Function at 0x18010ec40
Capabilities:
Encrypt data using speck

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xfb8
movaps xmmword [rsp + 0xfa0], xmm8
movdqa xmmword [rsp + 0xf90], xmm7
movaps xmmword [rsp + 0xf80], xmm6
mov rsi, rdx
mov qword [rsp + 0xe8], rcx
mov rbx, qword [rsp + 0x1038]
mov r14, qword [rsp + 0x1030]
mov r15, qword [rsp + 0x1028]
mov rax, qword [rsp + 0x1020]
mov qword [rsp + 0x230], rdx
mov qword [rsp + 0x248], rax
shr rsi, 1
cmp rsi, rax
jae 0x180110da6
test r14, r14
je 0x180110e85
lea r12, [r15 + r14*8]
mov r13, qword [rbx]
mov rbp, qword [rbx + 8]
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x188], rax
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0x150], rax
xorps xmm6, xmm6
pcmpeqd xmm7, xmm7
mov eax, 8
mov qword [rsp + 0xf0], rax
xor eax, eax
mov qword [rsp + 0x140], rax
xor eax, eax
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x1f0], r12
mov qword [rsp + 0x1e8], r13
mov qword [rsp + 0x1e0], rbp
jmp 0x18010ed86
mov rax, qword [rsp + 0x158]
mov qword [rsi + 0xe0], rax
mov rax, qword [rsp + 0x160]
mov qword [rsi + 0xe8], rax
movzx eax, word [rbp]
movzx edx, byte [rbp + 2]
shl edx, 0x10
or edx, eax
mov rax, qword [rsp + 0x188]
mov r8, qword [rax]
mov rax, qword [rsp + 0x150]
mov r9, qword [rax]
mov rcx, rsi
call fcn.1801122b0
add r15, 8
cmp r15, r12
je 0x180110de0
mov rax, qword [r15]
movzx edi, word [rax + 0x38]
mov rbx, qword [rax + 0x40]
mov r14, qword [rax + 0x50]
mov rcx, qword [rax + 0x58]
mov qword [rsp + 0x168], rcx
mov rcx, qword [rax + 0x78]
mov qword [rsp + 0x160], rcx
mov rax, qword [rax + 0x90]
mov qword [rsp + 0x158], rax
mov rsi, qword [r13]
cmp qword [rsi + 0x18], 0
je 0x18010eef2
mov rcx, qword [rsi + 0x20]
mov rdx, qword [rsi + 0x28]
mov r8, r14
call fcn.1801113d0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
mov r8, rax
shr r8, 0x39
movd xmm0, r8d
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
lea r8, [rcx - 0x158]
xor r9d, r9d
and rax, rdx
movdqu xmm1, xmmword [rcx + rax]
movdqa xmm2, xmm0
pcmpeqb xmm2, xmm1
pmovmskb r10d, xmm2
nop dword [rax + rax]
test r10w, r10w
je 0x18010ee50
lea esi, [r10 - 1]
and esi, r10d
tzcnt r10d, r10d
add r10, rax
and r10, rdx
neg r10
imul r11, r10, 0x158
mov r10d, esi
cmp qword [r8 + r11], r14
jne 0x18010ee20
jmp 0x18010ee70
pcmpeqb xmm1, xmm7
pmovmskb r10d, xmm1
test r10d, r10d
jne 0x18010eef2
add rax, r9
add rax, 0x10
add r9, 0x10
jmp 0x18010ee06
lea rsi, [rcx + r11]
add rsi, 0xfffffffffffffeb0
mov rax, qword [rcx + r11 - 0x60]
test rax, rax
je 0x18010ed30
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x3a0], 0
mov qword [rsp + 0x7b0], 0
lea r8, [rsp + 0x7b0]
mov qword [rsp + 0x20], r8
lea rdx, [rsp + 0x3a0]
mov r9, r8
call sub.KERNEL32.dll_GetProcessTimes
movabs rax, 0xd6bf94d5e57a42bd
mul qword [rsp + 0x3a0]
shr rdx, 0x17
movabs rax, 0xfffffffd49ef6f00
add rdx, rax
cmp rdx, qword [rsi + 0x118]
je 0x18010ed30
mov qword [rsp + 0x250], r14
test rbx, rbx
je 0x18010f200
and edi, 0xfffffffe
add rdi, rbx
mov qword [rsp + 0x3a0], rbx
mov qword [rsp + 0x3a8], rdi
mov word [rsp + 0x3b0], 0
mov qword [rsp + 0x7b0], 1
lea rax, [rsp + 0x7b8]
movups xmmword [rax], xmm6
lea rcx, [rsp + 0x7b0]
lea rdx, [rsp + 0x3a0]
call fcn.18010deb0
mov rax, qword [rsp + 0x7c0]
mov qword [rsp + 0x120], rax
movdqu xmm0, xmmword [rsp + 0x7b0]
movdqa xmmword [rsp + 0x110], xmm0
xor edi, edi
cmp qword [rsp + 0x168], 0
setne dil
test r14, r14
je 0x18010f0e0
mov rax, qword [rsp + 0x150]
mov rax, qword [rax]
mov qword [rsp + 0x228], rax
movzx eax, word [rbp]
mov dword [rsp + 0xf8], eax
movzx esi, byte [rbp + 2]
mov ecx, 0x410
xor edx, edx
mov r8d, r14d
call sub.KERNEL32.dll_OpenProcess
mov rbx, rax
test rax, rax
jne 0x18010efdd
mov ecx, 0x1000
xor edx, edx
mov r8d, r14d
call sub.KERNEL32.dll_OpenProcess
mov rbx, rax
test rax, rax
je 0x18010f0e0
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x220], rdi
mov r8d, 0x20a
lea rdi, [rsp + 0x7b0]
mov rcx, rdi
xor edx, edx
call fcn.180181020
mov rcx, rbx
xor edx, edx
mov r8, rdi
mov r9d, 0x105
call sub.psapi.dll_GetModuleFileNameExW
mov r8d, 0x105
lea rcx, [rsp + 0x3a0]
mov rdx, rdi
call fcn.180112130
mov r13, qword [rsp + 0x3a0]
mov rbp, qword [rsp + 0x3a8]
mov r12, qword [rsp + 0x3b0]
test r12, r12
je 0x18010f287
js 0x180111183
movzx eax, byte [0x18021ea38]
mov rax, qword [0x18021e9c0]
test rax, rax
jne 0x18010f07b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x180111198
mov qword [0x18021e9c0], rax
mov rcx, rax
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x180111198
mov rdi, rax
mov rcx, rax
mov rdx, r13
mov r8, r12
call fcn.180180980
movzx edx, byte [rdi]
cmp dl, 0x2f
mov eax, 0x5c
cmove edx, eax
cmp r12, 1
mov qword [rsp + 0x48], rdi
jne 0x18010f2ba
xor ecx, ecx
xor r10d, r10d
xor r8d, r8d
xor eax, eax
xor edi, edi
xor r9d, r9d
