Function at 0x18006e670
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate threads
Execute shellcode via indirect call
Spawn thread to rwx shellcode
Terminate process
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x180119070]
xor rax, rsp
mov qword [rbp + 0x150], rax
cmp edx, 1
jne 0x180070192
lea rcx, [rbp + 0x68]
call fcn.180056040
lea rdi, [0x180127f00]
cmp rdi, rax
je 0x18006e6d0
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
call fcn.1800759b0
lea rcx, [rbp + 0x68]
call fcn.1800503e0
lea rcx, [rbp + 0x68]
call fcn.180056300
lea rsi, [0x180127f80]
cmp rsi, rax
je 0x18006e6fc
xor r8d, r8d
mov rdx, rax
mov rcx, rsi
call fcn.1800759b0
lea rcx, [rbp + 0x68]
call fcn.1800503e0
lea rcx, [rbp + 0x68]
call fcn.180056e00
lea r15, [0x180127f20]
cmp r15, rax
je 0x18006e728
xor r8d, r8d
mov rdx, rax
mov rcx, r15
call fcn.1800759b0
lea rcx, [rbp + 0x68]
call fcn.1800503e0
mov dword [rsp + 0x40], 0xd3d7c7d9
mov dword [rsp + 0x44], 0xe582f9e1
mov dword [rsp + 0x48], 0xeae3f3ed
mov word [rsp + 0x4c], 0x100
lea rcx, [rsp + 0x40]
call fcn.180070b00
lea rax, [rsp + 0x40]
mov r14, 0xffffffffffffffff
mov r8, r14
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18006e770
lea rdx, [rsp + 0x40]
lea rcx, [0x180127fc0]
call fcn.180075850
xor edx, edx
lea rcx, [rbp + 0x48]
call fcn.180072ac0
nop
lea rax, [rsp + 0x40]
mov qword [rbp - 0x78], rax
mov dword [rsp + 0x58], 0xf8f0f4ef
mov dword [rsp + 0x5c], 0x100cfc9
lea rcx, [rsp + 0x58]
call fcn.180070490
lea rax, [rsp + 0x58]
mov qword [rbp], rax
lea rdx, [rbp]
lea rcx, [rsp + 0x40]
call fcn.1800787f0
mov rbx, rax
mov dword [rsp + 0x30], 0xf7eaf8f1
mov dword [rsp + 0x34], 0x100c5cf
lea rcx, [rsp + 0x30]
call fcn.180070490
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x48]
call fcn.180078300
mov rcx, rax
mov rdx, rbx
call fcn.180072770
lea rax, [rsp + 0x40]
mov qword [rbp - 0x78], rax
lea rdx, [0x180127fc0]
lea rcx, [rsp + 0x40]
call fcn.180078150
mov rbx, rax
mov dword [rsp + 0x30], 0xfaf3fcf2
mov word [rsp + 0x34], 0x100
lea rcx, [rsp + 0x30]
call fcn.180070ac0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x48]
call fcn.180078300
mov rcx, rax
mov rdx, rbx
call fcn.180072770
lea rax, [rsp + 0x40]
mov qword [rbp - 0x78], rax
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.180078150
mov rdi, rax
mov dword [rsp + 0x30], 0xf0f8f3f5
mov word [rsp + 0x34], 0x100
lea rcx, [rsp + 0x30]
call fcn.180070ac0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x48]
call fcn.180078300
mov rbx, rax
mov dword [rsp + 0x58], 0xfbf7e8e9
mov word [rsp + 0x5c], 0x100
lea rcx, [rsp + 0x58]
call fcn.180070ac0
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.180078300
mov rcx, rax
mov rdx, rdi
call fcn.180072770
lea rax, [rsp + 0x40]
mov qword [rbp - 0x78], rax
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.180078150
mov rdi, rax
mov dword [rsp + 0x58], 0xf0f8f3f5
mov word [rsp + 0x5c], 0x100
lea rcx, [rsp + 0x58]
call fcn.180070ac0
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x48]
call fcn.180078300
mov rbx, rax
mov dword [rsp + 0x30], 0xabf9f1
mov byte [rsp + 0x34], 1
lea rcx, [rsp + 0x30]
call fcn.1800704c0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180078300
mov rcx, rax
mov rdx, rdi
call fcn.180072770
lea rax, [rsp + 0x40]
mov qword [rbp - 0x78], rax
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.180078150
mov rdi, rax
mov dword [rsp + 0x58], 0xf0f8f3f5
mov word [rsp + 0x5c], 0x100
lea rcx, [rsp + 0x58]
call fcn.180070ac0
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x48]
