Function at 0x180051dc0
Capabilities:
Enumerate gui resources
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xa18]
sub rsp, 0xaf0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x18017a040]
xor rax, rsp
mov qword [rbp + 0x9d0], rax
movabs rax, 0x1d1fa91c5f217986
lea rcx, [rbp + 0x7c0]
mov qword [rsp + 0x40], rax
movabs rsi, 0x84c0ea13ef530cc2
mov rax, qword [rsp + 0x40]
movabs r14, 0x1d77a96c5f5279e7
mov qword [rbp + 0x300], rax
movabs rdi, 0xda952d7936bc53c0
movabs rax, 0xdaf42d1036c453b9
movabs r12, 0x602ebe69af55459
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x308], rax
movabs rax, 0x665eb899a995477
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x310], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x318], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x3e0], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x3e8], rax
movdqa xmm6, xmmword [rbp + 0x3e0]
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x3f0], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp + 0x310]
xorps xmm6, xmmword [rbp + 0x300]
mov qword [rbp + 0x3f8], rax
xorps xmm0, xmmword [rbp + 0x3f0]
movdqa xmmword [rbp + 0x310], xmm0
movdqa xmmword [rbp + 0x300], xmm6
call fcn.180051890
test al, al
je 0x18005352b
cmp word [rbp + 0x7c0], 0
lea rax, [rbp + 0x7c0]
je 0x180051f2a
nop dword [rax]
add rax, 2
cmp word [rax], 0
jne 0x180051f20
movq rcx, xmm6
test cx, cx
je 0x180051f50
lea rdx, [rbp + 0x300]
sub rdx, rax
nop
mov word [rax], cx
add rax, 2
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x180051f40
xor r13d, r13d
lea rcx, [rbp + 0x7c0]
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov word [rax], r13w
lea r8d, [r13 + 1]
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x18017aed8], rax
cmp rax, 0xffffffffffffffff
je 0x18005352b
xor r9d, r9d
mov qword [rsp + 0x20], r13
lea r8d, [r13 + 3]
mov rcx, rax
lea rdx, [0x180162c28]
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
call fcn.180075a40
movabs rax, 0x3d10c7053835168b
lea rdx, [rbp + 0x80]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0x80]
mov rax, qword [rsp + 0x40]
movabs rbx, 0x8a0ee29d662c2864
mov qword [rbp + 0x80], rax
movabs r15, 0x487bf0b00dd5d51b
movabs rax, 0xb3b5401c42cf2ab3
mov r8d, edx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x88], rax
movabs rax, 0x7c6b8787f3813d37
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x90], rax
movabs rax, 0xeba3ca7d803a78a3
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x98], rax
movabs rax, 0x481f95c468b9a576
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0xa0], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0xa8], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x4e0], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov qword [rbp + 0x4e8], rax
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp + 0x4e0]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x4f0], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x4f8], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x500], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
xorps xmm2, xmmword [rbp + 0x80]
movdqa xmm0, xmmword [rbp + 0x90]
movdqa xmm1, xmmword [rbp + 0xa0]
xorps xmm0, xmmword [rbp + 0x4f0]
mov qword [rbp + 0x508], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x500]
movdqa xmmword [rbp + 0xa0], xmm1
movdqa xmmword [rbp + 0x80], xmm2
movdqa xmmword [rbp + 0x90], xmm0
test al, al
je 0x18005213b
nop word [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180052130
mov rcx, qword [0x18017aed8]
sub r8d, edx
lea rdx, [rbp + 0x80]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.180076140
test al, al
je 0x18005352b
xor edx, edx
call fcn.180075a40
movabs rax, 0x6e57d01e303f1c8a
lea rdx, [rbp + 0xb0]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0xb0]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp + 0xb0], rax
movabs rax, 0xb4fc0d1453c820b9
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0xb8], rax
movabs rax, 0x6778828afb9c2030
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0xc0], rax
movabs rax, 0xe9af8933813c65b6
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0xc8], rax
movabs rax, 0x487b94d579b0b96b
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0xd0], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0xd8], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x510], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov qword [rbp + 0x518], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x520], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x528], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x530], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp + 0xb0]
xorps xmm2, xmmword [rbp + 0x510]
movdqa xmm0, xmmword [rbp + 0xc0]
movdqa xmm1, xmmword [rbp + 0xd0]
xorps xmm0, xmmword [rbp + 0x520]
mov qword [rbp + 0x538], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x530]
movdqa xmmword [rbp + 0xb0], xmm2
movdqa xmmword [rbp + 0xc0], xmm0
movdqa xmmword [rbp + 0xd0], xmm1
test al, al