xor r11d, r11d
jmp 0x18010f470
lea rcx, [rsp + 0x320]
movups xmmword [rcx - 0xb0], xmm6
mov qword [rsp + 0x268], 1
mov byte [rsp + 0x280], 1
movups xmmword [rcx - 0x90], xmm6
mov qword [rsp + 0x288], 1
mov byte [rsp + 0x2a0], 1
movups xmmword [rcx - 0x70], xmm6
mov qword [rsp + 0x2a8], 1
mov byte [rsp + 0x2c0], 1
movups xmmword [rcx + 0x38], xmm6
movups xmmword [rcx + 0x28], xmm6
mov rax, qword [rsp + 0x120]
mov qword [rcx - 0x48], rax
movdqa xmm0, xmmword [rsp + 0x110]
movdqu xmmword [rcx - 0x58], xmm0
mov qword [rsp + 0x2e0], 8
movups xmmword [rcx - 0x38], xmm6
mov qword [rsp + 0x310], r14
mov qword [rsp + 0x318], 0
mov qword [rsp + 0x2f8], 8
movups xmmword [rcx - 0x20], xmm6
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x330], rax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x338], rax
mov qword [rsp + 0x250], rdi
mov rax, qword [rsp + 0x168]
mov qword [rsp + 0x258], rax
mov dword [rsp + 0x260], 1
mov qword [rsp + 0x340], 0
mov dword [rsp + 0x398], 0
movups xmmword [rcx + 0x48], xmm6
mov byte [rsp + 0x39c], 1
movups xmmword [rcx + 0x68], xmm6
movups xmmword [rcx + 0x58], xmm6
jmp 0x18011023f
test r14, r14
je 0x18010f2e5
cmp r14, 4
jne 0x18010f353
movzx eax, byte [0x18021ea38]
mov rax, qword [0x18021e9c0]
test rax, rax
jne 0x18010f23c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x1801111a7
mov qword [0x18021e9c0], rax
mov r8d, 6
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x1801111a7
mov word [rax + 4], 0x6d65
mov dword [rax], 0x74737953
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], 6
mov qword [rsp + 0x120], 6
jmp 0x18010ef71
mov eax, 1
mov qword [rsp + 0x48], rax
mov ecx, 1
mov rdx, r13
mov r8, r12
call fcn.180180980
xor ecx, ecx
xor r10d, r10d
xor r8d, r8d
xor eax, eax
xor edi, edi
xor r9d, r9d
xor r11d, r11d
xor edx, edx
jmp 0x18010f470
movzx r11d, byte [rdi + 1]
cmp r11b, 0x2f
cmove r11d, eax
cmp r12, 2
jne 0x18010f3cf
xor ecx, ecx
xor r10d, r10d
xor r8d, r8d
xor eax, eax
xor edi, edi
xor r9d, r9d
jmp 0x18010f470
movzx eax, byte [0x18021ea38]
mov rax, qword [0x18021e9c0]
test rax, rax
jne 0x18010f30e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x1801111b8
mov qword [0x18021e9c0], rax
mov r8d, 4
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x1801111b8
mov dword [rax], 0x656c6449
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], 4
mov qword [rsp + 0x120], 4
jmp 0x18010ef71
lea rax, [rsp + 0x250]
mov qword [rsp + 0x3a0], rax
lea rax, [0x1801120d0]
mov qword [rsp + 0x3a8], rax
lea rax, [0x1801e4370]
mov qword [rsp + 0x7b0], rax
mov qword [rsp + 0x7b8], 1
mov qword [rsp + 0x7d0], 0
lea rax, [rsp + 0x3a0]
mov qword [rsp + 0x7c0], rax
mov qword [rsp + 0x7c8], 1
lea rcx, [rsp + 0x110]
lea rdx, [rsp + 0x7b0]
call fcn.18001dcc0
jmp 0x18010ef71
movzx r9d, byte [rdi + 2]
cmp r9b, 0x2f
cmove r9d, eax
cmp r12, 3
jne 0x18010f3f3
xor ecx, ecx
xor r10d, r10d
xor r8d, r8d
xor eax, eax
xor edi, edi
jmp 0x18010f470
mov rcx, rdi
movzx edi, byte [rdi + 3]
cmp dil, 0x2f
cmove edi, eax
cmp r12, 4
mov ebx, 0x5c
jne 0x18010f418
xor ecx, ecx
xor r10d, r10d
xor r8d, r8d
xor eax, eax
jmp 0x18010f470
movzx eax, byte [rcx + 4]
cmp al, 0x2f
cmove eax, ebx
cmp r12, 5
jne 0x18010f431
xor ecx, ecx
xor r10d, r10d
xor r8d, r8d
jmp 0x18010f470
movzx r8d, byte [rcx + 5]
cmp r8b, 0x2f
cmove r8d, ebx
cmp r12, 6
jne 0x18010f44b
xor ecx, ecx
xor r10d, r10d
jmp 0x18010f470
movzx r10d, byte [rcx + 6]
cmp r10b, 0x2f
cmove r10d, ebx
cmp r12, 7
jne 0x18010f462
xor ecx, ecx
jmp 0x18010f470
movzx ecx, byte [rcx + 7]
cmp cl, 0x2f
cmove ecx, ebx
shl rcx, 0x38
cmp r12, 8
mov ebx, 8
cmovb rbx, r12
cmp rbx, 2
mov qword [rsp + 0x218], r15
mov qword [rsp + 0x210], r13
mov qword [rsp + 0x208], rbp
jb 0x18010f51a
movzx r11d, r11b
shl r11, 8
movzx edx, dl
or rdx, r11
cmp edx, 0x5c5c
jne 0x18010f51a
mov edx, ebx
and edx, 0xe
cmp edx, 2
je 0x18010f569
movzx edx, dil
shl edx, 8
movzx r9d, r9b
or r9d, edx
movzx edx, r9w
cmp edx, 0x5c2e
je 0x18010f66c
cmp edx, 0x5c3f
jne 0x18010f569
cmp r12, 3
jbe 0x180111183
mov rdi, qword [rsp + 0x48]
cmp byte [rdi], 0x2f
je 0x18010f513
cmp byte [rdi + 1], 0x2f
je 0x18010f513
cmp byte [rdi + 2], 0x2f
je 0x18010f513
cmp byte [rdi + 3], 0x2f
jne 0x18011078d
lea rdx, [r12 - 2]
jmp 0x18010f585
mov bl, 6
cmp r12, 2
jb 0x18010f5c4
mov bl, 6
mov rdi, qword [rsp + 0x48]
cmp byte [rdi + 1], 0x3a
jne 0x18010f667
movzx eax, byte [rdi]
mov ecx, eax
and cl, 0xdf
add cl, 0xbf
cmp cl, 0x1a
jae 0x18010f667
lea ecx, [rax - 0x61]
cmp cl, 0x1a
setb cl
shl cl, 5
xor cl, al
mov byte [rsp + 0x37], cl
mov edx, 2
mov bl, 5
jmp 0x18010f6cb
cmp r12, 1
jbe 0x180111183
mov rdx, r12
add rdx, 0xfffffffffffffffe
mov rdi, qword [rsp + 0x48]
je 0x18010f665
lea rcx, [rdi + 2]
mov r8d, 2
sub r8, r12
xor eax, eax
nop word cs:[rax + rax]
movzx r9d, byte [rdi + rax + 2]
cmp r9d, 0x2f