call fcn.180078300
mov rbx, rax
mov dword [rsp + 0x30], 0xfafafcea
mov word [rsp + 0x34], 0x100
lea rcx, [rsp + 0x30]
call fcn.180070ac0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180078300
mov rcx, rax
mov rdx, rdi
call fcn.180072770
lea rax, [rsp + 0x40]
mov qword [rbp - 0x78], rax
lea rdx, [rbp + 0x48]
lea rcx, [rsp + 0x40]
call fcn.1800727e0
mov rbx, rax
movdqa xmm0, xmmword [0x180104700]
movdqu xmmword [rbp - 0x18], xmm0
mov dword [rbp - 8], 0x81c2ca
mov byte [rbp - 4], 1
lea rcx, [rbp - 0x18]
call fcn.1800709a0
nop
mov r8, rbx
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x88]
call fcn.180053f30
nop
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x68]
call fcn.180073640
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.1800509b0
lea rcx, [rbp + 0x88]
cmp rcx, rax
je 0x18006ea3a
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x88]
call fcn.1800759b0
lea rcx, [rbp + 8]
call fcn.1800503e0
xor r15d, r15d
mov qword [rbp + 0xe8], r15
lea rcx, [rbp + 0x88]
call fcn.180073490
mov qword [rbp], rax
mov byte [rsp + 0x20], r15b
mov r9b, 1
lea r8, [rbp + 0xb0]
lea rdx, [rbp]
lea rcx, [rbp + 0x58]
call fcn.180078020
nop
mov dword [rsp + 0x40], 0xcbdfc9cf
mov dword [rsp + 0x44], 0xf0fdf2f5
mov dword [rsp + 0x48], 0xe2e5e6f1
mov dword [rsp + 0x4c], 0x100fafb
lea rcx, [rsp + 0x40]
call fcn.180070970
mov dword [rsp + 0x58], 0xfafaf2ff
mov word [rsp + 0x5c], 0x100
lea rcx, [rsp + 0x58]
call fcn.180070ac0
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x58]
call fcn.180078300
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.1800788c0
test al, al
je 0x180070153
mov dword [rsp + 0x58], 0xf0f8f3f5
mov word [rsp + 0x5c], 0x100
lea rcx, [rsp + 0x58]
call fcn.180070ac0
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x58]
call fcn.180078300
mov rbx, rax
mov dword [rsp + 0x30], 0xfae8f4fa
mov word [rsp + 0x34], Ordinal_211
mov byte [rsp + 0x36], 1
lea rcx, [rsp + 0x30]
call fcn.180070a00
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180078300
mov rdx, rax
lea rcx, [0x180127f60]
call fcn.180080720
mov dword [rsp + 0x58], 0xf0f8f3f5
mov word [rsp + 0x5c], 0x100
lea rcx, [rsp + 0x58]
call fcn.180070ac0
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x58]
call fcn.180078300
mov rbx, rax
mov dword [rsp + 0x40], 0xfae8f4fa
mov dword [rsp + 0x44], 0xcad6fecd
mov dword [rsp + 0x48], 0x100c0c9
lea rcx, [rsp + 0x40]
call fcn.180070a60
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.180078300
mov rdx, rax
lea rcx, [0x180127ec0]
call fcn.180080720
mov dword [rsp + 0x58], 0xf0f8f3f5
mov word [rsp + 0x5c], 0x100
lea rcx, [rsp + 0x58]
call fcn.180070ac0
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x58]
call fcn.180078300
mov rbx, rax
mov dword [rsp + 0x40], 0xfae8f4fa
mov dword [rsp + 0x44], 0xd7d1fecd
mov dword [rsp + 0x48], 0xd4d3d1c5
mov word [rsp + 0x4c], 0x100
lea rcx, [rsp + 0x40]
call fcn.180070b00
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.180078300
mov rdx, rax
lea rcx, [0x180127ea0]
call fcn.180080720
mov dword [rsp + 0x30], 0x100e0e7
lea rcx, [rsp + 0x30]
call fcn.1800709d0
lea rdx, [rsp + 0x30]
lea rcx, [0x180127f60]
call fcn.18007cdd0
test al, al
jne 0x180070153
movzx eax, byte [0x1800f4880]
xor al, 0x9c
mov byte [rsp + 0x30], al
mov word [rsp + 0x31], 0x100
lea rcx, [rsp + 0x30]
call fcn.180070af0
lea rdx, [rsp + 0x30]
lea rcx, [0x180127ea0]
call fcn.18007cdd0
test al, al
jne 0x18006ecb0
movzx eax, byte [0x1800f4888]
xor al, 0x9c
mov byte [rsp + 0x30], al
