxd rbp, dword [rsp + 0x44]
mov edx, 0x39
mov r8d, 0x11
mov rbx, qword [section..data]
mov esi, 0x1e
sub sil, bl
movzx ecx, sil
lea rax, [rcx - 0x13]
cmp rax, 3
ja 0x180005abc
xor rbx, 0x2b8
jmp 0x180005b96
cmp rax, 0x4b
jbe 0x180005ad1
add rbx, 0x255
and rbx, rax
jmp 0x180005b96
cmp rax, 9
jne 0x180005ae9
xor edx, edx
mov eax, 0x242
div rbx
mov rbx, rax
jmp 0x180005b96
cmp rax, 0x2b
jne 0x180005b20
cmp sil, 0x3e
jne 0x180005b96
xor edx, edx
mov rax, rbp
div qword [rsp + 0x4e0]
movzx eax, byte [rdx + r9]
add eax, dword [rsp + rbp*4 + 0x90]
add eax, r10d
movzx r10d, al
mov dword [rsp + 0x40], r10d
jmp 0x180005b96
cmp rax, r8
je 0x18000622b
cmp rax, rdx
ja 0x180005a93
cmp rax, 0xe
ja 0x180005b4d
mov r9, rax
mov qword [rsp + 0x20], rcx
mov r8, rax
mov rdx, rbx
call fcn.180004de0
jmp 0x180005b8e
cmp rax, 0x64
ja 0x18000622e
cmp rax, 0x19
ja 0x180005b6c
mov edx, eax
mov rcx, rbx
call fcn.180006240
jmp 0x180005fdd
cmp rax, 0x42
jne 0x180005b7a
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x180005b91
mov ecx, 0x41
cmp rax, rcx
jne 0x180005b96
mov r8d, ebx
mov edx, ecx
call fcn.180003298
mov sil, al
mov r10d, dword [rsp + 0x40]
movzx eax, sil
lea rdi, [rax + 0x67]
cmp rbx, 7
jb 0x1800061cb
mov ecx, 0x2f
cmp rbx, rcx
jne 0x180005c7b
movzx edx, sil
mov r8d, edx
call fcn.180003298
mov ebx, eax
movabs r8, 0x4bd98416163ab4e0
mov al, dil
mov edx, 0x3d
sub al, dl
and sil, al
cmp rbx, 0x20
jae 0x180005d3f
movzx ecx, sil
mov edx, ebx
call fcn.180006240
mov rbx, rax
mov edx, 0x3d
movabs r8, 0x4bd98416163ab4e0
mov r10d, dword [rsp + 0x40]
movzx eax, di
movzx ecx, bx
imul ecx, eax
xor cx, 0x68
cmp rbx, r8
jne 0x180006000
mov r9, qword [rsp + 0x4d8]
mov r11d, 0x48
cmp rdi, 0xb
jb 0x180004e86
cmp rdi, rdx
jbe 0x180005f39
cmp rdi, 0x35
jb 0x180005f39
cmp rdi, 0xa5
je 0x180005fef
lea edx, [r11 - 0xf]
lea r8d, [r11 - 0x37]
cmp rdi, 0x60
jbe 0x180005a93
mov rbp, qword [rsp + 0x60]
cmp rdi, 0x37
jb 0x180004e1e
jmp 0x18000601e
mov r9, qword [rsp + 0x4d8]
mov ecx, 0xc
lea edx, [rcx + 0x2d]
lea r8d, [rcx + 5]
cmp rbx, rcx
jbe 0x180005a93
lea ecx, [rdx + 0xa]
cmp rbx, rcx
jne 0x180005cba
mov qword [rsp + 0x20], rcx
mov r8d, ecx
mov edx, ecx
mov r9, rax
mov rcx, rax
call fcn.180004de0
jmp 0x180005fdd
cmp rbx, 0x36
ja 0x180005cde
mov r9, rdi
mov qword [rsp + 0x20], rbx
mov r8, rdi
mov rdx, rax
mov rcx, rdi
call fcn.180004de0
mov rbx, rax
jmp 0x180005bc4
cmp rbx, 0x20
jb 0x180005bc4
mov r9, qword [rsp + 0x4d8]
cmp rbx, 0x4c
jb 0x180005a93
cmp rbx, 0x5d
je 0x180005bc4
cmp rbx, 6
jb 0x180005bc4
mov eax, 0x31
cmp rbx, rax
jbe 0x180006181
movabs r8, 0x4bd98416163ab4e0
cmp rbx, r8
jne 0x180005bce
mov al, byte [rsp + rbp*4 + 0x90]
mov byte [rsp + 0x4c], al
