Function at 0x180003298
Capabilities:
Accept command line arguments
Authenticate hmac
Check os version
Encode data using base64
Encrypt data using speck
Parse credit card information
Parse pe header
Terminate process
Write file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x88
mov eax, dword [rsp + 0xc8]
mov r11d, r8d
mov qword [rsp + 0x70], rax
mov edi, 0x23
mov rcx, qword [str.m2e]
xor edx, edx
mov rax, rcx
div rcx
mov rcx, rdx
and ecx, 0x2c0
xor rcx, 0x1f2
lea rbp, [rcx + 0x1437c]
mov qword [rsp + 0x58], rbp
cmp rcx, 1
jae 0x1800032ff
and rcx, 0xffffffffffffff48
jmp 0x180003316
mov eax, dword [rsp + 0x44]
cmp rcx, 0x1f2
mov edx, 0x5bd1e995
cmove eax, edx
mov dword [rsp + 0x44], eax
cmp rcx, 0x64
jne 0x180003335
mov edx, ecx
mov r8d, ebp
mov rcx, rbp
call fcn.180003298
mov ebp, eax
mov qword [rsp + 0x58], rbp
jmp 0x180003438
cmp rcx, 0x2a
jb 0x180004dca
cmp rcx, 0x50
jne 0x180003358
mov edx, ecx
mov rcx, rbp
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapSize]
jmp 0x180003438
cmp rcx, 0x1f
jae 0x180003379
mov r8, rcx
mov qword [rsp + 0x20], rbp
mov rdx, rcx
mov r9, rbp
mov rcx, rbp
call fcn.180004de0
jmp 0x180003438
cmp rcx, 0x31
je 0x1800032c5
cmp rcx, 0xd
je 0x180004dca
cmp rcx, 0xc
ja 0x1800033a6
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov r11d, dword [rsp + 0xc0]
jmp 0x1800032c5
cmp rcx, rdi
jae 0x1800033bf
mov rbp, rcx
xor rbp, 0x293
mov qword [rsp + 0x58], rbp
jmp 0x180003440
cmp rcx, 0x35
jae 0x1800033f3
movabs rax, 0x51d07eae2f8151d1
mul rcx
mov eax, 0x27b
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 9
sub rax, rcx
xor rax, rbp
mov qword [0x18002e018], rax
jmp 0x180003440
cmp rcx, 0x3e
je 0x1800032c5
cmp rcx, 0x1f2
jne 0x180003420
imul rax, rbp, 0x919b
xor edx, edx
div rbp
lea r8d, [rax - 0x9183]
mov qword [rsp + 0x70], r8
jmp 0x180003440
cmp rcx, 0x10
ja 0x180003440
mov edx, ecx
mov rcx, rbp
call fcn.180006240
mov rbp, rax
mov qword [rsp + 0x58], rax
mov r11d, dword [rsp + 0xc0]
xor edx, edx
mov eax, 0x3a4
div rbp
mov qword [rsp + 0x60], rax
mov rbx, rax
cmp rax, rdi
ja 0x180004dca
cmp rax, 0x4c
jae 0x180004dcc
cmp rax, 0x27
jne 0x180003478
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov ebp, eax
jmp 0x18000352a
cmp rbx, 0x28
jbe 0x180003494
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov rbx, rax
mov qword [rsp + 0x60], rax
jmp 0x18000352f
cmp rbx, 0x3b
ja 0x1800032c5
cmp rbx, 7
jae 0x180004dca
cmp rbx, 0x14
jbe 0x1800034b7
add rbp, 0x20c
jmp 0x18000352a
cmp rbx, 0x60
ja 0x180004dca
cmp rbx, 0x36
ja 0x18000352f
test rbx, rbx
jne 0x1800034e3
mov r8d, dword [rsp + 0xb8]
mov esi, r8d
xor esi, r11d
