Function at 0x180017810
Capabilities:
Allocate or change rwx memory
Check if file exists
Create thread
Get file attributes
Inject thread
Print debug messages
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0x9e8
mov rax, qword [0x1802bb7b8]
xor rax, rsp
mov qword [rsp + 0x9d0], rax
mov dword [rsp + 0x40], 0
cmp dword [rsp + 0xa00], 4
jae 0x180017935
lea rax, [rsp + 0x95]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x230]
lea rcx, [0x1800c5560]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x4a
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x24
movzx eax, word [rsp + rax + 0x230]
test eax, eax
je 0x18001789c
mov dword [rsp + 0xd8], 1
jmp 0x1800178a7
mov dword [rsp + 0xd8], 0
movzx eax, byte [rsp + 0xd8]
test eax, eax
je 0x18001790d
mov dword [rsp + 0x48], 0
jmp 0x1800178c7
mov eax, dword [rsp + 0x48]
inc eax
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0x25
jge 0x18001790d
movsxd rax, dword [rsp + 0x48]
movzx eax, word [rsp + rax*2 + 0x230]
mov dword [rsp + 0x118], eax
mov eax, dword [rsp + 0x48]
cdq
mov ecx, 0x3a
idiv ecx
mov eax, edx
add eax, 0x31
mov ecx, dword [rsp + 0x118]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x48]
mov word [rsp + rcx*2 + 0x230], ax
jmp 0x1800178bd
lea rax, [rsp + 0x230]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x40], 6
jmp 0x180018784
mov rcx, qword [rsp + 0xa08]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rsp + 0xac], eax
cmp dword [rsp + 0xac], 0xffffffff
jne 0x180017d6b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x88], eax
cmp dword [rsp + 0x88], 2
jne 0x180017a59
lea rax, [rsp + 0x8c]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x280]
lea rcx, [0x1800c55b0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x4a
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x24
movzx eax, word [rsp + rax + 0x280]
test eax, eax
je 0x1800179c5
mov dword [rsp + 0x9c], 1
jmp 0x1800179d0
mov dword [rsp + 0x9c], 0
movzx eax, byte [rsp + 0x9c]
test eax, eax
je 0x180017a36
mov dword [rsp + 0x4c], 0
jmp 0x1800179f0
mov eax, dword [rsp + 0x4c]
inc eax
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x4c], 0x25
jge 0x180017a36
movsxd rax, dword [rsp + 0x4c]
movzx eax, word [rsp + rax*2 + 0x280]
mov dword [rsp + 0x11c], eax
mov eax, dword [rsp + 0x4c]
cdq
mov ecx, 0x3a
idiv ecx
mov eax, edx
add eax, 0x31
mov ecx, dword [rsp + 0x11c]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x4c]
mov word [rsp + rcx*2 + 0x280], ax
jmp 0x1800179e6
lea rax, [rsp + 0x280]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x40], 1
jmp 0x180018784
cmp dword [rsp + 0x88], 3
jne 0x180017b4d
lea rax, [rsp + 0x8d]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x2d0]
lea rcx, [0x1800c5600]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x4a
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x24
movzx eax, word [rsp + rax + 0x2d0]
test eax, eax
je 0x180017ab9
mov dword [rsp + 0xa0], 1
jmp 0x180017ac4
mov dword [rsp + 0xa0], 0
movzx eax, byte [rsp + 0xa0]
test eax, eax
je 0x180017b2a
mov dword [rsp + 0x50], 0
jmp 0x180017ae4
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0x25
jge 0x180017b2a
movsxd rax, dword [rsp + 0x50]
movzx eax, word [rsp + rax*2 + 0x2d0]
mov dword [rsp + 0xe8], eax
mov eax, dword [rsp + 0x50]
cdq
mov ecx, 0x3a
idiv ecx
mov eax, edx
add eax, 0x31
mov ecx, dword [rsp + 0xe8]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x50]
mov word [rsp + rcx*2 + 0x2d0], ax
jmp 0x180017ada
lea rax, [rsp + 0x2d0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x40], 2
jmp 0x180018784
cmp dword [rsp + 0x88], 5
jne 0x180017c46
lea rax, [rsp + 0x8e]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x1e0]
lea rcx, [0x1800c5650]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x48
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x23
movzx eax, word [rsp + rax + 0x1e0]
test eax, eax
je 0x180017bad
mov dword [rsp + 0xa4], 1
jmp 0x180017bb8
mov dword [rsp + 0xa4], 0
movzx eax, byte [rsp + 0xa4]
test eax, eax
