Function at 0x180002ac0
Capabilities:
Set file attributes
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xc8
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, 0x578
xor edx, edx
mov rcx, rax
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8d, edi
xor edx, edx
mov rcx, rax
mov qword [section..data], rax
call fcn.180005f30
mov r13, qword [section..data]
xor eax, eax
mov ecx, 0x3053
mov qword [rbp + 7], r13
mov edx, 0x3523
mov r9d, 0x3a05
mov r8d, 0x3415
mov qword [r13 + 0x280], rcx
mov qword [r13 + 0x290], rcx
mov qword [r13 + 0x168], 0x318d
mov qword [r13 + 0x328], rdx
mov qword [r13 + 0x118], r13
mov qword [r13 + 0x510], r13
mov qword [r13 + 0xe8], r13
mov qword [r13 + 0x190], r13
mov qword [r13 + 0x128], r13
mov qword [r13 + 0x4f8], r9
mov dword [r13 + 0x558], 1
mov dword [r13 + 0x4d0], ebx
mov dword [rbp + 0x7f], eax
mov dword [rbp - 9], 0x37b1
mov dword [rbp - 0x29], eax
mov dword [rbp - 0x15], eax
mov dword [rbp - 0x1d], 0x378a
mov dword [rbp - 1], eax
mov dword [rbp - 0x11], r8d
mov dword [rbp + 3], edx
mov dword [rbp + 0x77], eax
mov dword [rbp - 5], 0x3655
mov dword [rbp - 0xd], ecx
mov dword [rbp + 0x67], eax
mov eax, 0x362a
mov dword [rbp - 0x21], eax
mov dword [rbp - 0x19], eax
mov dword [rbp + 0x6f], 0x33a3
mov dword [rbp - 0x25], 0x32ec
mov ecx, dword [rbp - 0x19]
mov eax, dword [rbp - 0x15]
add ecx, 0xfffffb58
cmp eax, ecx
je 0x180002ec2
add dword [rbp + 0x6f], 0x72
mov ecx, dword [rbp + 0x7f]
mov r12d, dword [rbp + 0x67]
add ecx, 0x2f79
add r12d, r8d
mov r8d, dword [rbp + 0x67]
add r8d, r9d
mov r9d, dword [rbp - 0x21]
mov r15d, dword [rbp - 5]
add r9d, 0x2b9
mov r14d, dword [rbp + 0x67]
sub r15d, 0x562
mov esi, dword [rbp - 0x21]
add r14d, 0x3182
mov edi, dword [rbp - 0x25]
add esi, 0x187
mov ebx, dword [rbp + 0x6f]
add edi, 0x237
mov r11d, dword [rbp - 1]
add ebx, 0x4ce
mov r10d, dword [rbp - 0x15]
add r11d, 0x38e3
mov edx, dword [rbp + 0x6f]
add r10d, 0x318c
mov eax, dword [rbp - 0x29]
add edx, 0x81d
add eax, 0x338c
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], edx
mov edx, r12d
mov dword [rsp + 0x58], r10d
mov dword [rsp + 0x50], r11d
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r15d
call fcn.180016e5c
mov dword [rbp - 9], eax
mov r14d, 0x3c12
mov rax, qword [r13 + 0x128]
mov edx, 0x3655
mov r9d, 0x338c
mov r8, r13
imul ecx, dword [rax + 0x280], 0xeb7e2098
lea rax, [0x1801b9090]
mov qword [rsp + 0x48], rax
mov eax, 0x3053
mov byte [rsp + 0x40], 0x5f
mov byte [rsp + 0x38], 0x99
mov dword [rsp + 0x30], 8
mov dword [rsp + 0x28], ecx
mov ecx, r14d
mov word [rsp + 0x20], ax
call fcn.180017234
mov ecx, dword [rbp - 0x11]
mov r15d, 0x187
mov edx, dword [rbp - 0x11]
mov r8d, dword [rbp + 0x7f]
mov esi, dword [rbp + 0x77]
add r8d, 0x3a05
mov edi, dword [rbp + 0x7f]
add esi, 0x3c32
mov ebx, dword [rbp - 0x21]
add edi, r14d
mov r11d, dword [rbp - 0x1d]
add ebx, 0x3db
mov r10d, dword [rbp - 0x21]
sub r11d, 0x160
mov r9d, dword [rbp - 9]
add r10d, r15d
mov dword [r13 + 0x34c], eax
add r9d, 0x9c7
mov eax, 0x81d
add ecx, eax
add edx, eax
mov eax, dword [rbp - 0x1d]
sub eax, 0x737
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], r9d
mov dword [rsp + 0x40], r10d
mov r9, r13
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