je 0x1800522db
nop dword [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x1800522d0
mov rcx, qword [0x18017aed8]
sub r8d, edx
lea rdx, [rbp + 0xb0]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.180075d10
test al, al
je 0x18005352b
xor edx, edx
call fcn.180075a40
movabs rax, 0x6e0eda4c3726188a
lea rdx, [rbp + 0xe0]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0xe0]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp + 0xe0], rax
movabs rax, 0xaefc431016d136b4
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0xe8], rax
movabs rax, 0x6f768a9cf3993530
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0xf0], rax
movabs rax, 0xe8b0877c8c7362ad
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0xf8], rax
movabs rax, 0x487bf0b069b0a17e
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x100], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x108], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x540], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov qword [rbp + 0x548], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x550], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x558], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x560], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp + 0xe0]
xorps xmm2, xmmword [rbp + 0x540]
movdqa xmm0, xmmword [rbp + 0xf0]
movdqa xmm1, xmmword [rbp + 0x100]
xorps xmm0, xmmword [rbp + 0x550]
mov qword [rbp + 0x568], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x560]
movdqa xmmword [rbp + 0xe0], xmm2
movdqa xmmword [rbp + 0xf0], xmm0
movdqa xmmword [rbp + 0x100], xmm1
test al, al
je 0x18005247b
nop dword [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180052470
mov rcx, qword [0x18017aed8]
sub r8d, edx
lea rdx, [rbp + 0xe0]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.180060440
test al, al
je 0x18005352b
xor edx, edx
call fcn.180075a40
movabs rax, 0x7e16cf1e3a26178e
lea rdx, [rbp + 0x230]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0x230]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp + 0x230], rax
movabs rax, 0xb3e144175f9c20a5
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x238], rax
movabs rax, 0x696b9f87e09c3838
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x240], rax
movabs rax, 0xe1ac9a7e80302cac
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x248], rax
movabs rax, 0x487bf0b00db1b06f
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x250], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x258], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x570], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov qword [rbp + 0x578], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x580], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x588], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x590], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp + 0x230]
xorps xmm2, xmmword [rbp + 0x570]
movdqa xmm0, xmmword [rbp + 0x240]
movdqa xmm1, xmmword [rbp + 0x250]
xorps xmm0, xmmword [rbp + 0x580]
mov qword [rbp + 0x598], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x590]
movdqa xmmword [rbp + 0x230], xmm2
movdqa xmmword [rbp + 0x240], xmm0
movdqa xmmword [rbp + 0x250], xmm1
test al, al
je 0x18005261b
nop dword [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180052610
mov rcx, qword [0x18017aed8]
sub r8d, edx
lea rdx, [rbp + 0x230]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs r15, 0x28599042666157d6
lea rbx, [rbp + 0x60]
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x60], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x68], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp + 0x60]
mov rcx, qword [0x18017c738]
mov qword [rsp + 0x58], rax
xorps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp + 0x60], xmm0
mov rax, qword [rcx]
mov rdx, qword [rax + 0x270]
call rdx
test rax, rax
je 0x1800526ce
nop dword [rax]
movzx ecx, byte [rax]
lea rax, [rax + 1]
movzx edx, byte [rbx]
lea rbx, [rbx + 1]
test cl, cl
je 0x1800526c6
cmp cl, dl
je 0x1800526b0
cmp cl, dl
je 0x180052bde
mov dl, 2
call fcn.180075a40
movabs rax, 0x3d19c6052c201c91
lea rdx, [rbp + 0x140]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0x140]
mov rax, qword [rsp + 0x40]
movabs rbx, 0x8a0ee29d662c2864
mov qword [rbp + 0x140], rax
mov r8d, edx
movabs rax, 0xb2f659185bcf3aad
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x148], rax
movabs rax, 0x266e8a85f5997478
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x150], rax
movabs rax, 0xf7b28f65cf615f81
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x158], rax
movabs rax, 0x487bf09037bbba72
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x160], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x168], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x5a0], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov qword [rbp + 0x5a8], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x5b0], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x5b8], rax
movabs rax, 0x487bf0b00dd5d51b