je 0x18010f5dd
cmp r9d, 0x5c
je 0x18010f5dd
inc rax
mov r9, r8
add r9, rax
jne 0x18010f5a0
mov bl, 6
jmp 0x18010f651
mov rax, r12
mov rdi, qword [rsp + 0x48]
mov rdx, rdi
test rax, rax
jne 0x18010f6e0
jmp 0x18010f6f3
lea r10, [rdx - 1]
mov bl, 6
sub r10, rax
je 0x18010f651
lea r8, [rdi + rax]
add r8, 3
mov r11, rax
sub r11, rdx
inc r11
lea rdx, [rdi + rax]
xor r9d, r9d
movzx edi, byte [rdx + r9 + 3]
cmp edi, 0x2f
je 0x18010f61e
cmp edi, 0x5c
je 0x18010f61e
inc r9
mov rdi, r11
add rdi, r9
jne 0x18010f600
mov r9, r10
test rax, rax
mov rdi, qword [rsp + 0x48]
je 0x18010f651
test r9, r9
je 0x18010f651
lea rdx, [r9 + 1]
test r9, r9
cmove rdx, r9
lea rdx, [rax + rdx + 2]
mov bl, 4
mov qword [rsp + 0x100], r8
mov qword [rsp + 0x138], r9
jmp 0x18010f6b2
mov rax, r12
mov rdx, rdi
test rax, rax
jne 0x18010f6e0
jmp 0x18010f6f3
mov bl, 6
mov rdx, rdi
jmp 0x18010f6e0
cmp r12, 3
mov rdi, qword [rsp + 0x48]
jbe 0x180111183
lea rcx, [rdi + 4]
mov rdx, r12
xor eax, eax
add rdx, 0xfffffffffffffffc
je 0x18010f6ac
nop word [rax + rax]
movzx r8d, byte [rcx + rax]
cmp r8d, 0x2f
je 0x18010f6ac
cmp r8d, 0x5c
je 0x18010f6ac
inc rax
cmp rdx, rax
jne 0x18010f690
mov rax, rdx
lea rdx, [rax + 4]
mov bl, 3
mov qword [rsp + 0x200], rcx
mov qword [rsp + 0x1f8], rax
cmp r12, rdx
jb 0x180111183
mov rax, r12
sub rax, rdx
add rdx, rdi
test rax, rax
je 0x18010f6f3
nop dword [rax]
movzx eax, byte [rdx]
cmp al, 0x5c
sete cl
cmp al, 0x2f
sete bpl
or bpl, cl
jmp 0x18010f6f5
xor ebp, ebp
shl esi, 0x10
add dword [rsp + 0xf8], esi
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], r12
mov byte [rsp + 0x90], bl
movzx eax, byte [rsp + 0x37]
mov byte [rsp + 0x91], al
mov rax, qword [rsp + 0x200]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0xb0], rax
mov byte [rsp + 0xba], bpl
mov word [rsp + 0xb8], 0x200
cmp bl, 6
mov rsi, r12
lea r13, [rsp + 0x90]
mov eax, 0
cmove r13, rax
lea r12, [rsp + 0xa0]
mov eax, 0x10
cmove r12, rax
lea r15, [rsp + 0xb0]
mov eax, 0x20
cmove r15, rax
mov dil, 2
mov qword [rsp + 0x148], rsi
mov ecx, edi
nop word [rax + rax]
cmp cl, 2
jne 0x18010f8a0
lea rcx, [rsp + 0x80]
call fcn.1801026c0
cmp bl, 6
jne 0x18010f7e0
xor ecx, ecx
jmp case.0x18010f7f8.2
movzx edx, byte [r13]
mov ecx, 6
lea r8, [0x1801111ec]
movsxd rdx, dword [r8 + rdx*4]
add rdx, r8
jmp rdx
mov rcx, qword [r12]
add rcx, 4
jmp case.0x18010f7f8.2
mov rcx, qword [r12]
mov rdx, qword [r15]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x18010f7f8.2
mov rcx, qword [r12]
mov rdx, qword [r15]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x18010f7f8.2
mov ecx, 2
nop
movzx eax, al
movzx edx, bpl
add rdx, rcx
add rdx, rax
cmp rsi, rdx
jbe 0x18010f900
lea rcx, [rsp + 0x7b0]
lea rdx, [rsp + 0x80]
call fcn.1801027d0
sub rsi, qword [rsp + 0x7b0]
jb 0x180111183
movzx eax, byte [rsp + 0x7b8]
mov qword [rsp + 0x88], rsi
mov cl, 2
cmp al, 0xa
je 0x18010f7c0
jmp case.0x18010f931.2
movzx eax, cl
test eax, eax
je 0x18010f910
mov byte [rsp + 0xb9], 0
test bpl, bpl
jne 0x18010fbb9
xor edi, edi
cmp bl, 3
jb 0x18010f7b8
movzx eax, bl
cmp eax, 5
je 0x18010f7b8
cmp eax, 6
jne 0x180110808
lea rcx, [rsp + 0x80]
call fcn.1801026c0
xor edi, edi
test al, al
je 0x18010f7b8
jmp 0x18011081b
mov byte [rsp + 0xb9], 1
mov dil, 1
jmp 0x18010f7b8
cmp bl, 6
je case.default.0x18010f931
movzx eax, byte [r13]
mov dil, 3
lea rdx, [0x180111204]
mov dh, 0x45
add byte [rax - 0x49], al
add ecx, dword [rax - 0x73]
adc eax, 0x18dc
movsxd rcx, dword [rdx + rax*4]
add rcx, rdx
mov eax, ebx
jmp rcx
mov rcx, qword [r12]
add rcx, 4
mov eax, ebx
test rcx, rcx
jne case.0x18010f931.2
jmp case.default.0x18010f931
mov rax, qword [r12]
mov rcx, qword [r15]
lea rdx, [rcx + 1]
test rcx, rcx
cmove rdx, rcx
lea rcx, [rax + rdx]
add rcx, 8
mov eax, ebx
test rcx, rcx
jne case.0x18010f931.2
jmp case.default.0x18010f931
mov rax, qword [r12]
mov rcx, qword [r15]
lea rdx, [rcx + 1]
test rcx, rcx
cmove rdx, rcx
lea rcx, [rax + rdx]
add rcx, 2
mov eax, ebx
test rcx, rcx
je case.default.0x18010f931
nop word cs:[rax + rax]
add al, 0xfa
cmp al, 3
ja case.default.0x18010f931
movzx eax, al
dec rax
cmp rax, 2
ja case.default.0x18010f931
cmp bl, 6
je 0x18010f9ef
lea rcx, [rsp + 0x90]
mov rax, qword [rcx + 0x20]
mov qword [rsp + 0x7cf], rax
movdqu xmm0, xmmword [rcx + 1]
movdqu xmm1, xmmword [rcx + 0x11]
movdqa xmmword [rsp + 0x7c0], xmm1
movdqa xmmword [rsp + 0x7b0], xmm0
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x3a0], rax
mov qword [rsp + 0x3a8], rsi
mov byte [rsp + 0x3b0], bl
mov rax, qword [rsp + 0x7cf]
lea rcx, [rsp + 0x3b1]
mov qword [rcx + 0x1f], rax
movdqa xmm0, xmmword [rsp + 0x7b0]
movdqa xmm1, xmmword [rsp + 0x7c0]
movdqu xmmword [rcx + 0x10], xmm1
movdqu xmmword [rcx], xmm0
mov byte [rsp + 0x3da], bpl
mov byte [rsp + 0x3d8], 0
mov byte [rsp + 0x3d9], dil
cmp dil, 2