mov dword [rsp + 0xc8], esi
jmp 0x18000353e
cmp rbx, 0x1b
jne 0x1800034fc
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rbx, eax
mov qword [rsp + 0x60], rbx
jmp 0x18000352f
cmp rbx, 8
je 0x1800032c5
cmp rbx, 5
jbe 0x18000352f
movabs rax, 0xf7c5ed9c4f5d661d
mov rbp, rbx
mul rbx
shr rdx, 9
imul rax, rdx, 0x211
sub rbp, rax
mov qword [rsp + 0x58], rbp
mov esi, dword [rsp + 0xc8]
mov r8d, dword [rsp + 0xb8]
movabs rax, 0x642c8590b21642c9
mov rdi, rbp
mul rbp
sub rdi, rdx
shr rdi, 1
add rdi, rdx
shr rdi, 8
mov qword [rsp + 0x68], rdi
cmp r8d, 4
jae 0x180003c28
mov rcx, rbp
mov eax, r8d
or rcx, 0x2aae9
sub rcx, 0x3efed
cmp rax, rcx
ja 0x180003bbd
imul rcx, rbx, 0xffffffffffffffc3
mov eax, r8d
and ecx, 0x51
inc rcx
cmp rax, rcx
jbe 0x1800035b5
mov r9d, 0x16
movabs rsi, 0x446f86562d9faee5
jmp 0x18000397c
mov esi, dword [rsp + 0xc8]
mov eax, r8d
cmp rax, rbx
ja 0x1800036ff
cmp rbx, 0x3b
je 0x180003bb5
cmp rbx, 0x47
ja 0x1800036ff
cmp rbx, 0x58
jne 0x1800035ea
mov r8d, ebx
mov edx, edi
mov rcx, rbp
call fcn.180003298
jmp 0x180003607
cmp rbx, 0x5a
jae 0x1800036ff
test rbx, rbx
jne 0x180003607
mov eax, esi
shr eax, 0xd
xor esi, eax
mov dword [rsp + 0xc8], esi
xor edx, edx
mov ecx, edi
mov eax, 0xb3
div rcx
mov rbp, rax
lea rax, [rbx - 0x281]
and rbp, rax
mov qword [rsp + 0x58], rbp
jne 0x180003699
mov r11d, dword [rsp + 0xc0]
mov eax, 0x53
cmp rbx, rax
jae 0x1800032c0
cmp rbx, 0x35
jae 0x1800032c0
test rbx, rbx
je 0x180004cc3
cmp rbx, 6
jb 0x180003674
mov edx, ecx
mov qword [rsp + 0x20], rbx
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
call fcn.180004de0
mov qword [rsp + 0x60], rax
jmp 0x1800036ff
cmp rbx, 0x1a
ja 0x180003c28
cmp rbx, 0x46
jbe 0x180003a1d
xor edx, edx
call fcn.180006240
mov rbp, rax
mov qword [rsp + 0x58], rax
jmp 0x1800036ff
cmp rbp, 9
ja 0x180003b3d
cmp rbp, 0x43
ja 0x180003b2f
mov eax, 0x4a
cmp rbp, rax
ja 0x180003b18
cmp rbp, 0x60
ja 0x180003b03
cmp rbp, 7
ja 0x1800038fe
cmp rbp, 0xe
ja 0x180003ae9
cmp rbp, 0x3a
ja 0x180003add
cmp rbp, 0x34
jbe 0x180003a57
xor edx, edx
mov eax, 0x14f
div rbx
mov rbp, rdx
mov qword [rsp + 0x58], rdx
mov rbx, qword [0x18002e010]
xor edx, edx
imul rax, rbx, 0x298
mov esi, 9
sub rsi, rax
mov eax, 0x1ba
div rbx
mov rdi, rax
add di, bx
cmp rbx, 0x44
jb 0x180003809
cmp rbx, 5
jb 0x1800037f0
cmp rbx, 0x3a
jb 0x180003809
cmp rbx, 0x27
je 0x180004be4
cmp rbx, 0x5a
jbe 0x180004d8a
cmp rbx, 0x1b
jbe 0x1800037d4
movabs rax, 0x2ebc7484d16e49c3
cmp rbx, rax
jne 0x180003783
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax]
xor dword [rsp + 0xc8], eax
jmp 0x180003809
cmp rbx, 0x29