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x5c0], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp + 0x140]
xorps xmm2, xmmword [rbp + 0x5a0]
movdqa xmm0, xmmword [rbp + 0x150]
movdqa xmm1, xmmword [rbp + 0x160]
xorps xmm0, xmmword [rbp + 0x5b0]
mov qword [rbp + 0x5c8], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x5c0]
movdqa xmmword [rbp + 0x140], xmm2
movdqa xmmword [rbp + 0x150], xmm0
movdqa xmmword [rbp + 0x160], xmm1
test al, al
je 0x18005285b
nop word [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180052850
mov rcx, qword [0x18017aed8]
sub r8d, edx
lea rdx, [rbp + 0x140]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov qword [rsp + 0x40], r15
lea rdx, [rbp - 0x50]
mov rax, qword [rsp + 0x40]
lea rcx, [rbp - 0x50]
mov qword [rbp - 0x50], rax
mov r8d, edx
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x48], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp - 0x50]
mov qword [rsp + 0x68], rax
xorps xmm0, xmmword [rsp + 0x60]
movq rax, xmm0
movdqa xmmword [rbp - 0x50], xmm0
test al, al
je 0x1800528eb
nop word [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x1800528e0
mov rcx, qword [0x18017aed8]
sub r8d, edx
lea rdx, [rbp - 0x50]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rax, 0x7312db1e2a3159cb
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x20]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp - 0x20], rax
movabs rax, 0xbfe30d4b65ff73b4
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x18], rax
movabs rax, 0x622d188f59c272b
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 8], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x400], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x408], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x410], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
movdqa xmm1, xmmword [rbp - 0x20]
xorps xmm1, xmmword [rbp + 0x400]
movdqa xmm0, xmmword [rbp - 0x10]
mov qword [rbp + 0x418], rax
movq rax, xmm1
xorps xmm0, xmmword [rbp + 0x410]
movdqa xmmword [rbp - 0x20], xmm1
movdqa xmmword [rbp - 0x10], xmm0
test al, al
je 0x1800529eb
nop word [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x1800529e0
mov rcx, qword [0x18017aed8]
sub r8d, edx
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x18017c738]
mov rax, qword [rcx]
mov rdx, qword [rax + 0x270]
call rdx
mov rcx, rax
mov r8d, eax
cmp byte [rax], r13b
je 0x180052a30
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180052a25
mov rcx, qword [0x18017aed8]
sub r8d, eax
xor r9d, r9d
mov qword [rsp + 0x20], r13
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rax, 0x650ec11c2c3359c9
lea rdx, [rbp + 0x170]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0x170]
mov rax, qword [rsp + 0x40]
movabs r15, 0x487bf0b00dd5d51b
mov qword [rbp + 0x170], rax
mov r8d, edx
movabs rax, 0xaefd4a105b9c32a9
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x178], rax
movabs rax, 0x68778dc6ee9a3a79
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x180], rax
movabs rax, 0xf7a1ca7d803a78a1
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x188], rax
movabs rax, 0x661791dd7fbabb3b
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x190], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x198], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x5d0], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov qword [rbp + 0x5d8], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x5e0], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x5e8], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x5f0], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp + 0x170]
xorps xmm2, xmmword [rbp + 0x5d0]
movdqa xmm0, xmmword [rbp + 0x180]
movdqa xmm1, xmmword [rbp + 0x190]
xorps xmm0, xmmword [rbp + 0x5e0]
mov qword [rbp + 0x5f8], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x5f0]
movdqa xmmword [rbp + 0x170], xmm2
movdqa xmmword [rbp + 0x180], xmm0
movdqa xmmword [rbp + 0x190], xmm1
test al, al
je 0x180052bbd
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180052bb2
mov rcx, qword [0x18017aed8]
sub r8d, edx
lea rdx, [rbp + 0x170]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x180052bf2
movabs rbx, 0x8a0ee29d662c2864
movabs r15, 0x487bf0b00dd5d51b
movabs rax, 0x1d05a9095f3b7993
lea rcx, [rbp + 0x320]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x320], rax
movabs rax, 0xdaf92d1d369253f0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x328], rax
movabs rax, 0x602ebe69af55435
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x330], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x338], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x420], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x428], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x430], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp + 0x320]
movdqa xmm1, xmmword [rbp + 0x330]
xorps xmm0, xmmword [rbp + 0x420]
mov qword [rbp + 0x438], rax
xorps xmm1, xmmword [rbp + 0x430]
movdqa xmmword [rbp + 0x330], xmm1