mov word [rsp + 0x31], 0x100
lea rcx, [rsp + 0x30]
call fcn.180070af0
lea rdx, [rsp + 0x30]
lea rcx, [0x180127ea0]
call fcn.18007cdd0
test al, al
je 0x180070153
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x18006ed0a
xor edx, edx
lea rcx, [rbp + 0x58]
call fcn.1800755f0
movzx edx, byte [rbp + 0x58]
lea rcx, [rbp + 0x60]
call fcn.180074c20
nop
lea rcx, [rbp + 0x88]
call fcn.1800503e0
nop
xor edx, edx
lea rcx, [rbp + 0x48]
call fcn.1800755f0
movzx edx, byte [rbp + 0x48]
lea rcx, [rbp + 0x50]
call fcn.180074c20
nop
xor eax, eax
jmp 0x180070197
mov dword [rbp + 8], Ordinal_30
lea rdx, [rbp + 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x18006edf3
mov dword [rbp - 0x78], 0xb1f5eef3
mov dword [rbp - 0x74], 0xc7d9c5
mov byte [rbp - 0x70], 1
lea rcx, [rbp - 0x78]
call fcn.180070a90
lea rcx, [rbp - 0x78]
call fcn.180050c50
mov rdi, rax
nop dword [rax]
mov eax, dword [rbp + 0x14]
cmp rax, rdi
jne 0x18006edde
mov r8d, dword [rbp + 0x10]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
mov rcx, rax
call fcn.18006dbe0
mov r8d, eax
mov edx, edi
lea rcx, [rbp + 0x28]
call fcn.18006daf0
nop
mov dword [rsp + 0x40], 0xecfcfce8
mov dword [rsp + 0x44], 0xc78cc3cb
mov dword [rsp + 0x48], 0x100c9c8
lea rcx, [rsp + 0x40]
call fcn.180070a60
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x28]
call fcn.180073300
cmp rax, 0xffffffffffffffff
je 0x18006edcb
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x28]
call fcn.1800503e0
lea rdx, [rbp + 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x18006ed50
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1800545b0
test eax, eax
jne 0x18006ee50
mov word [rsp + 0x30], 0x100
lea rcx, [rsp + 0x30]
call fcn.180070220
mov rbx, rax
movdqa xmm0, xmmword [0x180104060]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x50], 1
lea rcx, [rsp + 0x40]
call fcn.180053ed0
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rbp + 0x100], 1
lea rcx, [rbp + 0x100]
call fcn.180054770
cmp dword [rbp + 0x100], 0x1337
jne 0x1800701c3
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x180129284], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x180129280], eax
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x18006da50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movdqa xmm0, xmmword [0x180104890]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x808382
mov byte [rsp + 0x54], 1
lea rcx, [rsp + 0x40]
call fcn.1800709a0
lea rax, [rsp + 0x40]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x18006eee0
lea rdx, [rsp + 0x40]
lea rcx, [0x180127ee0]
call fcn.180075850
nop dword [rax + rax]
movdqa xmm0, xmmword [0x180104a70]
movdqu xmmword [rsp + 0x68], xmm0
mov dword [rsp + 0x78], 0xcad6c882
mov word [rsp + 0x7c], 0x100
lea rcx, [rsp + 0x68]
call fcn.180070420
lea rcx, [rsp + 0x68]
call fcn.180050c50
test rax, rax
je 0x18006f06e
movdqa xmm0, xmmword [0x180104a70]
movdqu xmmword [rbp + 0x28], xmm0
mov dword [rbp + 0x38], 0xcad6c882
mov word [rbp + 0x3c], 0x100
lea rcx, [rbp + 0x28]
call fcn.180070420
lea rax, [rbp + 0x28]
mov qword [0x1801292a0], rax
mov dword [0x1801292f8], 0x247f840
mov dword [0x1801292e8], 0x1efd4c8
mov dword [0x180129304], 0x2087780
mov dword [0x18012930c], 0xec58f1
mov dword [0x1801292d4], 0xec58ac
mov dword [0x1801292d0], 0x12c
mov dword [0x1801292dc], 0x74
mov dword [0x1801292ec], 0x2e8
mov dword [0x180129310], 0x28c
mov dword [0x18012931c], 0xb0
mov dword [0x1801292e0], 0x114
mov dword [0x1801292d8], 0x108
mov dword [0x180129308], 0xd28
mov dword [0x180129318], 0x918