lea r13, [rsp + 0x3a0]
jne 0x18010fba3
lea r15, [rsp + 0x3c0]
movzx edi, bpl
cmp bl, 6
mov eax, 0x10
cmove r15, rax
lea r12, [rsp + 0x3d0]
mov eax, 0x20
cmove r12, rax
jne 0x18010faf0
nop
mov rcx, r13
call fcn.1801026c0
movzx eax, al
add rax, rdi
cmp rsi, rax
mov rbx, qword [rsp + 0x28]
jbe 0x18010fba8
lea rcx, [rsp + 0x7b0]
mov rdx, r13
call fcn.1801027d0
cmp byte [rsp + 0x7b8], 0xa
jne 0x18010fba8
sub rsi, qword [rsp + 0x7b0]
jb 0x180111183
mov qword [rsp + 0x3a8], rsi
jmp 0x18010fa90
mov rcx, r13
call fcn.1801026c0
mov ecx, 6
movzx edx, bl
lea r8, [0x18011121c]
movsxd rdx, dword [r8 + rdx*4]
add rdx, r8
jmp rdx
mov rcx, qword [r15]
add rcx, 4
jmp case.0x18010fb0e.2
mov rcx, qword [r15]
mov rdx, qword [r12]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x18010fb0e.2
mov rcx, qword [r15]
mov rdx, qword [r12]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x18010fb0e.2
mov ecx, 2
nop word cs:[rax + rax]
movzx eax, al
add rcx, rdi
add rcx, rax
cmp rsi, rcx
jbe 0x18010fba3
lea rcx, [rsp + 0x7b0]
mov rdx, r13
call fcn.1801027d0
cmp byte [rsp + 0x7b8], 0xa
jne 0x18010fba3
sub rsi, qword [rsp + 0x7b0]
jb 0x180111183
mov qword [rsp + 0x3a8], rsi
jmp 0x18010faf0
mov rbx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x148]
cmp rax, rsi
cmovb rsi, rax
jmp 0x18010fbf5
mov al, 6
test rsi, rsi
je 0x180111183
dec rsi
mov qword [rsp + 0x88], rsi
xor edi, edi
add al, 0xfa
cmp al, 3
jbe 0x18010f9aa
nop dword [rax + rax]
mov rsi, qword [rsp + 0x148]
lea r13, [rsp + 0x3a0]
mov rbx, qword [rsp + 0x28]
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov edx, 0x1a
lea r8, [rsp + 0x238]
mov r9d, 8
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x18010fde0
mov rdx, qword [rsp + 0x238]
test rdx, rdx
je 0x18010fceb
mov qword [rsp + 0x20], 0
mov r9d, 0x470
mov rcx, rbx
lea r8, [rsp + 0x7b0]
call sub.KERNEL32.dll_ReadProcessMemory
cmp eax, 1
jne 0x18010fde0
mov edx, dword [rsp + 0x7c0]
mov qword [rsp + 0x20], 0
mov r9d, 0x2a4
mov rcx, rbx
mov r8, r13
call sub.KERNEL32.dll_ReadProcessMemory
cmp eax, 1
jne 0x18010fde0
movzx ebp, word [rsp + 0x3c4]
mov edi, dword [rsp + 0x3c8]
mov r12d, dword [rsp + 0x3e4]
movzx r15d, word [rsp + 0x3e0]
mov ebx, dword [rsp + 0x3e8]
mov rax, qword [0x18021d050]
cmp rax, 2
jne 0x180110391
movzx eax, byte [0x18021d058]
test al, al
mov qword [rsp + 0x38], rdi
je 0x1801103aa
lea rcx, [rsp + 0x170]
mov rdi, qword [rsp + 0x28]
mov rdx, rdi
call fcn.1801127c0
jmp 0x18011041c
mov qword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
lea r8, [rsp + 0x190]
mov r9d, 0x30
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x18010fde0
mov rdx, qword [rsp + 0x198]
mov qword [rsp + 0x20], 0
mov r9d, 0x7c8
mov rcx, rbx
lea r8, [rsp + 0x7b0]
call sub.KERNEL32.dll_ReadProcessMemory
cmp eax, 1
jne 0x18010fde0
mov rdx, qword [rsp + 0x7d0]
mov qword [rsp + 0x20], 0
mov r9d, 0x410
mov rcx, rbx
mov r8, r13
call sub.KERNEL32.dll_ReadProcessMemory
cmp eax, 1
jne 0x18010fde0
movzx ebp, word [rsp + 0x3d8]
mov rdi, qword [rsp + 0x3e0]
mov r12, qword [rsp + 0x418]
movzx r15d, word [rsp + 0x410]
mov rbx, qword [rsp + 0x420]
mov rax, qword [0x18021d050]
cmp rax, 2
jne 0x180110857
movzx eax, byte [0x18021d058]
test al, al
mov qword [rsp + 0x38], rdi
je 0x180110870
lea rcx, [rsp + 0x1c8]
mov rdi, qword [rsp + 0x28]
mov rdx, rdi
call fcn.1801127c0
jmp 0x1801108e2
movaps xmmword [rsp + 0x7b0], xmm6
xorps xmm8, xmm8
mov eax, 8
mov qword [rsp + 0x40], rax
mov eax, 1
mov qword [rsp + 0x38], rax
xor edi, edi
xor ebp, ebp
mov r15d, 8
movaps xmm0, xmmword [rsp + 0x7b0]
movaps xmmword [rsp + 0x190], xmm0
mov eax, dword [rsp + 0x3a0]
mov ecx, dword [rsp + 0x3a3]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x53], ecx
mov qword [rsp + 0x3a0], 0
mov qword [rsp + 0x7b0], 0
lea r8, [rsp + 0x7b0]
mov qword [rsp + 0x20], r8
mov rcx, rbx
mov rdx, r13
mov r9, r8
call sub.KERNEL32.dll_GetProcessTimes
mov r12, qword [rsp + 0x3a0]
mov eax, dword [rsp + 0xf8]
and eax, 0xffffff
cmp eax, 0x10000
jae 0x18010fe9d
xor r13d, r13d
movzx eax, byte [0x18021ea38]
mov rax, qword [0x18021e9c0]
test rax, rax
jne 0x18010fffc
jmp 0x18010ffe6
mov qword [rsp + 0x80], 0
mov rcx, rbx
mov edx, 8
lea r8, [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x18010ffcb
mov rbx, qword [rsp + 0x80]
test rbx, rbx
je 0x18010ffcb
mov qword [rsp + 0xf8], r15
mov dword [rsp + 0xc0], 0
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call sub.ADVAPI32.dll_GetTokenInformation
test eax, eax
jne 0x18010ff1d
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x18010ffba
mov r15d, dword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov edx, 8
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x18010ffba
mov r15, rax
mov r9d, dword [rsp + 0xc0]
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov edx, 1
mov r8, r15