movdqa xmmword [rbp + 0x320], xmm0
call fcn.180076b50
mov r8, rax
test rax, rax
je 0x18005352b
movabs rax, 0x721bc62f313d3ad8
lea rdx, [rbp + 0x380]
mov qword [rsp + 0x40], rax
movabs rax, 0x9bcc6d3951cf1eb2
mov rcx, qword [rsp + 0x40]
mov qword [rbp + 0x380], rcx
mov qword [rsp + 0x40], rax
movabs rax, 0x6a6da8b0d8b01501
mov rcx, qword [rsp + 0x40]
mov qword [rbp + 0x388], rcx
mov rcx, r8
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x390], rax
movabs rax, 0xc082af43af137ead
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x398], rax
movabs rax, 0x487bf0b00dd58f41
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x3a0], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x3a8], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x600], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov qword [rbp + 0x608], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x610], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x618], rax
movdqa xmm1, xmmword [rbp + 0x610]
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x620], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp + 0x380]
xorps xmm0, xmmword [rbp + 0x600]
xorps xmm1, xmmword [rbp + 0x390]
movdqa xmmword [rbp + 0x380], xmm0
mov qword [rbp + 0x628], rax
movdqa xmm0, xmmword [rbp + 0x620]
xorps xmm0, xmmword [rbp + 0x3a0]
movdqa xmmword [rbp + 0x3a0], xmm0
movdqa xmmword [rbp + 0x390], xmm1
call fcn.180076e30
mov qword [0x18017cc60], rax
test rax, rax
je 0x18005352b
xor edx, edx
call fcn.180075a40
movabs rax, 0x691ec7057f391d94
lea rdx, [rbp]
mov qword [rsp + 0x40], rax
lea rcx, [rbp]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp], rax
movabs rax, 0xb3e14c035fd032a9
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 8], rax
movabs rax, 0x6a728689f9d53a36
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x10], rax
movabs rax, 0x84c0ea138b3678a7
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x18], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x440], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x448], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x450], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
movdqa xmm1, xmmword [rbp]
xorps xmm1, xmmword [rbp + 0x440]
movdqa xmm0, xmmword [rbp + 0x10]
mov qword [rbp + 0x458], rax
movq rax, xmm1
xorps xmm0, xmmword [rbp + 0x450]
movdqa xmmword [rbp], xmm1
movdqa xmmword [rbp + 0x10], xmm0
test al, al
je 0x180052f2c
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180052f21
mov rcx, qword [0x18017aed8]
sub r8d, edx
lea rdx, [rbp]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x18017c860]
test rcx, rcx
jne 0x180052f8b
nop dword [rax]
nop dword [rax + rax]
lea rdx, [0x18017c860]
lea rcx, [0x1800759c0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x18017c860]
test rcx, rcx
je 0x180052f60
lea r8, [0x18005e030]
mov edx, 0xfffffffc
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov qword [0x18017c958], rax
test rax, rax
je 0x18005352b
xor edx, edx
call fcn.180075a40
movabs rax, 0x640489182a22178e
lea rdx, [rbp + 0x1a0]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0x1a0]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp + 0x1a0], rax
movabs rax, 0xb3fb44595bd927b3
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x1a8], rax
movabs rax, 0x7263918ff6943d2d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x1b0], rax
movabs rax, 0xf4ad8570cf3d63ab
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x1b8], rax
movabs rax, 0x487bf0d468a1b077
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x1c0], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x1c8], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x630], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov qword [rbp + 0x638], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x640], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x648], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x650], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp + 0x1a0]
xorps xmm2, xmmword [rbp + 0x630]
movdqa xmm0, xmmword [rbp + 0x1b0]
movdqa xmm1, xmmword [rbp + 0x1c0]
xorps xmm0, xmmword [rbp + 0x640]
mov qword [rbp + 0x658], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x650]
movdqa xmmword [rbp + 0x1a0], xmm2
movdqa xmmword [rbp + 0x1b0], xmm0
movdqa xmmword [rbp + 0x1c0], xmm1
test al, al
je 0x18005311c
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180053111
mov rcx, qword [0x18017aed8]
sub r8d, edx
lea rdx, [rbp + 0x1a0]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8, qword [0x18017c748]
mov rdx, qword [0x18017c740]
mov rcx, qword [0x18017c860]
call fcn.180074290
xor ecx, ecx
call fcn.1800652b0
cmp byte [0x18017c750], r13b
jne 0x180053179
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x18017c750], r13b
je 0x180053165
xor edx, edx
call fcn.180075a40
movabs rax, 0x6f12db093b3c1c95
lea rdx, [rbp + 0x1d0]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0x1d0]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp + 0x1d0], rax