mov dword [0x180129300], 0x10b8
mov dword [0x180129314], 0x60
mov dword [0x1801292e4], 0x60
mov dword [0x1801292fc], 0x90
mov dword [0x1801292f0], 0x280
mov dword [0x180129320], 0x14b8
mov dword [0x180129324], 0x10a8
mov dword [0x1801292f4], 0x10c8
mov dword [rbp - 0x78], 0xc8fdeffb
mov dword [rbp - 0x74], 0xccc6cfc9
mov word [rbp - 0x70], reloc.WLDAP32.dll_Ordinal_211
mov byte [rbp - 0x6e], 1
lea rcx, [rbp - 0x78]
call fcn.180070a30
lea rcx, [rbp - 0x78]
jmp 0x18006fe07
movdqa xmm0, xmmword [0x180104c80]
movdqu xmmword [rbp + 0x28], xmm0
mov dword [rbp + 0x38], 0xcacdc2de
mov dword [rbp + 0x3c], 0xd69cc2c3
mov dword [rbp + 0x40], 0x100d0cc
lea rcx, [rbp + 0x28]
call fcn.1800703f0
lea rcx, [rbp + 0x28]
call fcn.180050c50
test rax, rax
je 0x18006f1f2
movdqa xmm0, xmmword [0x180104c80]
movdqu xmmword [rsp + 0x68], xmm0
mov dword [rsp + 0x78], 0xcacdc2de
mov dword [rsp + 0x7c], 0xd69cc2c3
mov dword [rbp - 0x80], 0x100d0cc
lea rcx, [rsp + 0x68]
call fcn.1800703f0
lea rax, [rsp + 0x68]
mov qword [0x1801292a0], rax
mov dword [0x1801292f8], 0x24c8858
mov dword [0x1801292e8], 0x1ec3828
mov dword [0x180129304], 0x1f6a7e0
mov dword [0x18012930c], 0x101b6d9
mov dword [0x1801292d4], 0x101b694
mov dword [0x1801292d0], 0x134
mov dword [0x1801292dc], 0x74
mov dword [0x1801292ec], 0x2f4
mov dword [0x180129310], 0x28c
mov dword [0x18012931c], 0xb0
mov dword [0x1801292e0], 0x11c
mov dword [0x1801292d8], 0x110
mov dword [0x180129308], 0xd30
mov dword [0x180129318], 0x938
mov dword [0x180129300], 0x10c8
mov dword [0x180129314], 0x78
mov dword [0x1801292e4], 0x60
mov dword [0x1801292fc], 0x90
mov dword [0x1801292f0], 0x280
mov dword [0x180129320], 0x14e0
mov dword [0x180129324], 0x10b8
mov dword [0x1801292f4], 0x10d8
mov dword [rsp + 0x58], 0xc8fdeffb
mov dword [rsp + 0x5c], 0xccc6cfc9
mov word [rsp + 0x60], reloc.WLDAP32.dll_Ordinal_211
mov byte [rsp + 0x62], 1
lea rcx, [rsp + 0x58]
call fcn.180070a30
lea rcx, [rsp + 0x58]
jmp 0x18006fe07
movdqa xmm0, xmmword [0x180104ca0]
movdqu xmmword [rbp + 0x28], xmm0
mov dword [rbp + 0x38], 0xcacdc2de
mov dword [rbp + 0x3c], 0xd69cc2c3
mov dword [rbp + 0x40], 0x100d0cc
lea rcx, [rbp + 0x28]
call fcn.1800703f0
lea rcx, [rbp + 0x28]
call fcn.180050c50
test rax, rax
je 0x18006f376
movdqa xmm0, xmmword [0x180104ca0]
movdqu xmmword [rsp + 0x68], xmm0
mov dword [rsp + 0x78], 0xcacdc2de
mov dword [rsp + 0x7c], 0xd69cc2c3
mov dword [rbp - 0x80], 0x100d0cc
lea rcx, [rsp + 0x68]
call fcn.1800703f0
lea rax, [rsp + 0x68]
mov qword [0x1801292a0], rax
mov dword [0x1801292f8], 0x24e6d90
mov dword [0x1801292e8], 0x1ee18a8
mov dword [0x180129304], 0x1f888c0
mov dword [0x18012930c], 0x102f8e9
mov dword [0x1801292d4], 0x102f8a4
mov dword [0x1801292d0], 0x134
mov dword [0x1801292dc], 0x74
mov dword [0x1801292ec], 0x2f4
mov dword [0x180129310], 0x28c
mov dword [0x18012931c], 0xb0
mov dword [0x1801292e0], 0x11c
mov dword [0x1801292d8], 0x110
mov dword [0x180129308], 0xd30
mov dword [0x180129318], 0x938
mov dword [0x180129300], 0x10c8
mov dword [0x180129314], 0x78
mov dword [0x1801292e4], 0x60
mov dword [0x1801292fc], 0x90
mov dword [0x1801292f0], 0x280
mov dword [0x180129320], 0x14e0
mov dword [0x180129324], 0x10b8
mov dword [0x1801292f4], 0x10d8
mov dword [rsp + 0x30], 0xc8fdeffb
mov dword [rsp + 0x34], 0xccc6cfc9
mov word [rsp + 0x38], reloc.WLDAP32.dll_Ordinal_211
mov byte [rsp + 0x3a], 1
lea rcx, [rsp + 0x30]
call fcn.180070a30
lea rcx, [rsp + 0x30]
jmp 0x18006fe07
movdqa xmm0, xmmword [0x180104c50]
movdqu xmmword [rbp + 0x28], xmm0