call sub.ADVAPI32.dll_GetTokenInformation
test eax, eax
je 0x18010ffa6
mov rdx, qword [r15]
lea rcx, [rsp + 0x7b0]
call fcn.180107150
mov r13, qword [rsp + 0x7b0]
test r13, r13
je 0x180110348
lea rax, [rsp + 0x7b8]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x3a0], xmm0
jmp 0x18011034b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsp + 0xf8]
xor r13d, r13d
mov rbx, qword [rsp + 0x28]
movzx eax, byte [0x18021ea38]
mov rax, qword [0x18021e9c0]
test rax, rax
jne 0x18010fffc
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x180111187
mov qword [0x18021e9c0], rax
mov r8d, 0x18
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x180111187
mov rcx, rax
mov rax, r12
movabs rdx, 0xd6bf94d5e57a42bd
mul rdx
shr rdx, 0x17
movabs rax, 0xfffffffd49ef6f00
add rdx, rax
mov r9, qword [rsp + 0x228]
cmp rdx, r9
mov eax, 0
cmovbe rax, rdx
sub r9, rax
mov qword [rcx], 1
mov qword [rcx + 8], 1
mov qword [rcx + 0x10], rbx
mov qword [rsp + 0x318], r13
movaps xmm0, xmmword [rsp + 0x3a0]
lea r8, [rsp + 0x320]
movups xmmword [r8], xmm0
mov rax, qword [rsp + 0x210]
mov qword [rsp + 0x268], rax
mov rax, qword [rsp + 0x208]
mov qword [rsp + 0x270], rax
mov r10, qword [rsp + 0x148]
mov qword [rsp + 0x278], r10
mov byte [rsp + 0x280], 1
mov eax, dword [rsp + 0x83]
mov dword [r8 - 0x9c], eax
mov eax, dword [rsp + 0x80]
mov dword [r8 - 0x9f], eax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x2a8], rax
mov qword [rsp + 0x2b0], r10
mov qword [rsp + 0x2b8], rsi
mov byte [rsp + 0x2c0], 1
mov eax, dword [rsp + 0x7b3]
mov dword [r8 - 0x5c], eax
mov eax, dword [rsp + 0x7b0]
mov dword [r8 - 0x5f], eax
movups xmmword [r8 + 0x38], xmm6
movups xmmword [r8 + 0x28], xmm6
mov rax, qword [rsp + 0x120]
mov qword [r8 - 0x48], rax
movaps xmm0, xmmword [rsp + 0x110]
movups xmmword [r8 - 0x58], xmm0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x2e0], rax
mov qword [rsp + 0x2e8], rdi
mov qword [rsp + 0x2f0], rbp
mov qword [rsp + 0x310], r14
mov qword [rsp + 0x2f8], r15
movups xmmword [rsp + 0x300], xmm8
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x288], rax
movdqa xmm0, xmmword [rsp + 0x190]
movdqu xmmword [r8 - 0x90], xmm0
mov byte [rsp + 0x2a0], 1
mov eax, dword [rsp + 0x53]
mov dword [r8 - 0x7c], eax
mov eax, dword [rsp + 0x50]
mov dword [r8 - 0x7f], eax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x330], rax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x338], rax
mov rax, qword [rsp + 0x220]
mov qword [rsp + 0x250], rax
mov rax, qword [rsp + 0x168]
mov qword [rsp + 0x258], rax
mov dword [rsp + 0x260], 1
mov qword [rsp + 0x340], rcx
mov qword [rsp + 0x368], rdx
mov qword [rsp + 0x370], r9
mov dword [rsp + 0x398], 0
mov byte [rsp + 0x39c], 1
movups xmmword [r8 + 0x68], xmm6
movups xmmword [r8 + 0x58], xmm6
mov r15, qword [rsp + 0x218]
mov r12, qword [rsp + 0x1f0]
mov r13, qword [rsp + 0x1e8]
mov rbp, qword [rsp + 0x1e0]
movzx eax, word [rbp]
movzx edx, byte [rbp + 2]
shl edx, 0x10
or edx, eax
mov rax, qword [rsp + 0x188]
mov r8, qword [rax]
mov rax, qword [rsp + 0x150]
mov r9, qword [rax]
lea rcx, [rsp + 0x250]
call fcn.1801122b0
mov rsi, qword [rsp + 0x250]
mov r8d, 0x148
lea rcx, [rsp + 0x7b0]
lea rdx, [rsp + 0x258]
call fcn.180180980
cmp rsi, 2
je 0x18010ed79
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x3a0], rax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x3a8], rax
mov rdi, qword [rsp + 0x140]
mov qword [rsp + 0x3b0], rdi
cmp rdi, rax
jne 0x180110303
lea rcx, [rsp + 0x3a0]
mov rdx, rdi
call fcn.180111550
mov rdi, qword [rsp + 0x3b0]
mov rcx, qword [rsp + 0x3a0]
mov rax, qword [rsp + 0x3a8]
mov qword [rsp + 0x108], rax
jmp 0x18011030b
mov rcx, qword [rsp + 0xf0]
imul rax, rdi, 0x150
mov qword [rcx + rax], rsi
mov qword [rsp + 0xf0], rcx
add rcx, rax
add rcx, 8
mov r8d, 0x148
lea rdx, [rsp + 0x7b0]
call fcn.180180980
inc rdi
mov qword [rsp + 0x140], rdi
jmp 0x18010ed79
xor r13d, r13d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x28]
mov r15, qword [rsp + 0xf8]
movzx eax, byte [0x18021ea38]
mov rax, qword [0x18021e9c0]
test rax, rax
jne 0x18010fffc
jmp 0x18010ffe6
call fcn.18018c660
movzx eax, byte [0x18021d058]
test al, al
mov qword [rsp + 0x38], rdi
jne 0x18010fcd1
lea rcx, [rsp + 0x80]
mov rdx, qword [rsp + 0x28]
mov r8, r12
mov r9, r15
call fcn.1801124f0
mov r12, qword [rsp + 0x80]
test r12, r12
je 0x180110400
mov rdi, qword [rsp + 0x88]
lea rcx, [rsp + 0x170]
mov rdx, r12
call fcn.180112640
test rdi, rdi
je 0x180110417
mov rcx, qword [0x18021e9c0]
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180110417
mov qword [rsp + 0x170], 8
lea rax, [rsp + 0x178]
movups xmmword [rax], xmm6
mov rdi, qword [rsp + 0x28]
mov r9d, 0x30
mov rcx, rdi
mov rdx, rbx
lea r8, [rsp + 0x80]
call sub.KERNEL32.dll_VirtualQueryEx
test rax, rax
je 0x1801106a0