jae 0x18000379f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movzx edi, ax
mov ecx, 0x336
imul edi, ecx
jmp 0x180003809
cmp rbx, 0x3c
jae 0x1800037ae
lea rbx, [rsi + 0x29a]
jmp 0x180003809
cmp rbx, 0x5f
jne 0x1800037c6
movzx edx, di
mov rcx, rsi
mov r8d, edx
call fcn.180003298
mov ebx, eax
jmp 0x180003809
cmp rbx, 0x32
jne 0x180003809
movzx eax, di
jmp 0x180004dcc
movzx r9d, di
mov r8, rbx
mov rdx, rsi
mov qword [rsp + 0x20], rbx
mov rcx, rsi
call fcn.180004de0
movzx edi, ax
jmp 0x180003809
mov r9, rbx
mov qword [rsp + 0x20], rsi
mov r8, rbx
mov rdx, rbx
mov rcx, rsi
call fcn.180004de0
mov rsi, rax
mov eax, 0x2c
cmp di, ax
je 0x180004503
mov eax, 0x14
cmp di, ax
jae 0x180003835
movzx edx, di
mov r8, rsi
movzx ecx, di
call qword [sym.imp.KERNEL32.dll_HeapSize]
jmp 0x1800038b8
mov r9d, 0x16
cmp di, r9w
jne 0x180003859
xor edx, edx
mov rax, rsi
div rbx
or rdx, 0xb6
mov qword [str.m2e], rdx
jmp 0x1800038b8
mov eax, 0x23
cmp di, ax
jbe 0x180004bf8
mov r11d, dword [rsp + 0xc0]
mov eax, 0x4c
cmp di, ax
je 0x1800032c0
mov eax, 0x4a
cmp di, ax
jb 0x18000391c
mov eax, 0x3f
cmp di, ax
jae 0x1800038a0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EncodePointer]
jmp 0x1800038b8
mov eax, 0x53
cmp di, ax
jne 0x1800038ce
imul rax, rbx, 0x14406
mov qword [0x18002e018], rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov esi, dword [rsp + 0xc8]
jmp 0x1800035c1
mov rbx, qword [rsp + 0x60]
mov eax, 0x49c3
mov esi, dword [rsp + 0xc8]
cmp di, ax
mov rdi, qword [rsp + 0x68]
jne 0x1800035c1
imul esi, dword [rsp + 0x44]
mov dword [rsp + 0xc8], esi
jmp 0x1800035c1
mov edx, ebp
mov rcx, rbp
call fcn.180006240
mov r8d, dword [rsp + 0xb8]
mov edi, eax
mov qword [rsp + 0x68], rdi
jmp 0x180003599
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov r8d, dword [rsp + 0xb8]
jmp 0x18000359f
cmp r10, 1
jb 0x180004d17
mov r11d, dword [rsp + 0xc0]
cmp r10, 0x27
jb 0x1800032c0
movabs rcx, 0x4bd98416163ab4e0
cmp r10, rcx
je 0x1800039f9
cmp r10, 0x3a
jb 0x180003bf4
cmp r10, 0x5b
jbe 0x180004d0b
cmp r10, 0x38
jae 0x1800039c4
mov r10, qword [section..data]
xor edx, edx
mov eax, 0x395
div r10
mov rax, rsi
mov rcx, rdx
mul rdx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x194
sub rcx, rax
mov al, r10b
sub al, cl
cmp r10, 0x34
jae 0x180003933
jmp 0x1800035ae
mov esi, dword [rsp + 0xc8]
cmp r10, r9
jb 0x1800035b5
cmp r10, 0x39
jae 0x1800035b5
movzx ecx, al
mov r8d, r10d
mov edx, ecx
call qword [sym.imp.SHELL32.dll_ExtractIconA]
mov r8d, dword [rsp + 0xb8]
jmp 0x1800035b5
mov esi, dword [rsp + 0xc8]
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 1]
shl eax, 8
xor esi, eax
mov dword [rsp + 0xc8], esi