movabs rax, 0xbefb481255dd31e0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x1d8], rax
movabs rax, 0x6a638292f39b3d79
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x1e0], rax
movabs rax, 0xa4ae857a9b3276ab
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x1e8], rax
movabs rax, 0x2d0f95dc7db8ba78
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x1f0], rax
movabs rax, 0x8a0ee29d662c2800
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x1f8], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x660], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov qword [rbp + 0x668], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x670], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x678], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x680], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp + 0x1d0]
xorps xmm2, xmmword [rbp + 0x660]
movdqa xmm0, xmmword [rbp + 0x1e0]
movdqa xmm1, xmmword [rbp + 0x1f0]
xorps xmm0, xmmword [rbp + 0x670]
mov qword [rbp + 0x688], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x680]
movdqa xmmword [rbp + 0x1d0], xmm2
movdqa xmmword [rbp + 0x1e0], xmm0
movdqa xmmword [rbp + 0x1f0], xmm1
test al, al
je 0x1800532fb
nop word [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x1800532f0
mov rcx, qword [0x18017aed8]
sub r8d, edx
lea rdx, [rbp + 0x1d0]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.18006d180
test al, al
jne 0x180053562
mov dl, 3
call fcn.180075a40
movabs rbx, 0x6957cd09333b1881
lea rdx, [rbp + 0x20]
mov qword [rsp + 0x40], rbx
lea rcx, [rbp + 0x20]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp + 0x20], rax
movabs rax, 0xbbfc591058d573af
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x28], rax
movabs rax, 0x676a88c6ff8f3d35
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x30], rax
movabs rax, 0x84c0ea13ef537faf
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x38], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x460], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x468], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x470], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
movdqa xmm1, xmmword [rbp + 0x20]
xorps xmm1, xmmword [rbp + 0x460]
movdqa xmm0, xmmword [rbp + 0x30]
mov qword [rbp + 0x478], rax
movq rax, xmm1
xorps xmm0, xmmword [rbp + 0x470]
movdqa xmmword [rbp + 0x20], xmm1
movdqa xmmword [rbp + 0x30], xmm0
test al, al
je 0x18005341b
nop dword [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180053410
mov rcx, qword [0x18017aed8]
sub r8d, edx
lea rdx, [rbp + 0x20]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dl, 3
call fcn.180075a40
mov qword [rsp + 0x40], rbx
lea rdx, [rbp + 0x40]
mov rax, qword [rsp + 0x40]
lea rcx, [rbp + 0x40]
mov qword [rbp + 0x40], rax
mov r8d, edx
movabs rax, 0xfae5580d53cf73af
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x48], rax
movabs rax, 0x6718787ef863d2f
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x50], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x58], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x3b0], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x3b8], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x3c0], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
movdqa xmm1, xmmword [rbp + 0x40]
xorps xmm1, xmmword [rbp + 0x3b0]
movdqa xmm0, xmmword [rbp + 0x50]
mov qword [rbp + 0x3c8], rax
movq rax, xmm1
xorps xmm0, xmmword [rbp + 0x3c0]
movdqa xmmword [rbp + 0x40], xmm1
movdqa xmmword [rbp + 0x50], xmm0
test al, al
je 0x18005350f
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180053504
mov rcx, qword [0x18017aed8]
sub r8d, edx
lea rdx, [rbp + 0x40]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor al, al
mov rcx, qword [rbp + 0x9d0]
xor rcx, rsp
call fcn.1800da960
lea r11, [rsp + 0xaf0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor edx, edx
call fcn.180075a40
movabs rax, 0x6e12db192b331c81
lea rdx, [rbp + 0x200]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0x200]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp + 0x200], rax
movabs rax, 0xb6f4440d5fd23ae0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x208], rax
movabs rax, 0x266c848fee942e30
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x210], rax
movabs rax, 0xe1b48f7f9f3e63a1
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x218], rax
movabs rax, 0x487bf0b00dd5d57f
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x220], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x228], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x690], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov qword [rbp + 0x698], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x6a0], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x6a8], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x6b0], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp + 0x200]
xorps xmm2, xmmword [rbp + 0x690]
movdqa xmm0, xmmword [rbp + 0x210]
movdqa xmm1, xmmword [rbp + 0x220]
xorps xmm0, xmmword [rbp + 0x6a0]