je 0x180017c1e
mov dword [rsp + 0x54], 0
jmp 0x180017bd8
mov eax, dword [rsp + 0x54]
inc eax
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0x24
jge 0x180017c1e
movsxd rax, dword [rsp + 0x54]
movzx eax, word [rsp + rax*2 + 0x1e0]
mov dword [rsp + 0xec], eax
mov eax, dword [rsp + 0x54]
cdq
mov ecx, 0x3a
idiv ecx
mov eax, edx
add eax, 0x31
mov ecx, dword [rsp + 0xec]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x54]
mov word [rsp + rcx*2 + 0x1e0], ax
jmp 0x180017bce
lea rax, [rsp + 0x1e0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x40], 3
jmp 0x180018784
lea rax, [rsp + 0x5b0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x8f]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x4a0]
lea rcx, [0x1800c56a0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x66
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x32
movzx eax, word [rsp + rax + 0x4a0]
test eax, eax
je 0x180017cac
mov dword [rsp + 0xa8], 1
jmp 0x180017cb7
mov dword [rsp + 0xa8], 0
movzx eax, byte [rsp + 0xa8]
test eax, eax
je 0x180017d1d
mov dword [rsp + 0x58], 0
jmp 0x180017cd7
mov eax, dword [rsp + 0x58]
inc eax
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0x33
jge 0x180017d1d
movsxd rax, dword [rsp + 0x58]
movzx eax, word [rsp + rax*2 + 0x4a0]
mov dword [rsp + 0xf0], eax
mov eax, dword [rsp + 0x58]
cdq
mov ecx, 0x3a
idiv ecx
mov eax, edx
add eax, 0x31
mov ecx, dword [rsp + 0xf0]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x58]
mov word [rsp + rcx*2 + 0x4a0], ax
jmp 0x180017ccd
lea rax, [rsp + 0x4a0]
mov r9d, dword [rsp + 0x88]
mov r8d, dword [rsp + 0x88]
mov rdx, rax
lea rcx, [rsp + 0x5b0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x5b0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x40], 4
jmp 0x180018784
mov eax, dword [rsp + 0xac]
and eax, 0x10
test eax, eax
je 0x180017e68
lea rax, [rsp + 0x90]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x320]
lea rcx, [0x1800c5710]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x52
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x28
movzx eax, word [rsp + rax + 0x320]
test eax, eax
je 0x180017dcf
mov dword [rsp + 0xb0], 1
jmp 0x180017dda
mov dword [rsp + 0xb0], 0
movzx eax, byte [rsp + 0xb0]
test eax, eax
je 0x180017e40
mov dword [rsp + 0x44], 0
jmp 0x180017dfa
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0x29
jge 0x180017e40
movsxd rax, dword [rsp + 0x44]
movzx eax, word [rsp + rax*2 + 0x320]
mov dword [rsp + 0xf4], eax
mov eax, dword [rsp + 0x44]
cdq
mov ecx, 0x3a
idiv ecx
mov eax, edx
add eax, 0x31
mov ecx, dword [rsp + 0xf4]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x44]
mov word [rsp + rcx*2 + 0x320], ax
jmp 0x180017df0
lea rax, [rsp + 0x320]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x40], 5
jmp 0x180018784
mov qword [rsp + 0x80], 0xffffffffffffffff
xor r9d, r9d
mov r8d, dword [rsp + 0xa00]
xor edx, edx
mov ecx, 0x1fffff
call sym.VisualLibrary.dll_xHunter_OpenProcess
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0xffffffffffffffff
je 0x180017ead
cmp qword [rsp + 0x80], 0
jne 0x180017f98
lea rax, [rsp + 0x91]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x190]
lea rcx, [0x1800c5770]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x44
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x21
movzx eax, word [rsp + rax + 0x190]
test eax, eax
je 0x180017eff
mov dword [rsp + 0xb4], 1
jmp 0x180017f0a
mov dword [rsp + 0xb4], 0
movzx eax, byte [rsp + 0xb4]
test eax, eax
je 0x180017f70
mov dword [rsp + 0x5c], 0
jmp 0x180017f2a
mov eax, dword [rsp + 0x5c]
inc eax
mov dword [rsp + 0x5c], eax
cmp dword [rsp + 0x5c], 0x22
jge 0x180017f70
movsxd rax, dword [rsp + 0x5c]
movzx eax, word [rsp + rax*2 + 0x190]
mov dword [rsp + 0xf8], eax
mov eax, dword [rsp + 0x5c]
cdq
mov ecx, 0x3a
idiv ecx
mov eax, edx
add eax, 0x31
mov ecx, dword [rsp + 0xf8]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x5c]
mov word [rsp + rcx*2 + 0x190], ax
jmp 0x180017f20
lea rax, [rsp + 0x190]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x40], 7