jmp 0x1800035b5
cmp rbx, 0x5b
jb 0x180003a30
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180003b3d
cmp rbx, 0x25
je 0x180004cad
cmp rbx, 4
je 0x180004ca6
cmp rbx, 0x26
jne 0x180003b3d
mov eax, edi
mov ebp, 0x22a
jmp 0x180003a81
cmp rbp, 0x18
jbe 0x180003a86
mov ecx, edi
mov edx, ebx
call fcn.180006240
mov rbp, rax
movabs rax, 0x4a6360c344de0095
mul rbp
shr rdx, 8
imul rax, rdx, 0x371
sub rbp, rax
jmp 0x180003aab
cmp rbp, 0x39
jb 0x180003a99
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
jmp 0x180003b3d
cmp rbp, 0x50
jbe 0x180003ab5
mov ebp, edi
or rbp, rbx
or rbp, 0x1a5
mov qword [rsp + 0x58], rbp
jmp 0x180003b3d
cmp rbp, 0x5b
ja 0x180003bb5
cmp rbp, 0x38
je 0x180004d01
cmp rbp, 4
jne 0x180003b3d
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x180003b3d
mov ecx, edi
mov edx, edi
call qword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x180003b3d
xor edx, edx
mov ecx, edi
mov eax, 0x11e
div rcx
imul rbx, rdx, 0x3d3
mov qword [rsp + 0x60], rbx
jmp 0x180003b3d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov edi, eax
mov qword [rsp + 0x68], rdi
jmp 0x180003bb5
mov ecx, edi
mov r9, rbx
mov r8, rbp
mov qword [rsp + 0x20], rbp
mov rdx, rbx
call fcn.180004de0
jmp 0x180003b35
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x58], rax
mov rbp, rax
mov edi, 0x3af
mov qword [rsp + 0x68], rdi
cmp rbx, 0x43
jae 0x180004d73
cmp rbx, 0x48
ja 0x180004d68
cmp rbx, 0x1a
je 0x180004dca
cmp rbx, 0x51
ja 0x180004dca
cmp rbx, 0xf
je 0x180004d40
cmp rbx, 0x2e
jae 0x180004d2f
mov r11d, dword [rsp + 0xc0]
cmp rbx, 0x5c
je 0x1800032c0
cmp rbx, 0x16
ja 0x180004cb9
cmp rbx, 0xb
jae 0x180003bb5
cmp rbx, 6
jae 0x180004dca
cmp rbx, 0x15
jne 0x180003c10
mov r8d, dword [rsp + 0xb8]
mov rax, qword [0x18002e018]
movabs rcx, 0xd7b12905d9881f02
cmp rax, rcx
jne 0x180003587
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 2]
shl eax, 0x10
xor esi, eax
mov dword [rsp + 0xc8], esi
jmp 0x180003587
mov eax, 0x3b7
mov qword [rsp + 0x20], r10
mov r9d, eax
mov r8d, eax
mov ecx, eax
mov rdx, r10
call fcn.180004de0
jmp 0x180003c28
cmp rbx, 0x38
ja 0x180003c28
cmp rbx, 0x4f
jb 0x180004d21
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8d, 0x4c
mov rcx, qword [str.m2e]
xor edx, edx
mov rdi, qword [rsp + 0xb0]
and rcx, 0xfffffffffffffcc2
xor rcx, 0x2e3
mov rax, rcx
div rcx
imul rbx, rdx, 0x3a2
test rbx, rbx
jne 0x180003c68
movzx esi, byte [rdi]
mov dword [rsp + 0x40], esi
jmp 0x180003c6c
mov esi, dword [rsp + 0x40]
cmp rbx, 0x61
jne 0x180003c83
mov edx, ebx
mov ecx, edx
call fcn.180006240
mov rbx, rax
jmp 0x180003d10
cmp rbx, 0x64
jbe 0x180003c9a
mov r8d, ebx