mov r9, qword [rsp + 0x80]
sub r9, rbx
add r9, qword [rsp + 0x98]
lea rcx, [rsp + 0xc0]
mov rdx, rdi
mov r8, rbx
call fcn.1801124f0
mov r11, qword [rsp + 0xc0]
test r11, r11
je 0x1801106af
mov qword [rsp + 0x40], rbp
mov r12, qword [rsp + 0xc8]
mov rbp, qword [rsp + 0xd0]
mov qword [rsp + 0x50], 8
lea rax, [rsp + 0x58]
movups xmmword [rax], xmm6
mov rdi, rbp
add rdi, rbp
mov eax, 8
mov qword [rsp + 0x78], rax
xor eax, eax
mov qword [rsp + 0x70], rax
xor ecx, ecx
mov rbx, qword [rsp + 0x28]
cmp rcx, rbp
je 0x180110677
lea rdx, [r11 + rcx*2]
mov r9, rdi
sub r9, rcx
sub r9, rcx
xor eax, eax
xor r8d, r8d
mov r10, rdx
nop word [rax + rax]
cmp word [r10], 0
je 0x1801104fd
add r10, 2
dec r8
add rax, 2
add r9, 0xfffffffffffffffe
jne 0x1801104e0
jmp 0x180110677
mov r15, rcx
sub r15, r8
cmp r15, rcx
jb 0x180111183
cmp r15, rbp
ja 0x180111183
neg r8
mov rcx, rdx
nop dword [rax + rax]
test rax, rax
je 0x180110677
add rax, 0xfffffffffffffffe
cmp word [rcx], 0x3d
lea rcx, [rcx + 2]
jne 0x180110520
mov qword [rsp + 0x128], r12
mov qword [rsp + 0x130], r11
lea rcx, [rsp + 0x80]
call fcn.180102360
mov rdx, qword [rsp + 0x80]
mov r8, qword [rsp + 0x90]
lea rcx, [rsp + 0x190]
call fcn.180106000
mov r12, qword [rsp + 0x190]
mov rbx, qword [rsp + 0x1a0]
test r12, r12
je 0x180110590
mov r13, qword [rsp + 0x198]
jmp 0x1801105db
mov r13, qword [rsp + 0x198]
test rbx, rbx
je 0x1801105c4
js 0x180111183
movzx eax, byte [0x18021ea38]
mov edx, 1
mov rcx, rbx
call fcn.180032860
mov r12, rax
test rax, rax
jne 0x1801105ca
jmp 0x1801111da
mov r12d, 1
mov rcx, r12
mov rdx, r13
mov r8, rbx
call fcn.180180980
mov r13, rbx
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
cmp rdx, qword [rsp + 0x58]
jne 0x180110600
lea rcx, [rsp + 0x50]
call fcn.18007db50
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x60]
lea rax, [rdx + rdx*2]
mov qword [rcx + rax*8], r12
mov qword [rcx + rax*8 + 8], r13
mov qword [rsp + 0x78], rcx
mov qword [rcx + rax*8 + 0x10], rbx
inc rdx
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x60], rdx
cmp qword [rsp + 0x88], 0
je 0x180110646
mov r8, qword [rsp + 0x80]
mov rcx, qword [0x18021e9c0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
inc r15
mov rcx, r15
cmp rbp, r15
lea r13, [rsp + 0x3a0]
mov rbx, qword [rsp + 0x28]
mov r11, qword [rsp + 0x130]
mov r12, qword [rsp + 0x128]
jae 0x1801104b9
jmp 0x180111183
mov r15, qword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x58]
test r12, r12
je 0x180110699
mov rcx, qword [0x18021e9c0]
xor edx, edx
mov r8, r11
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbp, qword [rsp + 0x40]
jmp 0x1801106be
xorps xmm8, xmm8
mov r15d, 8
mov rbx, rdi
jmp 0x1801106be
xorps xmm8, xmm8
mov r15d, 8
mov rbx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x38]
lea rcx, [rsp + 0x190]
mov rdx, rbx
mov r9, rbp
call fcn.1801124f0
mov rbx, qword [rsp + 0x190]
test rbx, rbx
je 0x18011073c
mov r8, qword [rsp + 0x1a0]
mov rdi, qword [rsp + 0x198]
lea rcx, [rsp + 0x80]
mov rdx, rbx
call fcn.180112130
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x90]
movdqu xmm0, xmmword [rax - 8]
movdqa xmmword [rsp + 0x50], xmm0
test rdi, rdi
mov qword [rsp + 0x38], rcx
je 0x18011074b
mov rcx, qword [0x18021e9c0]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18011074b
movaps xmmword [rsp + 0x50], xmm6
mov eax, 1
mov qword [rsp + 0x38], rax
mov rbx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x40], rax
mov rdi, qword [rsp + 0x178]
mov rbp, qword [rsp + 0x180]
movaps xmm0, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x80], xmm0
mov eax, dword [rsp + 0x190]
mov ecx, dword [rsp + 0x193]
jmp 0x180110c55
cmp rbx, 3
jbe 0x180111183
and ebx, 0xc
cmp ebx, 4
je 0x18011082b
movzx edx, r10b
shl rdx, 0x30
or rdx, rcx
movzx ecx, r8b
shl rcx, 0x28
movzx eax, al
shl rax, 0x20
or rax, rcx
or rax, rdx
movabs rcx, 0x5c434e5500000000
cmp rax, rcx
jne 0x18011082b
cmp r12, 7
jbe 0x180111183
mov rcx, r12
add rcx, 0xfffffffffffffff8
je 0x180110cf4
lea rdx, [r12 - 8]
xor eax, eax
cmp byte [rdi + rax + 8], 0x5c
je 0x180110d35
inc rax
cmp rdx, rax
jne 0x1801107f0
jmp 0x180110cf6
mov al, 6
xor edi, edi
add al, 0xfa
cmp al, 3
jbe 0x18010f9aa
jmp case.default.0x18010f931
mov al, 7
test rsi, rsi
jne 0x18010fbc4
jmp 0x180111183
lea rcx, [rdi + 4]
lea rax, [r12 - 4]
cmp rax, 3
jae 0x180110c96
cmp r12, 4
je 0x180110d2a
cmp r12, 6
je 0x180110ca4
jmp 0x180110cdb
call fcn.18018c660
movzx eax, byte [0x18021d058]
test al, al
mov qword [rsp + 0x38], rdi
jne 0x18010fdba
lea rcx, [rsp + 0x80]
mov rdx, qword [rsp + 0x28]
mov r8, r12
mov r9, r15
call fcn.1801124f0
mov r12, qword [rsp + 0x80]
test r12, r12
je 0x1801108c6
mov rdi, qword [rsp + 0x88]
lea rcx, [rsp + 0x1c8]
mov rdx, r12
call fcn.180112640
test rdi, rdi
je 0x1801108dd
mov rcx, qword [0x18021e9c0]