mov qword [rbp + 0x6b8], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x6b0]
movdqa xmmword [rbp + 0x200], xmm2
movdqa xmmword [rbp + 0x210], xmm0
movdqa xmmword [rbp + 0x220], xmm1
test al, al
je 0x1800536db
nop word [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x1800536d0
mov rcx, qword [0x18017aed8]
sub r8d, edx
lea rdx, [rbp + 0x200]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rax, 0x1d12a9045f317994
lea rcx, [rbp + 0x340]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x340], rax
movabs rax, 0xdae12d5736dd53ad
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x348], rax
movabs rax, 0x602ebe69a815421
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x350], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x358], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x480], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x488], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x490], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp + 0x340]
movdqa xmm1, xmmword [rbp + 0x350]
xorps xmm0, xmmword [rbp + 0x480]
mov qword [rbp + 0x498], rax
xorps xmm1, xmmword [rbp + 0x490]
movdqa xmmword [rbp + 0x350], xmm1
movdqa xmmword [rbp + 0x340], xmm0
call fcn.18006afb0
test al, al
je 0x18005352b
xor edx, edx
call fcn.180075a40
movabs rax, 0x6e57c8013a3a1a94
lea rdx, [rbp + 0x260]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0x260]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp + 0x260], rax
movabs rax, 0xb4fc0d1453c820b9
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x268], rax
movabs rax, 0x6778828afb9c2030
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x270], rax
movabs rax, 0xe9af8933813c65b6
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x278], rax
movabs rax, 0x487b94d579b0b96b
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x280], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x288], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x6c0], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov qword [rbp + 0x6c8], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x6d0], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x6d8], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x6e0], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp + 0x260]
xorps xmm2, xmmword [rbp + 0x6c0]
movdqa xmm0, xmmword [rbp + 0x270]
movdqa xmm1, xmmword [rbp + 0x280]
xorps xmm0, xmmword [rbp + 0x6d0]
mov qword [rbp + 0x6e8], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x6e0]
movdqa xmmword [rbp + 0x260], xmm2
movdqa xmmword [rbp + 0x270], xmm0
movdqa xmmword [rbp + 0x280], xmm1
test al, al
je 0x18005395b
nop word [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180053950
mov rcx, qword [0x18017aed8]
sub r8d, edx
lea rdx, [rbp + 0x260]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rax, 0x1d01a9025f3d7984
lea rcx, [rbp + 0x360]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x360], rax
movabs rax, 0xdabb2d0a36ce53a1
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x368], rax
movabs rax, 0x602eb929a8d542d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x370], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x378], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x4a0], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x4a8], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x4b0], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp + 0x360]
movdqa xmm1, xmmword [rbp + 0x370]
xorps xmm0, xmmword [rbp + 0x4a0]
mov qword [rbp + 0x4b8], rax
xorps xmm1, xmmword [rbp + 0x4b0]
movdqa xmmword [rbp + 0x370], xmm1
movdqa xmmword [rbp + 0x360], xmm0
call fcn.18005a6b0
test al, al
je 0x18005352b
xor edx, edx
call fcn.180075a40
movabs rax, 0x3d04db0d293c1684
lea rdx, [rbp + 0x110]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0x110]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp + 0x110], rax
movabs rax, 0xb9b5491c46d126a4
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x118], rax
movabs rax, 0x62679f83f6853936
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x120], rax
movabs rax, 0xf0b59a679a3c2cee
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x128], rax
movabs rax, 0x290d9edf6ef7f521
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x130], rax
movabs rax, 0x8a2c96e512025b16
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x138], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x6f0], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov qword [rbp + 0x6f8], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x700], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x708], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x710], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp + 0x110]
xorps xmm2, xmmword [rbp + 0x6f0]
movdqa xmm0, xmmword [rbp + 0x120]
movdqa xmm1, xmmword [rbp + 0x130]
xorps xmm0, xmmword [rbp + 0x700]
mov qword [rbp + 0x718], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x710]
movdqa xmmword [rbp + 0x110], xmm2