mov edx, ebx
mov rcx, rbx
call fcn.180003298
mov ebx, eax
jmp 0x180003d10
cmp rbx, 0x18
je 0x180003c2e
test rbx, rbx
jne 0x180003cb4
movzx eax, byte [rdi + 1]
shl eax, 8
or esi, eax
mov dword [rsp + 0x40], esi
jmp 0x180003d10
cmp rbx, 0x3d
ja 0x180004503
cmp rbx, 0x1d
jbe 0x180003ccf
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
jmp 0x180003c28
cmp rbx, 0x10
je 0x180003d10
cmp rbx, r8
jae 0x180004503
cmp rbx, 0x39
je 0x180003d10
cmp rbx, 0x51
je 0x180003d10
mov r11d, dword [rsp + 0xc0]
cmp rbx, 0x3d
je 0x1800032c0
cmp rbx, 0x5b
ja 0x180003c2e
cmp rbx, 0x56
ja 0x180004503
mov ebp, ebx
or ebp, 0x366
test rbx, rbx
jne 0x180003d6c
movzx eax, byte [rdi + 2]
shl eax, 0x10
or esi, eax
mov dword [rsp + 0x40], esi
mov r8d, 0x4c
xor edx, edx
mov ecx, ebp
mov eax, 0x2a3
div rcx
mov rdi, rax
xor rdi, 0x1c9
cmp ebp, 0x51
jne 0x180003e83
mov edx, ebp
mov qword [rsp + 0x20], rbx
mov r8d, edx
mov r9, rbx
mov rcx, rdi
call fcn.180004de0
mov rbx, rax
jmp 0x180003ff8
cmp rbx, 0x50
je 0x180004dc3
cmp rbx, 0x11
ja 0x180003d2a
mov r8d, 0x4c
cmp rbx, 0x3b
ja 0x180003c2e
cmp rbx, 0x47
ja 0x180004c0f
cmp rbx, 0xe
jae 0x180004503
cmp rbx, 0x31
jbe 0x180003dc4
mov r9d, ebp
mov r8, rbx
mov rdx, rbx
mov qword [rsp + 0x20], r9
mov rcx, rbx
call fcn.180004de0
mov rbp, rax
jmp 0x180003d2a
cmp rbx, 0x45
jae 0x180003d30
mov eax, 0x4a
cmp rbx, rax
jbe 0x180003de3
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x180003c28
cmp rbx, 0x5e
jbe 0x180003e06
mov r9d, ebp
mov r8, rbx
mov edx, ebp
mov qword [rsp + 0x20], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_HeapQueryInformation]
mov ebp, eax
jmp 0x180003d2a
cmp rbx, 5
jne 0x180003e1c
mov qword [str.m2e], 0x2eb
jmp 0x180003d30
cmp rbx, 0xc
jne 0x180003e3f
mov ecx, ebp
mov edx, ebx
mov r9d, ebp
mov r8d, ebp
mov qword [rsp + 0x20], rcx
call qword [sym.imp.KERNEL32.dll_HeapQueryInformation]
movsxd rbx, eax
jmp 0x180003d2a
cmp rbx, 3
ja 0x180004503
cmp rbx, r8
jbe 0x180003e6c
mov r9d, ebp
mov r8, rbx
mov rdx, rbx
mov qword [rsp + 0x20], r9
mov rcx, rbx
call fcn.180004de0
mov rbx, rax
jmp 0x180003d2a
mov r11d, dword [rsp + 0xc0]
cmp rbx, 0x10
je 0x1800032c0
jmp 0x180003d30
cmp ebp, 0xa
je 0x180004dbc
cmp ebp, 0x10
jne 0x180003ea3
mov r8d, ebp
mov edx, edi
mov rcx, rbx
call fcn.180003298
jmp 0x180003fbb
cmp ebp, 0x366
jne 0x180003f60
cmp rbx, 0x20
jbe 0x180003ec2
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_InitializeSListHead]
jmp 0x180003ff8
cmp rbx, 0x4d
ja 0x180003ff8
mov eax, 0x2c
cmp rbx, rax
jbe 0x180003ef0
mov qword [rsp + 0x20], 0x366
mov r9, rdi
mov r8, rdi
mov rdx, rdi
mov rcx, rbx
jmp 0x180003c09
cmp rbx, 0x5e