jmp 0x180005bce
cmp rbx, 0x62
jb 0x180006226
cmp rbx, 9
ja 0x180005d65
movzx eax, sil
add rax, 0x1c0
mov qword [0x18002e008], rax
jmp 0x180005c02
cmp rbx, 0x20
jbe 0x1800060c0
cmp rbx, 0x45
je 0x180005c02
cmp rbx, 0x1b
jne 0x180005d9e
movzx r9d, sil
mov r8, rbx
mov rdx, rdi
mov qword [rsp + 0x20], rdi
mov rcx, rdi
call fcn.180004de0
mov rdi, rax
jmp 0x180005bf3
cmp rbx, 0x53
jb 0x18000622b
cmp rbx, 0x57
jne 0x180005db8
mov edi, 0x363
jmp 0x180005c02
cmp rbx, 0x63
ja 0x180005dcc
call qword [sym.imp.KERNEL32.dll_GetConsoleCP]
mov sil, al
jmp 0x180005bf3
cmp rbx, r8
jne 0x180005f96
cmp sil, 0xa
jae 0x180005df4
movzx ecx, sil
mov r9, r8
mov r8, rdi
mov qword [rsp + 0x20], rcx
mov rdx, rdi
call fcn.180004de0
jmp 0x180005dc4
cmp sil, 0x33
jbe 0x180005e10
lea rax, [rdi + 0x1e3]
and rax, rdi
mov qword [0x18002e018], rax
jmp 0x180005c02
cmp sil, 0x59
ja 0x18000621b
cmp sil, 0x2a
jbe 0x180005e39
imul rax, rdi, 0x1cd
xor rax, 0x2e8
mov qword [0x18002e010], rax
jmp 0x180005c02
mov r10d, dword [rsp + 0x40]
cmp sil, 0x28
jne 0x180005f41
cmp rdi, 0x51
jne 0x180005e58
mov ebx, 0x3b3
jmp 0x180005c07
mov r9, qword [rsp + 0x4d8]
mov edx, 0x39
cmp rdi, 0x3a
jbe 0x180005a8d
cmp rdi, 0x5b
jb 0x180005f8c
cmp rdi, 0x52
jae 0x180005e91
mov edx, 0x163ab4e0
mov rcx, rdi
call fcn.180006240
jmp 0x180005d96
cmp rdi, 0x4b
jbe 0x180005f39
cmp rdi, 0xa5
jne 0x180005ebb
movsxd r10, r10d
mov ecx, dword [rsp + r10*4 + 0x90]
mov dword [rsp + rbp*4 + 0x90], ecx
jmp 0x180005f8c
mov r9, qword [rsp + 0x4d8]
cmp rdi, 0x56
jb 0x180005a8d
mov r11d, 0x48
cmp rdi, 0x4c
je 0x180004e86
lea eax, [r11 - 0x38]
cmp rdi, rax
jb 0x180004e86
cmp rdi, 0x24
jne 0x180005efa
mov edi, 0x36b
jmp 0x180005f8c
cmp rdi, 0x41
je 0x18000609c
cmp rdi, 2
jae 0x180005f25
mov r9d, 0x28
mov qword [rsp + 0x20], r8
mov ecx, r9d
mov rdx, rdi
call fcn.180004de0
jmp 0x180005bf0
mov eax, 0x1d
cmp rdi, rax
jbe 0x180005f39
mov eax, 0x1c
cmp rdi, rax
jae 0x180005f8c
mov rax, r8
jmp 0x18000622e
mov r9, qword [rsp + 0x4d8]
mov edx, 0x39
cmp sil, 0x5f
ja 0x180005a8d
test sil, sil
jne 0x180005f74
mov r8d, 0x163ab4e0
mov edx, edi
mov rcx, rdi
call fcn.180003298
mov ebx, eax
jmp 0x180005bf3
cmp sil, 0x41
ja 0x180006226
mov eax, 0x4f
cmp sil, al
ja 0x180006189
mov edx, 0x3d
jmp 0x180005c07
mov eax, 0x30
cmp rbx, rax
jae 0x180005fab
movzx ecx, sil
mov edx, ebx
jmp 0x180005e87
cmp rbx, 0x55
jb 0x1800061b7
cmp rbx, 0x58
jbe 0x1800060c0
cmp rbx, 0x59
je 0x180006197
mov eax, 0x1d
cmp rbx, rax
jne 0x180005c02
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov r10d, dword [rsp + 0x40]
mov r9, qword [rsp + 0x4d8]
jmp 0x180005a88
movzx ecx, byte [rsp + 0x4c]
movsxd rax, r10d
mov dword [rsp + rax*4 + 0x90], ecx
jmp 0x18000601e