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1801108dd
mov qword [rsp + 0x1c8], 8
lea rax, [rsp + 0x1d0]
movups xmmword [rax], xmm6
mov rdi, qword [rsp + 0x28]
mov r9d, 0x30
mov rcx, rdi
mov rdx, rbx
lea r8, [rsp + 0x80]
call sub.KERNEL32.dll_VirtualQueryEx
test rax, rax
je 0x180110b76
mov r9, qword [rsp + 0x80]
sub r9, rbx
add r9, qword [rsp + 0x98]
lea rcx, [rsp + 0x170]
mov rdx, rdi
mov r8, rbx
call fcn.1801124f0
mov r11, qword [rsp + 0x170]
test r11, r11
je 0x180110b85
mov qword [rsp + 0x40], rbp
mov r12, qword [rsp + 0x178]
mov rbp, qword [rsp + 0x180]
mov qword [rsp + 0xc0], 8
lea rax, [rsp + 0xc8]
movups xmmword [rax], xmm6
mov rdi, rbp
add rdi, rbp
mov eax, 8
mov qword [rsp + 0x78], rax
xor eax, eax
mov qword [rsp + 0x70], rax
xor ecx, ecx
mov rbx, qword [rsp + 0x28]
cmp rcx, rbp
je 0x180110b47
lea rdx, [r11 + rcx*2]
mov r9, rdi
sub r9, rcx
sub r9, rcx
xor eax, eax
xor r8d, r8d
mov r10, rdx
nop word cs:[rax + rax]
cmp word [r10], 0
je 0x1801109cd
add r10, 2
dec r8
add rax, 2
add r9, 0xfffffffffffffffe
jne 0x1801109b0
jmp 0x180110b47
mov r15, rcx
sub r15, r8
cmp r15, rcx
jb 0x180111183
cmp r15, rbp
ja 0x180111183
neg r8
mov rcx, rdx
nop dword [rax + rax]
test rax, rax
je 0x180110b47
add rax, 0xfffffffffffffffe
cmp word [rcx], 0x3d
lea rcx, [rcx + 2]
jne 0x1801109f0
mov qword [rsp + 0x128], r12
mov qword [rsp + 0x130], r11
lea rcx, [rsp + 0x80]
call fcn.180102360
mov rdx, qword [rsp + 0x80]
mov r8, qword [rsp + 0x90]
lea rcx, [rsp + 0x50]
call fcn.180106000
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
test r12, r12
je 0x180110a54
mov r13, qword [rsp + 0x58]
jmp 0x180110a9c
mov r13, qword [rsp + 0x58]
test rbx, rbx
je 0x180110a85
js 0x180111183
movzx eax, byte [0x18021ea38]
mov edx, 1
mov rcx, rbx
call fcn.180032860
mov r12, rax
test rax, rax
jne 0x180110a8b
jmp 0x1801111da
mov r12d, 1
mov rcx, r12
mov rdx, r13
mov r8, rbx
call fcn.180180980
mov r13, rbx
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
cmp rdx, qword [rsp + 0xc8]
jne 0x180110acd
lea rcx, [rsp + 0xc0]
call fcn.18007db50
mov rcx, qword [rsp + 0xc0]
mov rdx, qword [rsp + 0xd0]
lea rax, [rdx + rdx*2]
mov qword [rcx + rax*8], r12
mov qword [rcx + rax*8 + 8], r13
mov qword [rsp + 0x78], rcx
mov qword [rcx + rax*8 + 0x10], rbx
inc rdx
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0xd0], rdx
cmp qword [rsp + 0x88], 0
je 0x180110b16
mov r8, qword [rsp + 0x80]
mov rcx, qword [0x18021e9c0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
inc r15
mov rcx, r15
cmp rbp, r15
lea r13, [rsp + 0x3a0]
mov rbx, qword [rsp + 0x28]
mov r11, qword [rsp + 0x130]
mov r12, qword [rsp + 0x128]
jae 0x180110985
jmp 0x180111183
mov r15, qword [rsp + 0xc0]
movups xmm8, xmmword [rsp + 0xc8]
test r12, r12
je 0x180110b6f
mov rcx, qword [0x18021e9c0]
xor edx, edx
mov r8, r11
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbp, qword [rsp + 0x40]
jmp 0x180110b94
xorps xmm8, xmm8
mov r15d, 8
mov rbx, rdi
jmp 0x180110b94
xorps xmm8, xmm8
mov r15d, 8
mov rbx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x38]
lea rcx, [rsp + 0x50]
mov rdx, rbx
mov r9, rbp
call fcn.1801124f0
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x180110c09
mov r8, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
lea rcx, [rsp + 0x80]
mov rdx, rbx
call fcn.180112130
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x90]
movdqu xmm0, xmmword [rax - 8]
movdqa xmmword [rsp + 0xc0], xmm0
test rdi, rdi
mov qword [rsp + 0x38], rcx
je 0x180110c1b
mov rcx, qword [0x18021e9c0]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180110c1b
movaps xmmword [rsp + 0xc0], xmm6
mov eax, 1
mov qword [rsp + 0x38], rax
mov rbx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x1c8]
mov qword [rsp + 0x40], rax
mov rdi, qword [rsp + 0x1d0]
mov rbp, qword [rsp + 0x1d8]
movaps xmm0, xmmword [rsp + 0xc0]
movaps xmmword [rsp + 0x80], xmm0
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x53]
mov dword [rsp + 0xe0], eax
mov dword [rsp + 0xe3], ecx
movdqa xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x7b0], xmm0
mov eax, dword [rsp + 0xe0]
mov ecx, dword [rsp + 0xe3]
mov dword [rsp + 0x3a0], eax
mov dword [rsp + 0x3a3], ecx
jmp 0x18010fe0a
movzx edx, byte [rdi + 6]
cmp edx, 0x2f
je 0x180110ca4
cmp edx, 0x5c
jne 0x180110cdb
cmp byte [rdi + 5], 0x3a
jne 0x180110cdb
movzx edx, byte [rcx]
mov r8d, edx
and r8b, 0xdf
add r8b, 0xbf
cmp r8b, 0x19
ja 0x180110cdb
lea eax, [rdx - 0x61]
cmp al, 0x1a
setb al
shl al, 5
xor al, dl
mov byte [rsp + 0x37], al
mov edx, 6
mov bl, 2
jmp 0x18010f6cb
lea rdx, [r12 - 4]
xor r8d, r8d
cmp byte [rcx + r8], 0x5c
je 0x180110d27
inc r8
cmp rdx, r8
jne 0x180110ce3
jmp 0x180110d2a
xor ecx, ecx
lea rax, str.description___is_deprecated__use_Display
mov qword [rsp + 0x100], rax
lea rdx, [rcx + 8]
xor r10d, r10d
mov rax, rcx
mov qword [rsp + 0x138], r10