movdqa xmmword [rbp + 0x120], xmm0
movdqa xmmword [rbp + 0x130], xmm1
test al, al
je 0x180053bdb
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180053bd0
mov rcx, qword [0x18017aed8]
sub r8d, edx
lea rdx, [rbp + 0x110]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rdx, 0x68045f57217a8e71
call fcn.180059300
movabs rdx, 0x8b4a6c039af717a8
mov qword [0x18017c868], rax
mov r12, rax
call fcn.180059300
movabs rdx, 0xe2d2563b91bdc56c
mov qword [0x18017c880], rax
mov r15, rax
call fcn.180059300
movabs rdx, 0xd5db34823d6f1c40
mov qword [0x18017c878], rax
mov r14, rax
call fcn.180059300
movabs rdx, 0xb231a1bea995f83b
mov qword [0x18017c888], rax
mov rsi, rax
call fcn.180059300
movabs rdx, 0x5f0720d54e5f164
mov qword [0x18017c870], rax
mov rdi, rax
call fcn.180059300
movabs rdx, 0x483047d5ed936395
mov qword [0x18017c890], rax
mov rbx, rax
call fcn.180059300
test rax, rax
mov qword [0x18017c898], rax
mov edx, r13d
mov r8d, r13d
setne cl
test rbx, rbx
setne al
and cl, al
test rdi, rdi
movzx eax, cl
mov ecx, r13d
cmovne edx, eax
test rsi, rsi
setne al
and dl, al
test r14, r14
movzx eax, dl
cmovne r8d, eax
test r15, r15
setne al
and r8b, al
test r12, r12
movzx eax, r8b
cmovne ecx, eax
test cl, cl
je 0x18005352b
xor edx, edx
call fcn.180075a40
movabs rax, 0x3d04db0d293c1684
lea rdx, [rbp + 0x290]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0x290]
mov rax, qword [rsp + 0x40]
movabs r12, 0x8a0ee29d662c2864
mov qword [rbp + 0x290], rax
movabs r14, 0x1d77a96c5f5279e7
movabs rax, 0xb3b5401c42cf2ab3
movabs rdi, 0xda952d7936bc53c0
mov qword [rsp + 0x40], rax
movabs r15, 0x602ebe69af55459
mov rax, qword [rsp + 0x40]
movabs rsi, 0x84c0ea13ef530cc2
mov qword [rbp + 0x298], rax
movabs rbx, 0x487bf0b00dd5d51b
movabs rax, 0x7c6b8787f3813d37
mov r8d, edx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x2a0], rax
movabs rax, 0xeba3ca7d803a78a3
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x2a8], rax
movabs rax, 0x481f95c468b9a576
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x2b0], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x2b8], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x720], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r15
mov qword [rbp + 0x728], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x730], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x738], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x740], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp + 0x290]
xorps xmm2, xmmword [rbp + 0x720]
movdqa xmm0, xmmword [rbp + 0x2a0]
movdqa xmm1, xmmword [rbp + 0x2b0]
xorps xmm0, xmmword [rbp + 0x730]
mov qword [rbp + 0x748], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x740]
movdqa xmmword [rbp + 0x290], xmm2
movdqa xmmword [rbp + 0x2a0], xmm0
movdqa xmmword [rbp + 0x2b0], xmm1
test al, al
je 0x180053e9e
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180053e93
mov rcx, qword [0x18017aed8]
sub r8d, edx
lea rdx, [rbp + 0x290]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.18005bbf0
test al, al
je 0x18005352b
xor edx, edx
call fcn.180075a40
movabs rax, 0x731e891f343d168f
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x40]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp - 0x40], rax
movabs rax, 0xbbef441557d527a9
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x38], rax
movabs rax, 0x6b6d88c6f49a3d2d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x30], rax
movabs rax, 0x84c08e769b3660b2
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x28], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x4c0], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x4c8], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x4d0], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
movdqa xmm1, xmmword [rbp - 0x40]
xorps xmm1, xmmword [rbp + 0x4c0]
movdqa xmm0, xmmword [rbp - 0x30]
mov qword [rbp + 0x4d8], rax
movq rax, xmm1
xorps xmm0, xmmword [rbp + 0x4d0]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmmword [rbp - 0x30], xmm0
test al, al
je 0x180053fbb
nop dword [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180053fb0
mov rcx, qword [0x18017aed8]
sub r8d, edx
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rax, 0x1d16a90a5f377983
lea rcx, [rbp + 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x70], rax
movabs rax, 0xda952d0d36d053b5
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x78], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp + 0x70]
mov qword [rsp + 0x78], rax
xorps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp + 0x70], xmm0
call fcn.180055a70
test al, al
jne 0x18005425a
mov dl, 2
call fcn.180075a40
movabs rbx, 0x6957cd09333b1881
lea rdx, [rbp + 0x2c0]
mov qword [rsp + 0x40], rbx
movabs rcx, 0xd667607a44b30a6
mov rax, qword [rsp + 0x40]
movabs rbx, 0x487bf0b00dd5d51b
mov qword [rbp + 0x2c0], rax
mov r8d, edx
movabs rax, 0xfae5580d53cf73af
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x2c8], rax
movabs rax, 0x6a229989b5913a38
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x2d0], rax