cmp rbx, 0x28
jb 0x1800060b4
cmp rbx, 0x60
jb 0x180006221
cmp rbx, 0x27
jb 0x18000621b
mov esi, dword [rsp + 0x44]
mov r11d, 0x48
mov rbx, qword [rsp + 0x68]
inc esi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov r9, qword [rsp + 0x4d8]
jmp 0x180004e63
mov edx, r11d
mov rcx, r11
call fcn.180006240
jmp 0x1800060c0
movzx edx, bpl
movzx ecx, si
jmp 0x18000604c
movzx ecx, r9w
movzx r9d, dl
movzx edx, bx
mov qword [rsp + 0x20], rcx
mov r8, rcx
call qword [sym.imp.KERNEL32.dll_HeapQueryInformation]
jmp 0x1800060c0
mov rdx, rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x1800060ce
movzx r8d, dil
mov edx, ebx
mov rcx, rbx
call fcn.180003298
mov ebx, eax
mov qword [rsp + 0x68], rbx
jmp 0x1800060ce
mov qword [rsp + 0x20], 0x28
mov r9, r8
mov edx, 0x163ab4e0
mov ecx, 0x28
jmp 0x18000606c
mov rdx, rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [rsp + 0x44]
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x68]
mov r10d, dword [rsp + 0x40]
movabs rcx, 0x4d53fe2a3f867323
mov r9, qword [rsp + 0x4d8]
mov rax, qword [0x18002e008]
cmp rax, rcx
jne 0x1800060fb
movsxd rax, esi
mov dword [rsp + rax*4 + 0x90], esi
mov rbp, qword [rsp + 0x60]
inc esi
mov r11d, 0x48
jmp 0x180004e55
mov edx, 0xff
mov qword [rsp + 0x30], 0xff
mov dword [rsp + 0x28], r11d
mov ecx, edx
mov r9, rdi
mov dword [rsp + 0x20], r11d
mov r8d, r11d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x180006146
movzx r8d, dl
movzx edx, dl
movzx ecx, r9w
call qword [sym.imp.SHELL32.dll_ExtractIconA]
mov rbp, qword [rsp + 0x60]
mov r10d, dword [rsp + 0x40]
mov r9, qword [rsp + 0x4d8]
jmp 0x180004e18
movzx ecx, bpl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
jmp 0x180006146
movzx edx, cl
mov r8, r11
mov r9d, edx
mov qword [rsp + 0x20], r11
mov rcx, r11
call fcn.180004de0
jmp 0x18000614b
call qword [sym.imp.KERNEL32.dll_GetVersion]
jmp 0x180006146
movzx ecx, sil
mov edx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x180006146
movzx eax, sil
mov r9, rdi
mov r8d, 0x59
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x180006146
movzx r8d, sil
mov edx, ebx
movzx ecx, sil
call fcn.180003298
jmp 0x180006146
movzx edx, sil
mov r8d, edx
jmp 0x1800061bd
mov eax, 0xff
jmp 0x18000622e
mov eax, 0x25
jmp 0x18000622e
mov ecx, 0xff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, r9
jmp 0x18000622e
movzx eax, dl
jmp 0x18000622e
movzx eax, bx
jmp 0x18000622e
movzx eax, si
jmp 0x18000622e
mov rax, r11
jmp 0x18000622e
mov eax, 0x5b
jmp 0x18000622e
movzx eax, dil
jmp 0x18000622e
mov eax, 0x3e
jmp 0x18000622e
movzx eax, sil
jmp 0x18000622e
movzx eax, cx
jmp 0x18000622e
mov rax, rdi
jmp 0x18000622e
mov rax, rbx
add rsp, 0x498
pop rdi
pop rsi
pop rbp
pop rbx
ret