mov dword [rbp + 0x38], 0xcacdc2de
mov dword [rbp + 0x3c], 0xd69cc2c3
mov dword [rbp + 0x40], 0x100d0cc
lea rcx, [rbp + 0x28]
call fcn.1800703f0
lea rcx, [rbp + 0x28]
call fcn.180050c50
test rax, rax
je 0x18006f4f4
movdqa xmm0, xmmword [0x180104c50]
movdqu xmmword [rsp + 0x68], xmm0
mov dword [rsp + 0x78], 0xcacdc2de
mov dword [rsp + 0x7c], 0xd69cc2c3
mov dword [rbp - 0x80], 0x100d0cc
lea rcx, [rsp + 0x68]
call fcn.1800703f0
lea rax, [rsp + 0x68]
mov qword [0x1801292a0], rax
mov dword [0x1801292f8], 0x252dcd8
mov dword [0x1801292e8], 0x1f05208
mov dword [0x180129304], 0x1f9e9f0
mov dword [0x18012930c], 0x1035665
mov dword [0x1801292d4], 0x1035620
mov dword [0x1801292d0], 0x134
mov dword [0x1801292dc], 0x74
mov dword [0x1801292ec], 0x2f4
mov dword [0x180129310], 0x28c
mov dword [0x18012931c], 0xb0
mov dword [0x1801292e0], 0x11c
mov dword [0x1801292d8], 0x110
mov dword [0x180129308], 0xd30
mov dword [0x180129318], 0x938
mov dword [0x180129300], 0x10c8
mov dword [0x180129314], 0x88
mov dword [0x1801292e4], 0x60
mov dword [0x1801292fc], 0x90
mov dword [0x1801292f0], 0x280
mov dword [0x180129320], 0x14e0
mov dword [0x180129324], 0x10b8
mov dword [0x1801292f4], 0x10d8
mov dword [rbp - 0x68], 0xc8fdeffb
mov dword [rbp - 0x64], 0xccc6cfc9
mov word [rbp - 0x60], reloc.WLDAP32.dll_Ordinal_211
mov byte [rbp - 0x5e], 1
lea rcx, [rbp - 0x68]
call fcn.180070a30
lea rcx, [rbp - 0x68]
jmp 0x18006fe07
movdqa xmm0, xmmword [0x180104c30]
movdqu xmmword [rbp + 0x28], xmm0
mov dword [rbp + 0x38], 0xcacdc2de
mov dword [rbp + 0x3c], 0xd69cc2c3
mov dword [rbp + 0x40], 0x100d0cc
lea rcx, [rbp + 0x28]
call fcn.1800703f0
lea rcx, [rbp + 0x28]
call fcn.180050c50
test rax, rax
je 0x18006f672
movdqa xmm0, xmmword [0x180104c30]
movdqu xmmword [rsp + 0x68], xmm0
mov dword [rsp + 0x78], 0xcacdc2de
mov dword [rsp + 0x7c], 0xd69cc2c3
mov dword [rbp - 0x80], 0x100d0cc
lea rcx, [rsp + 0x68]
call fcn.1800703f0
lea rax, [rsp + 0x68]
mov qword [0x1801292a0], rax
mov dword [0x1801292f8], 0x25667e8
mov dword [0x1801292e8], 0x1f2e7a8
mov dword [0x180129304], 0x1fd6f70
mov dword [0x18012930c], 0x103f4ad
mov dword [0x1801292d4], 0x103f468
mov dword [0x1801292d0], 0x134
mov dword [0x1801292dc], 0x74
mov dword [0x1801292ec], 0x2f4
mov dword [0x180129310], 0x28c
mov dword [0x18012931c], 0xb0
mov dword [0x1801292e0], 0x11c
mov dword [0x1801292d8], 0x110
mov dword [0x180129308], 0xd30
mov dword [0x180129318], 0x938
mov dword [0x180129300], 0x10c8
mov dword [0x180129314], 0x88
mov dword [0x1801292e4], 0x60
mov dword [0x1801292fc], 0x90
mov dword [0x1801292f0], 0x280
mov dword [0x180129320], 0x1530
mov dword [0x180129324], 0x10b8
mov dword [0x1801292f4], 0x10d8
mov dword [rbp - 0x58], 0xc8fdeffb
mov dword [rbp - 0x54], 0xccc6cfc9
mov word [rbp - 0x50], reloc.WLDAP32.dll_Ordinal_211
mov byte [rbp - 0x4e], 1
lea rcx, [rbp - 0x58]
call fcn.180070a30
lea rcx, [rbp - 0x58]
jmp 0x18006fe07
movdqa xmm0, xmmword [0x180104c60]
movdqu xmmword [rbp + 0x28], xmm0
mov dword [rbp + 0x38], 0xcacdc2de
mov dword [rbp + 0x3c], 0xd69cc2c3
mov dword [rbp + 0x40], 0x100d0cc
lea rcx, [rbp + 0x28]
call fcn.1800703f0
lea rcx, [rbp + 0x28]
call fcn.180050c50
test rax, rax
je 0x18006f7f0
movdqa xmm0, xmmword [0x180104c60]
movdqu xmmword [rsp + 0x68], xmm0
mov dword [rsp + 0x78], 0xcacdc2de
mov dword [rsp + 0x7c], 0xd69cc2c3
mov dword [rbp - 0x80], 0x100d0cc
lea rcx, [rsp + 0x68]
call fcn.1800703f0
lea rax, [rsp + 0x68]
mov qword [0x1801292a0], rax
mov dword [0x1801292f8], 0x2567db0
mov dword [0x1801292e8], 0x1f77ef0