jmp 0x180018784
lea rax, [rsp + 0x92]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x128]
lea rcx, str.ZWAZPZ
mov rdi, rax
mov rsi, rcx
mov ecx, 0xd
rep movsb byte [rdi], byte [rsi]
mov eax, 1
imul rax, rax, 0xc
movsx eax, byte [rsp + rax + 0x128]
test eax, eax
je 0x180017fea
mov dword [rsp + 0xb8], 1
jmp 0x180017ff5
mov dword [rsp + 0xb8], 0
movzx eax, byte [rsp + 0xb8]
test eax, eax
je 0x18001805a
mov dword [rsp + 0x60], 0
jmp 0x180018015
mov eax, dword [rsp + 0x60]
inc eax
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0xd
jge 0x18001805a
movsxd rax, dword [rsp + 0x60]
movsx eax, byte [rsp + rax + 0x128]
mov dword [rsp + 0xfc], eax
mov eax, dword [rsp + 0x60]
cdq
mov ecx, 0x3a
idiv ecx
mov eax, edx
add eax, 0x31
mov ecx, dword [rsp + 0xfc]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x60]
mov byte [rsp + rcx + 0x128], al
jmp 0x18001800b
lea rax, [rsp + 0x128]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x148], rax
cmp qword [rsp + 0x148], 0
jne 0x18001817b
lea rax, [rsp + 0x93]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x3e0]
lea rcx, [0x1800c57d0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x60
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x2f
movzx eax, word [rsp + rax + 0x3e0]
test eax, eax
je 0x1800180d4
mov dword [rsp + 0xbc], 1
jmp 0x1800180df
mov dword [rsp + 0xbc], 0
movzx eax, byte [rsp + 0xbc]
test eax, eax
je 0x180018145
mov dword [rsp + 0x64], 0
jmp 0x1800180ff
mov eax, dword [rsp + 0x64]
inc eax
mov dword [rsp + 0x64], eax
cmp dword [rsp + 0x64], 0x30
jge 0x180018145
movsxd rax, dword [rsp + 0x64]
movzx eax, word [rsp + rax*2 + 0x3e0]
mov dword [rsp + 0x100], eax
mov eax, dword [rsp + 0x64]
cdq
mov ecx, 0x3a
idiv ecx
mov eax, edx
add eax, 0x31
mov ecx, dword [rsp + 0x100]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x64]
mov word [rsp + rcx*2 + 0x3e0], ax
jmp 0x1800180f5
lea rax, [rsp + 0x3e0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x40], 8
jmp 0x180018784
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0x120], 0
lea rax, [rsp + 0x94]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x138]
lea rcx, [0x1800c5830]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xd
rep movsb byte [rdi], byte [rsi]
mov eax, 1
imul rax, rax, 0xc
movsx eax, byte [rsp + rax + 0x138]
test eax, eax
je 0x1800181e5
mov dword [rsp + 0xc0], 1
jmp 0x1800181f0
mov dword [rsp + 0xc0], 0
movzx eax, byte [rsp + 0xc0]
test eax, eax
je 0x180018255
mov dword [rsp + 0x68], 0
jmp 0x180018210
mov eax, dword [rsp + 0x68]
inc eax
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0xd
jge 0x180018255
movsxd rax, dword [rsp + 0x68]
movsx eax, byte [rsp + rax + 0x138]
mov dword [rsp + 0x104], eax
mov eax, dword [rsp + 0x68]
cdq
mov ecx, 0x3a
idiv ecx
mov eax, edx
add eax, 0x31
mov ecx, dword [rsp + 0x104]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x68]
mov byte [rsp + rcx + 0x138], al
jmp 0x180018206
lea rax, [rsp + 0x138]
mov rdx, rax
mov rcx, qword [rsp + 0x148]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x120], rax
mov rcx, qword [rsp + 0xa08]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
cdqe
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, rax
xor edx, edx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0xe0], rax
cmp qword [rsp + 0xe0], 0
je 0x1800182c9
cmp qword [rsp + 0x120], 0
jne 0x180018409
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xc8], eax
lea rax, [rsp + 0x7c0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x99]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x510]
lea rcx, [0x1800c5840]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x9a
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x4c
movzx eax, word [rsp + rax + 0x510]
test eax, eax
je 0x18001833c
mov dword [rsp + 0xc4], 1
jmp 0x180018347
mov dword [rsp + 0xc4], 0
movzx eax, byte [rsp + 0xc4]
test eax, eax
je 0x1800183ad
mov dword [rsp + 0x6c], 0
jmp 0x180018367
mov eax, dword [rsp + 0x6c]