movabs rax, 0xe5a68f77cf376dad
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x2d8], rax
movabs rax, 0x2e159fd32da1b96e
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x2e0], rax
movabs rax, 0xe56796fc14594f0d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x2e8], rax
movabs rax, 0x371ff37a56e1f143
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x2f0], rax
mov qword [rsp + 0x40], rcx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x2f8], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x780], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r15
mov qword [rbp + 0x788], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x790], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rbx
mov qword [rbp + 0x798], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x7a0], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x7a8], rax
movabs rax, 0x371ff37a56e1f12d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x7b0], rax
mov qword [rsp + 0x40], rcx
lea rcx, [rbp + 0x2c0]
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp + 0x2d0]
xorps xmm0, xmmword [rbp + 0x790]
movdqa xmm2, xmmword [rbp + 0x2c0]
xorps xmm2, xmmword [rbp + 0x780]
movdqa xmm1, xmmword [rbp + 0x2e0]
xorps xmm1, xmmword [rbp + 0x7a0]
movdqa xmmword [rbp + 0x2d0], xmm0
movdqa xmm0, xmmword [rbp + 0x2f0]
mov qword [rbp + 0x7b8], rax
movq rax, xmm2
xorps xmm0, xmmword [rbp + 0x7b0]
movdqa xmmword [rbp + 0x2f0], xmm0
movdqa xmmword [rbp + 0x2c0], xmm2
movdqa xmmword [rbp + 0x2e0], xmm1
test al, al
je 0x18005424b
nop word [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180054240
sub r8d, edx
lea rdx, [rbp + 0x2c0]
jmp 0x1800543b2
xor edx, edx
call fcn.180075a40
movabs rax, 0x6f02ce05393c1684
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x80]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp - 0x80], rax
movabs rax, 0xa3e60d1759d527a1
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x78], rax
movabs rax, 0x6f6c82c6f790202a
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x70], rax
movabs rax, 0xf0a1907a833265b6
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
movabs rax, 0x38169fd32dbbba72
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
movabs rax, 0x8a0ee2f903584d08
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x58], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x750], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r15
mov qword [rbp + 0x758], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x760], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x768], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x770], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp - 0x80]
xorps xmm2, xmmword [rbp + 0x750]
movdqa xmm0, xmmword [rbp - 0x70]
movdqa xmm1, xmmword [rbp - 0x60]
xorps xmm0, xmmword [rbp + 0x760]
mov qword [rbp + 0x778], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x770]
movdqa xmmword [rbp - 0x80], xmm2
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmmword [rbp - 0x60], xmm1
test al, al
je 0x1800543ab
nop
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x1800543a0
sub r8d, edx
lea rdx, [rbp - 0x80]
mov rcx, qword [0x18017aed8]
xor r9d, r9d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
call fcn.180075a40
movabs rax, 0x7c1ed11537220a86
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x80]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp - 0x80], rax
movabs rax, 0xb6f4440d5fd23ae0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x78], rax
movabs rax, 0x266c848fee942e30
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x70], rax
movabs rax, 0xe1b48f7f9f3e63a1
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
movabs rax, 0x210882d57bf5f97f
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
movabs rax, 0x8a0ee29d4616460b
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x58], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x3b0], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r15
mov qword [rbp + 0x3b8], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x3c0], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x3c8], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x3d0], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp - 0x80]
xorps xmm2, xmmword [rbp + 0x3b0]
movdqa xmm0, xmmword [rbp - 0x70]
movdqa xmm1, xmmword [rbp - 0x60]
xorps xmm0, xmmword [rbp + 0x3c0]
mov qword [rbp + 0x3d8], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x3d0]
movdqa xmmword [rbp - 0x80], xmm2
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmmword [rbp - 0x60], xmm1
test al, al
je 0x18005451b
nop dword [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180054510
mov rcx, qword [0x18017aed8]
sub r8d, edx
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rdx, str.1000
mov r8, rdx
inc r8
cmp byte [r8], r13b
jne 0x180054541
mov rcx, qword [0x18017aed8]
sub r8d, edx
xor r9d, r9d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov al, 1
jmp 0x18005352d