mov dword [0x180129304], 0x1fd8570
mov dword [0x18012930c], 0x1040dbd
mov dword [0x1801292d4], 0x1040d78
mov dword [0x1801292d0], 0x134
mov dword [0x1801292dc], 0x74
mov dword [0x1801292ec], 0x2f4
mov dword [0x180129310], 0x28c
mov dword [0x18012931c], 0xb0
mov dword [0x1801292e0], 0x11c
mov dword [0x1801292d8], 0x110
mov dword [0x180129308], 0xd30
mov dword [0x180129318], 0x938
mov dword [0x180129300], 0x10c8
mov dword [0x180129314], 0x88
mov dword [0x1801292e4], 0x60
mov dword [0x1801292fc], 0x90
mov dword [0x1801292f0], 0x280
mov dword [0x180129320], 0x1530
mov dword [0x180129324], 0x10b8
mov dword [0x1801292f4], 0x10d8
mov dword [rbp - 0x48], 0xc8fdeffb
mov dword [rbp - 0x44], 0xccc6cfc9
mov word [rbp - 0x40], reloc.WLDAP32.dll_Ordinal_211
mov byte [rbp - 0x3e], 1
lea rcx, [rbp - 0x48]
call fcn.180070a30
lea rcx, [rbp - 0x48]
jmp 0x18006fe07
movdqa xmm0, xmmword [0x180104c90]
movdqu xmmword [rbp + 0x28], xmm0
mov dword [rbp + 0x38], 0xcacdc2de
mov dword [rbp + 0x3c], 0xd69cc2c3
mov dword [rbp + 0x40], 0x100d0cc
lea rcx, [rbp + 0x28]
call fcn.1800703f0
lea rcx, [rbp + 0x28]
call fcn.180050c50
test rax, rax
je 0x18006f96e
movdqa xmm0, xmmword [0x180104c90]
movdqu xmmword [rsp + 0x68], xmm0
mov dword [rsp + 0x78], 0xcacdc2de
mov dword [rsp + 0x7c], 0xd69cc2c3
mov dword [rbp - 0x80], 0x100d0cc
lea rcx, [rsp + 0x68]
call fcn.1800703f0
lea rax, [rsp + 0x68]
mov qword [0x1801292a0], rax
mov dword [0x1801292f8], 0x26684d8
mov dword [0x1801292e8], 0x20304c8
mov dword [0x180129304], 0x20d8c90
mov dword [0x18012930c], 0x10479f9
mov dword [0x1801292d4], 0x10479b4
mov dword [0x1801292d0], 0x134
mov dword [0x1801292dc], 0x74
mov dword [0x1801292ec], 0x2f4
mov dword [0x180129310], 0x28c
mov dword [0x18012931c], 0xb0
mov dword [0x1801292e0], 0x11c
mov dword [0x1801292d8], 0x110
mov dword [0x180129308], 0xd10
mov dword [0x180129318], 0x918
mov dword [0x180129300], 0x10c8
mov dword [0x180129314], 0x88
mov dword [0x1801292e4], 0x60
mov dword [0x1801292fc], 0x90
mov dword [0x1801292f0], 0x280
mov dword [0x180129320], 0x1530
mov dword [0x180129324], 0x10b8
mov dword [0x1801292f4], 0x10d8
mov dword [rbp - 0x38], 0xc8fdeffb
mov dword [rbp - 0x34], 0xccc6cfc9
mov word [rbp - 0x30], reloc.WLDAP32.dll_Ordinal_211
mov byte [rbp - 0x2e], 1
lea rcx, [rbp - 0x38]
call fcn.180070a30
lea rcx, [rbp - 0x38]
jmp 0x18006fe07
movdqa xmm0, xmmword [0x180104c70]
movdqu xmmword [rbp + 0x28], xmm0
mov dword [rbp + 0x38], 0xcacdc2de
mov dword [rbp + 0x3c], 0xd69cc2c3
mov dword [rbp + 0x40], 0x100d0cc
lea rcx, [rbp + 0x28]
call fcn.1800703f0
lea rcx, [rbp + 0x28]
call fcn.180050c50
test rax, rax
je 0x18006faf6
movdqa xmm0, xmmword [0x180104c70]
movdqu xmmword [rsp + 0x68], xmm0
mov dword [rsp + 0x78], 0xcacdc2de
mov dword [rsp + 0x7c], 0xd69cc2c3
mov dword [rbp - 0x80], 0x100d0cc
lea rcx, [rsp + 0x68]
call fcn.1800703f0
lea rax, [rsp + 0x68]
mov qword [0x1801292a0], rax
mov dword [0x1801292f8], 0x254d448
mov dword [0x1801292e8], 0x1f5b820
mov dword [0x180129304], 0x1fbc100
mov dword [0x18012930c], 0x10455f5
mov dword [0x1801292d4], 0x10455b0
mov dword [0x1801292d0], 0x134
mov dword [0x1801292dc], 0x74
mov dword [0x1801292ec], 0x2f4
mov dword [0x180129310], 0x28c
mov dword [0x18012931c], 0xb0
mov dword [0x1801292e0], 0x11c
mov dword [0x1801292d8], 0x110
mov dword [0x180129308], 0xd10
mov dword [0x180129318], 0x918
mov dword [0x180129300], 0x10a8
mov dword [0x180129314], 0x88
mov dword [0x1801292e4], 0x60
mov dword [0x1801292fc], 0x90
mov dword [0x1801292f0], 0x280
mov dword [0x180129320], 0x150c