jae 0x1800041e5
cmp rbx, 0x39
jbe 0x180003f14
mov rdx, rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
movsxd rdi, eax
jmp 0x180003ff8
cmp rbx, 0xa
ja 0x180004cdf
test rbx, rbx
jne 0x180003f3d
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 3]
shl eax, 0x18
or esi, eax
mov dword [rsp + 0x40], esi
jmp 0x180003ff8
cmp rbx, 0x12
je 0x180004d8e
mov eax, 0x16
cmp rbx, rax
jb 0x180003ff8
call qword [sym.imp.KERNEL32.dll_GetVersion]
jmp 0x180003c28
cmp ebp, 0x20
ja 0x180003f7a
mov r9, rdi
mov qword [rsp + 0x20], rcx
mov r8, rbx
mov rdx, rbx
call fcn.180004de0
jmp 0x180003fbb
cmp ebp, 0x36
jb 0x180003ff8
cmp ebp, 0x55
jb 0x180003c2e
cmp ebp, 0x62
jbe 0x180004cdf
mov r10d, 0x5f
cmp ebp, r10d
jne 0x180003fbf
mov qword [rsp + 0x30], r10
mov r9d, r10d
mov dword [rsp + 0x28], edi
mov r8d, edi
mov edx, edi
mov dword [rsp + 0x20], r10d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
jmp 0x180003ff8
cmp ebp, 0xf
jae 0x180003fe0
mov qword [rsp + 0x20], rcx
mov r9, rdi
mov rcx, rdi
mov r8d, ebx
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x180003c28
cmp ebp, 0x3c
jae 0x180003fef
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov ebx, eax
jmp 0x180003ff8
cmp ebp, 0x58
jbe 0x180004dca
xor edx, edx
mov eax, ebp
div rdi
mov esi, ebp
mov r8, rdx
or r8d, 0x2a6
mov qword [rsp + 0x50], r8
cmp ebp, 0x5e
jbe 0x180004cdf
cmp ebp, 0x55
ja 0x18000403a
mov edx, edi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_HeapSize]
mov rbx, rax
xor edx, edx
mov eax, 0x11452
div rsi
mov ebp, edx
jmp 0x180004054
cmp ebp, 0x3e
jbe 0x180003c28
cmp ebp, 0x3d
jae 0x18000405b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov rdi, rax
mov r8, qword [rsp + 0x50]
jmp 0x1800040d3
mov r11d, dword [rsp + 0xc0]
jbe 0x1800032c0
cmp ebp, 0x40
jae 0x180004075
mov ecx, ebp
jmp 0x180003c22
cmp ebp, 0x5b
jb 0x180004dca
cmp ebp, 0x18
jne 0x180004095
mov r8d, ebx
mov edx, ebx
mov rcx, rdi
call fcn.180003298
mov r8d, eax
jmp 0x1800040b7
cmp ebp, 0x49
jae 0x1800040be
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_InitializeSListHead]
mov r8d, edi
and r8d, ebx
and r8d, 0x26a
or r8d, 0x181
mov qword [rsp + 0x50], r8
jmp 0x1800040d3
cmp ebp, 0x366
jne 0x1800040d3
mov eax, dword [rsp + 0x40]
imul eax, dword [rsp + 0x44]
mov dword [rsp + 0x40], eax
mov ecx, ebp
xor edx, edx
mov eax, r8d
div rcx
mov esi, r8d
mov rcx, rdx
or rcx, 0x258
mov qword [rsp + 0x48], rcx
cmp ebp, 0x2a
jne 0x180004104
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x48]
jmp 0x180004212
cmp ebp, 0x38
jne 0x180004111
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1800040fa
cmp ebp, 0x47
jb 0x180004cdf