call sym.uomm805zl62.dll_XqRsY25v
mov dword [rbp + 0x7f], eax
mov eax, 0x3182
mov ecx, dword [rbp + 0x67]
mov edx, dword [rbp - 0x19]
add ecx, 0x2f79
mov r8d, dword [rbp + 0x77]
add edx, r15d
mov r9d, dword [rbp + 0x77]
add r8d, 0x37b1
mov r13d, dword [rbp - 0x29]
add r9d, eax
mov r12d, dword [rbp - 0x21]
add r13d, r14d
mov r15d, dword [rbp + 0x6f]
add r12d, 0x2b
mov r14d, dword [rbp - 0x19]
sub r15d, 0x293
mov esi, dword [rbp - 0x11]
sub r14d, 0x287
mov edi, dword [rbp - 0x15]
sub esi, 0x49c
mov ebx, dword [rbp + 0x77]
add edi, 0x32ec
mov r11d, dword [rbp - 0xd]
add ebx, 0x3c12
mov r10d, dword [rbp - 0x29]
add r11d, 0x75e
add r10d, eax
mov eax, dword [rbp - 0x29]
add eax, 0x33a3
mov dword [rsp + 0x70], eax
mov rax, qword [rbp + 7]
mov dword [rsp + 0x68], r10d
mov dword [rsp + 0x60], r11d
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r13d
call fcn.1800178a8
mov r13, qword [rbp + 7]
mov dword [rbp + 0x77], eax
mov ecx, dword [rbp + 0x6f]
mov r8d, dword [rbp - 9]
sub ecx, 0x289
mov r9d, dword [rbp - 0x29]
add r8d, 0x53f
mov edi, dword [rbp - 0x1d]
add r9d, 0x3523
mov ebx, dword [rbp + 0x67]
sub edi, 0x5fe
mov r11d, dword [rbp - 0x25]
add ebx, 0x3182
mov r10d, dword [rbp - 1]
add r11d, 0x5f7
mov edx, dword [rbp - 0x25]
add r10d, 0x3523
mov eax, dword [rbp + 0x67]
add edx, 0x4c5
add eax, 0x30f3
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], edx
mov rdx, r13
mov dword [rsp + 0x38], r10d
mov dword [rsp + 0x30], r11d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], edi
call fcn.180014334
mov dword [rbp - 0x29], eax
mov ecx, dword [rbp + 0x6f]
mov eax, dword [rbp - 0x19]
add ecx, 0x375
cmp eax, ecx
jg 0x180002fb8
mov ecx, dword [rbp + 3]
mov eax, dword [rbp - 0xd]
add ecx, 0xfffffa56
cmp eax, ecx
je 0x18000302c
mov ecx, dword [rbp - 0x25]
mov edx, dword [rbp + 0x77]
sub ecx, 0x1f9
mov r8d, dword [rbp + 0x77]
add edx, 0xda
mov r9d, dword [rbp + 0x7f]
add r8d, 0x6b1
mov r13d, dword [rbp + 0x7f]
sub r9d, 0x373
mov r12d, dword [rbp - 0x25]
add r13d, 0x946
mov r15d, dword [rbp - 0x25]
sub r12d, 0x16a
mov r14d, dword [rbp - 5]
sub r15d, 0x299
mov esi, dword [rbp - 0x15]
add r14d, 0x416
mov edi, dword [rbp - 0x1d]
add esi, 0x2f79
mov ebx, dword [rbp - 0x11]
add edi, 0x2e1
mov r11d, dword [rbp - 0x1d]
sub ebx, 0x322
mov r10d, dword [rbp + 0x67]
sub r11d, 0x135
mov eax, dword [rbp - 5]
add r10d, 0x38e3
add eax, 0x3b0
mov dword [rsp + 0x70], eax
mov rax, qword [rbp + 7]
mov dword [rsp + 0x68], r10d
mov dword [rsp + 0x60], r11d
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r13d
call fcn.180002590
mov dword [rbp + 0x67], eax
jmp 0x18000302c
mov ecx, dword [r13 + 0x58]
movsxd rbx, dword [r13 + 0x250]
and ecx, 0x3c32
cmp rbx, rcx
jb 0x18000302c
mov esi, 0x324b
mov edi, dword [rbp + 0x7f]
jmp 0x18000300f
imul rax, qword [r13 + 0x510], 0x3415
xor rax, qword [r13 + 0x30]
sub qword [r13 + 0x210], rax
imul rax, qword [r13 + 0x118], 0x3415
or rax, 0x33a3
mov qword [r13 + 0x340], rax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
add edi, 2
mov eax, dword [rbp - 0xd]
and eax, esi
cmp edi, eax
jl 0x180002fd8
mov ecx, dword [r13 + 0x58]
inc ebx
and ecx, 0x3c32
movsxd rax, ebx
cmp rax, rcx
jae 0x180002fd3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]