mov dword [0x180129324], 0x1098
mov dword [0x1801292f4], 0x10b8
mov dword [0x1801190bc], 0x410
mov dword [rbp - 0x28], 0xc8fdeffb
mov dword [rbp - 0x24], 0xccc6cfc9
mov word [rbp - 0x20], reloc.WLDAP32.dll_Ordinal_211
mov byte [rbp - 0x1e], 1
lea rcx, [rbp - 0x28]
call fcn.180070a30
lea rcx, [rbp - 0x28]
jmp 0x18006fe07
movdqa xmm0, xmmword [0x180104c20]
movdqu xmmword [rbp + 0x28], xmm0
mov dword [rbp + 0x38], 0xcacdc2de
mov dword [rbp + 0x3c], 0xd69cc2c3
mov dword [rbp + 0x40], 0x100d0cc
lea rcx, [rbp + 0x28]
call fcn.1800703f0
lea rcx, [rbp + 0x28]
call fcn.180050c50
test rax, rax
je 0x18006fc7e
movdqa xmm0, xmmword [0x180104c20]
movdqu xmmword [rsp + 0x68], xmm0
mov dword [rsp + 0x78], 0xcacdc2de
mov dword [rsp + 0x7c], 0xd69cc2c3
mov dword [rbp - 0x80], 0x100d0cc
lea rcx, [rsp + 0x68]
call fcn.1800703f0
lea rax, [rsp + 0x68]
mov qword [0x1801292a0], rax
mov dword [0x1801292f8], 0x257bea0
mov dword [0x1801292e8], 0x1f42068
mov dword [0x180129304], 0x1feaac0
mov dword [0x18012930c], 0x1052879
mov dword [0x1801292d4], 0x1052834
mov dword [0x1801292d0], 0x134
mov dword [0x1801292dc], 0x74
mov dword [0x1801292ec], 0x2f4
mov dword [0x180129310], 0x28c
mov dword [0x18012931c], 0xb0
mov dword [0x1801292e0], 0x11c
mov dword [0x1801292d8], 0x110
mov dword [0x180129308], 0xd10
mov dword [0x180129318], 0x918
mov dword [0x180129300], 0x10a8
mov dword [0x180129314], 0xe8
mov dword [0x1801292e4], 0x60
mov dword [0x1801292fc], 0x90
mov dword [0x1801292f0], 0x280
mov dword [0x180129320], 0x150c
mov dword [0x180129324], 0x1098
mov dword [0x1801292f4], 0x10b8
mov dword [0x1801190bc], 0x410
mov dword [rbp - 0x18], 0xc8fdeffb
mov dword [rbp - 0x14], 0xccc6cfc9
mov word [rbp - 0x10], reloc.WLDAP32.dll_Ordinal_211
mov byte [rbp - 0xe], 1
lea rcx, [rbp - 0x18]
call fcn.180070a30
lea rcx, [rbp - 0x18]
jmp 0x18006fe07
movdqa xmm0, xmmword [0x180104c40]
movdqu xmmword [rbp + 0x28], xmm0
mov dword [rbp + 0x38], 0xcacdc2de
mov dword [rbp + 0x3c], 0xd69cc2c3
mov dword [rbp + 0x40], 0x100d0cc
lea rcx, [rbp + 0x28]
call fcn.1800703f0
lea rcx, [rbp + 0x28]
call fcn.180050c50
test rax, rax
je 0x18006fe14
movdqa xmm0, xmmword [0x180104c40]
movdqu xmmword [rsp + 0x68], xmm0
mov dword [rsp + 0x78], 0xcacdc2de
mov dword [rsp + 0x7c], 0xd69cc2c3
mov dword [rbp - 0x80], 0x100d0cc
lea rcx, [rsp + 0x68]
call fcn.1800703f0
lea rax, [rsp + 0x68]
mov qword [0x1801292a0], rax
mov dword [0x1801292f8], 0x2593320
mov dword [0x1801292e8], 0x1f58b58
mov dword [0x180129304], 0x20019e0
mov dword [0x18012930c], 0x105dfa9
mov dword [0x1801292d4], 0x105df64
mov dword [0x1801292d0], 0x134
mov dword [0x1801292dc], 0x74
mov dword [0x1801292ec], 0x2f4
mov dword [0x180129310], 0x28c
mov dword [0x18012931c], 0xb0
mov dword [0x1801292e0], 0x11c
mov dword [0x1801292d8], 0x110
mov dword [0x180129308], 0xd10
mov dword [0x180129318], 0x960
mov dword [0x180129300], 0x10a8
mov dword [0x180129314], 0xe8
mov dword [0x1801292e4], 0x60
mov dword [0x1801292fc], 0x90
mov dword [0x1801292f0], 0x280
mov dword [0x180129320], 0x150c
mov dword [0x180129324], 0x1098
mov dword [0x1801292f4], 0x10b8
mov dword [0x1801190bc], 0x410
mov dword [rsp + 0x40], 0xc8fdeffb
mov dword [rsp + 0x44], 0xccc6cfc9
mov word [rsp + 0x48], reloc.WLDAP32.dll_Ordinal_211
mov byte [rsp + 0x4a], 1
lea rcx, [rsp + 0x40]
call fcn.180070a30
lea rcx, [rsp + 0x40]
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x18006fe24
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18006ef00
mov dword [rsp + 0x40], 0xc8fdeffb