inc eax
mov dword [rsp + 0x6c], eax
cmp dword [rsp + 0x6c], 0x4d
jge 0x1800183ad
movsxd rax, dword [rsp + 0x6c]
movzx eax, word [rsp + rax*2 + 0x510]
mov dword [rsp + 0x108], eax
mov eax, dword [rsp + 0x6c]
cdq
mov ecx, 0x3a
idiv ecx
mov eax, edx
add eax, 0x31
mov ecx, dword [rsp + 0x108]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x6c]
mov word [rsp + rcx*2 + 0x510], ax
jmp 0x18001835d
lea rax, [rsp + 0x510]
mov r9d, dword [rsp + 0xc8]
mov r8d, dword [rsp + 0xc8]
mov rdx, rax
lea rcx, [rsp + 0x7c0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x7c0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x40], 9
jmp 0x180018784
mov rcx, qword [rsp + 0xa08]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
cdqe
mov qword [rsp + 0x20], 0
mov r9, rax
lea r8, [rsp + 0xa08]
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x18001853f
lea rax, [rsp + 0x96]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x440]
lea rcx, str.sS__V
mov rdi, rax
mov rsi, rcx
mov ecx, 0x60
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x2f
movzx eax, word [rsp + rax + 0x440]
test eax, eax
je 0x18001849d
mov dword [rsp + 0xcc], 1
jmp 0x1800184a8
mov dword [rsp + 0xcc], 0
movzx eax, byte [rsp + 0xcc]
test eax, eax
je 0x18001850e
mov dword [rsp + 0x70], 0
jmp 0x1800184c8
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0x30
jge 0x18001850e
movsxd rax, dword [rsp + 0x70]
movzx eax, word [rsp + rax*2 + 0x440]
mov dword [rsp + 0x10c], eax
mov eax, dword [rsp + 0x70]
cdq
mov ecx, 0x3a
idiv ecx
mov eax, edx
add eax, 0x31
mov ecx, dword [rsp + 0x10c]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x70]
mov word [rsp + rcx*2 + 0x440], ax
jmp 0x1800184be
lea rax, [rsp + 0x440]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x40], 9
jmp 0x180018784
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x120]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0x150], rax
cmp qword [rsp + 0x150], 0xffffffffffffffff
jne 0x180018683
lea rax, [rsp + 0x97]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x380]
lea rcx, [0x1800c5940]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x58
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x2b
movzx eax, word [rsp + rax + 0x380]
test eax, eax
je 0x1800185e1
mov dword [rsp + 0xd0], 1
jmp 0x1800185ec
mov dword [rsp + 0xd0], 0
movzx eax, byte [rsp + 0xd0]
test eax, eax
je 0x180018652
mov dword [rsp + 0x74], 0
jmp 0x18001860c
mov eax, dword [rsp + 0x74]
inc eax
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0x74], 0x2c
jge 0x180018652
movsxd rax, dword [rsp + 0x74]
movzx eax, word [rsp + rax*2 + 0x380]
mov dword [rsp + 0x110], eax
mov eax, dword [rsp + 0x74]
cdq
mov ecx, 0x3a
idiv ecx
mov eax, edx
add eax, 0x31
mov ecx, dword [rsp + 0x110]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x74]
mov word [rsp + rcx*2 + 0x380], ax
jmp 0x180018602
lea rax, [rsp + 0x380]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x40], 0xa
jmp 0x180018784
lea rax, [rsp + 0x98]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x158]
lea rcx, [0x1800c5998]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x34
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x19
movzx eax, word [rsp + rax + 0x158]
test eax, eax
je 0x1800186d5
mov dword [rsp + 0xd4], 1
jmp 0x1800186e0
mov dword [rsp + 0xd4], 0
movzx eax, byte [rsp + 0xd4]
test eax, eax
je 0x180018746
mov dword [rsp + 0x78], 0
jmp 0x180018700
mov eax, dword [rsp + 0x78]
inc eax
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 0x1a
jge 0x180018746
movsxd rax, dword [rsp + 0x78]
movzx eax, word [rsp + rax*2 + 0x158]
mov dword [rsp + 0x114], eax
mov eax, dword [rsp + 0x78]
cdq
mov ecx, 0x3a
idiv ecx
mov eax, edx
add eax, 0x31
mov ecx, dword [rsp + 0x114]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x78]
mov word [rsp + rcx*2 + 0x158], ax
jmp 0x1800186f6
lea rax, [rsp + 0x158]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x9d0]
xor rcx, rsp
call fcn.18004e560
add rsp, 0x9e8
pop rdi
pop rsi
ret