xor ecx, ecx
add rdx, rcx
lea rcx, [rdi + 8]
mov bl, 1
jmp 0x18010f6b2
mov rax, r8
lea rdx, [rax + 4]
xor ebx, ebx
jmp 0x18010f6b2
lea rcx, [r12 - 9]
lea rdx, [rdi + rax]
add rdx, 9
mov qword [rsp + 0x100], rdx
cmp rcx, rax
jne 0x180110d54
mov rcx, rax
jmp 0x180110d05
mov rcx, r12
sub rcx, rax
add rcx, 0xfffffffffffffff7
mov rdx, rax
sub rdx, r12
add rdx, 9
lea r8, [rdi + rax]
add r8, 9
xor r10d, r10d
cmp byte [r8 + r10], 0x5c
je 0x180110d88
inc r10
mov r9, rdx
add r9, r10
jne 0x180110d73
mov r10, rcx
lea rdx, [rax + 8]
test r10, r10
je 0x180110d0f
mov qword [rsp + 0x138], r10
lea rcx, [r10 + 1]
jmp 0x180110d19
mov rdi, r9
test r8b, r8b
je 0x180110e74
mov eax, dword [0x18021ea3c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 0x50]
test rax, rax
je 0x180110f0d
add rax, 0x110
jmp 0x180110f12
mov rdi, qword [rsp + 0x140]
test rdi, rdi
je 0x180110ea2
movzx eax, byte [0x18021ea38]
mov rcx, qword [0x18021e9c0]
test rcx, rcx
mov rsi, qword [rsp + 0xf0]
jne 0x180110e25
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x1801111c9
mov rcx, rax
mov qword [0x18021e9c0], rax
mov r8d, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x1801111c9
mov qword [rax], rsi
mov rcx, qword [rsp + 0x108]
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdi
pxor xmm0, xmm0
movdqu xmmword [rax + 0x18], xmm0
mov rcx, qword [rsp + 0xe8]
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], 1
jmp 0x180111122
test rdi, rdi
je 0x18010ecb4
shr rdi, 1
jmp 0x180110f26
pxor xmm0, xmm0
mov rax, qword [rsp + 0xe8]
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
jmp 0x180111122
pxor xmm0, xmm0
mov rax, qword [rsp + 0xe8]
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
cmp qword [rsp + 0x108], 0
mov r8, qword [rsp + 0xf0]
je 0x180111122
mov rcx, qword [0x18021e9c0]
xor edx, edx
movaps xmm6, xmmword [rsp + 0xf80]
movaps xmm7, xmmword [rsp + 0xf90]
movaps xmm8, xmmword [rsp + 0xfa0]
add rsp, 0xfb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
call fcn.1800774f0
mov rax, qword [rax]
mov rax, qword [rax + 0x1f0]
shr rdi, 1
cmp rax, rdi
cmova rdi, rax
mov qword [rsp + 0x240], rdi
mov qword [rsp + 0x250], rsi
cmp rsi, r14
ja 0x180111183
lea rax, [r15 + rsi*8]
sub r14, rsi
lea rcx, [rsp + 0x230]
mov qword [rsp + 0x7b0], rcx
lea rcx, [rsp + 0x250]
mov qword [rsp + 0x7b8], rcx
lea rdx, [rsp + 0x240]
mov qword [rsp + 0x7c0], rdx
mov qword [rsp + 0x7c8], rax
mov qword [rsp + 0x7d0], r14
mov qword [rsp + 0x7d8], rbx
mov qword [rsp + 0x7e0], rcx
mov qword [rsp + 0x7e8], rdx
mov qword [rsp + 0x7f0], r15
mov qword [rsp + 0x7f8], rsi
mov qword [rsp + 0x800], rbx
mov eax, dword [0x18021ea3c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov r8, qword [rax + 0x50]
test r8, r8
jne 0x180111014
call fcn.1800774f0
mov rax, qword [rax]
lea rdx, [rax + 0x80]
mov ecx, dword [0x18021ea3c]
mov r8, qword gs:[0x58]
mov rcx, qword [r8 + rcx*8]
mov r8, qword [rcx + 0x50]
test r8, r8
je 0x18011114f
cmp qword [r8 + 0x110], rax
jne 0x180111169
lea rcx, [rsp + 0x3a0]
lea rdx, [rsp + 0x7b0]
xor r9d, r9d
call fcn.180111620
mov rsi, qword [rsp + 0x3a0]
mov r8, qword [rsp + 0x3a8]
mov r9, qword [rsp + 0x3b8]
mov rax, qword [rsp + 0x3c0]
mov rdx, qword [rsp + 0x3c8]
test r8, r8
je 0x18011107a
mov rcx, qword [rsp + 0x3b0]
test r9, r9
je 0x18011110c
mov qword [r8 + 0x18], r9
mov qword [r9 + 0x20], r8
add rcx, rdx
jmp 0x18011110f
mov rcx, qword [rsp + 0xe8]
mov qword [rcx], r9
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rdx
test rsi, rsi
je 0x180111122
mov r14, qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1801110b7
mov rcx, qword [0x18021e9c0]
xor edx, edx
mov r8, rsi
call r14
mov rsi, r15
test r15, r15
je 0x180111122
mov r15, qword [rsi + 0x18]
test r15, r15
je 0x1801110c8
mov qword [r15 + 0x20], 0
mov rdi, qword [rsi]
mov r12, qword [rsi + 0x10]
test r12, r12
je 0x1801110f4
mov rbx, rdi
nop word [rax + rax]
mov rcx, rbx
call fcn.180111240
add rbx, 0x150
dec r12
jne 0x1801110e0
cmp qword [rsi + 8], 0
je 0x1801110a0
mov rcx, qword [0x18021e9c0]
xor edx, edx
mov r8, rdi
call r14
jmp 0x1801110a0
mov rax, r8
mov rdx, qword [rsp + 0xe8]
mov qword [rdx], rsi
mov qword [rdx + 8], rax
mov qword [rdx + 0x10], rcx
movaps xmm6, xmmword [rsp + 0xf80]
movaps xmm7, xmmword [rsp + 0xf90]
movaps xmm8, xmmword [rsp + 0xfa0]
add rsp, 0xfb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x3a0]
lea r8, [rsp + 0x7b0]
call fcn.18018c440
jmp 0x18011102c
lea rcx, [rsp + 0x3a0]
lea r9, [rsp + 0x7b0]
call fcn.18018c550
jmp 0x18011102c
ud2
mov ecx, 8
mov edx, 0x18
call fcn.1801828e0
ud2
mov ecx, 1
mov rdx, r12
call fcn.1801828e0
ud2
mov ecx, 1
mov edx, 6
call fcn.1801828e0
ud2
mov ecx, 1
mov edx, 4
call fcn.1801828e0
ud2
mov ecx, 8
mov edx, 0x28
call fcn.1801828e0
ud2
mov ecx, 1
mov rdx, rbx
call fcn.1801828e0
ud2