mov dword [rsp + 0x44], 0xccc6cfc9
mov word [rsp + 0x48], reloc.WLDAP32.dll_Ordinal_211
mov byte [rsp + 0x4a], 1
lea rcx, [rsp + 0x40]
call fcn.180070a30
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str._Founded
lea rcx, [rbp + 0x68]
call fcn.180073600
nop
lea r8, [rbp + 0x68]
mov rdx, qword [0x1801292a0]
lea rcx, [rbp + 0x28]
call fcn.1800774e0
mov rdx, rax
lea rcx, [0x180127ee0]
call fcn.180073570
lea rcx, [rbp + 0x28]
call fcn.1800503e0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm0, xmmword [0x180104980]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], 0x100
lea rcx, [rsp + 0x40]
call fcn.180070460
lea rax, [rsp + 0x40]
inc r14
cmp byte [rax + r14], 0
jne 0x18006fec3
mov r8, r14
lea rdx, [rsp + 0x40]
lea rcx, [0x180127ee0]
call fcn.180075850
lea rsi, [rbp + 0x178]
lea rdi, [0x180078630]
lea rbx, [0x180000000]
nop word [rax + rax]
mov dword [rsp + 0x30], 0x77
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], rax
mov rdx, rsi
lea rcx, [rbp + 0x28]
call fcn.18004d240
nop
mov ecx, r15d
mov rax, qword [0x180129e60]
test rax, rax
je 0x18006ff5d
mov rdx, r15
cmp rax, rdi
je 0x18006ff4c
inc ecx
mov edx, ecx
mov rax, qword [rbx + rcx*8 + 0x129e60]
test rax, rax
jne 0x18006ff34
jmp 0x18006ff5d
mov r8, qword [rbx + rdx*8 + 0x1294f0]
test r8, r8
jne 0x18007003f
mov edx, 0x1f4
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
jne 0x18006ff84
mov r8, r15
jmp 0x18007001e
mov rcx, rdi
mov edx, 3
nop dword [rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x18006ff90
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
mov ecx, dword [rcx + 0x70]
mov dword [rax + 0x70], ecx
mov rax, qword [0x18012a180]
mov qword [rbx + rax*8 + 0x129e60], rdi
mov qword [rbx + rax*8 + 0x1294f0], r8
inc rax
mov qword [0x18012a180], rax
lea rdx, [rsp + 0x30]
mov rcx, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call r8
movzx edx, ax
mov rcx, qword [rbp + 0x28]
xor rcx, qword [rbp + 0x30]
mov rax, qword [rbp + 0x38]
mov qword [rax], rcx
test dx, dx
jne 0x180070075
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18006ff00
xor r8d, r8d
lea rdx, [0x1800f2e32]
lea rcx, [0x180127ee0]
call fcn.180075850
mov rcx, qword [0x1801292a0]
call fcn.180050c50
mov dword [0x180129328], eax
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x180129328]
test eax, eax
je 0x1800700dd
mov qword [rbp + 0xb0], 2
mov dword [rbp + 0xb8], eax
lea rcx, [rbp + 0xb0]
call fcn.180054770
mov rax, qword [rbp + 0xc0]
mov qword [0x180129330], rax
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x180057d60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x180059870]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x18006dcd0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [0x180129079], 1
lea rcx, [rbp + 0x68]
call fcn.1800503e0
nop
xor edx, edx
lea rcx, [rbp + 0x58]
call fcn.1800755f0
movzx edx, byte [rbp + 0x58]
lea rcx, [rbp + 0x60]
call fcn.180074c20
nop
lea rcx, [rbp + 0x88]
call fcn.1800503e0
nop
xor edx, edx
lea rcx, [rbp + 0x48]
call fcn.1800755f0
movzx edx, byte [rbp + 0x48]
lea rcx, [rbp + 0x50]
call fcn.180074c20
nop
mov eax, 1
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.1800dec50
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov word [rsp + 0x30], 0x100
lea rcx, [rsp + 0x30]
call fcn.180070220
mov rbx, rax
mov dword [rsp + 0x40], 0xf3f7fcda
mov dword [rsp + 0x44], 0xf782c5c5
mov dword [rsp + 0x48], 0xcef685cb
mov dword [rsp + 0x4c], 0x100cec6
lea rcx, [rsp + 0x40]
call fcn.180057400
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3