cmp ebp, 0x366
jne 0x1800041ef
mov r11d, dword [rsp + 0xc0]
cmp rbx, 0x50
jae 0x1800032c0
cmp rbx, 0x36
jae 0x180004d95
test rbx, rbx
jne 0x180004163
mov edx, dword [rsp + 0x40]
mov eax, edx
mov ecx, dword [rsp + 0x70]
shr eax, cl
mov rcx, qword [rsp + 0x48]
xor edx, eax
mov dword [rsp + 0x40], edx
jmp 0x180004216
cmp rbx, 7
ja 0x1800041e5
cmp rbx, 0x3b
je 0x180004c20
mov r8d, 0x4c
cmp rbx, 0x58
jae 0x180003c2e
cmp rbx, 0x51
ja 0x180003c2e
cmp rbx, 0x54
jbe 0x1800041a0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebp, eax
jmp 0x1800040fa
cmp rbx, 0x15
jae 0x180004cdf
mov eax, 0x4a
cmp rbx, rax
ja 0x180004cdf
cmp rbx, 0xc
jb 0x1800041df
mov r8, rcx
mov qword [rsp + 0x20], 0x366
mov rcx, rdi
mov r9, rdi
mov edx, 0x366
call fcn.180004de0
jmp 0x1800040fa
cmp rbx, 0x11
jne 0x180004212
mov eax, 0x366
jmp 0x180004dcc
cmp ebp, 0x55
jne 0x180004212
mov r9, rcx
mov qword [rsp + 0x20], rsi
mov rcx, rbx
mov r8d, ebp
mov rdx, rbx
call fcn.180004de0
mov rcx, rax
mov qword [rsp + 0x48], rax
mov edx, dword [rsp + 0x40]
mov edi, 0x273
mov eax, ebp
sub rdi, rbx
xor rdi, rax
xor rdi, 0x3cc
cmp ebp, 0x2b
ja 0x180004242
lea ebp, [rdi + rdi*4]
mov r10d, 0x3f
shl ebp, 7
and ebp, edi
jmp 0x1800042ea
cmp ebp, 0x39
jae 0x18000426d
mov r9, rdi
mov qword [rsp + 0x20], rbx
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call fcn.180004de0
mov qword [rsp + 0x50], rax
mov r10d, 0x3f
jmp 0x1800042ef
cmp ebp, 0x3a
jbe 0x180004cdf
mov r10d, 0x3f
lea r8d, [r10 + 0xd]
cmp ebp, r10d
je 0x180003c2e
mov r11d, dword [rsp + 0xc0]
cmp ebp, 0x25
jb 0x1800032c0
lea eax, [r10 + 0x14]
cmp ebp, eax
jne 0x1800042b3
call qword [sym.imp.KERNEL32.dll_GetConsoleCP]
mov esi, eax
mov rdi, 0xfffffffffffffeaa
jmp 0x1800042cf
cmp ebp, 0x28
jne 0x1800042dc
mov edx, ecx
mov rcx, rdi
call fcn.180006240
mov rsi, rax
lea rdi, [rax - 0xd4]
and rdi, rax
mov rax, qword [rsp + 0x50]
mov r10d, 0x3f
jmp 0x1800042f4
cmp ebp, 0x366
jne 0x1800042ea
xor edx, ebx
mov dword [rsp + 0x40], edx
mov rax, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
add rdi, 0x3d4
xor rdi, rbx
cmp ebp, 0x1e
jae 0x180004318
mov rbx, rsi
and ebx, 0x81
or rbx, 0x34a
jmp 0x180004544
mov r8d, 0x4c
jbe 0x180003c2e
mov r11d, dword [rsp + 0xc0]
cmp ebp, 0x30
jb 0x1800032c0
cmp ebp, 0x366
jne 0x18000453b
lea r9d, [rbp + 0x59]
cmp eax, r9d
jne 0x18000450a
test rbx, rbx
jne 0x180004402
lea r10d, [r8 - 0x38]
cmp rsi, r10
jb 0x180004c30
cmp rsi, 0x13
je 0x180003c2e
cmp rsi, 0x50
jae 0x180004389
mov r8d, ebp
mov edx, r9d
mov ecx, r8d
call fcn.180003298
mov ebx, eax
jmp 0x180004544
mov eax, 0x46
cmp rsi, rax
jne 0x1800043a5
mov r8d, eax
xor edx, edx
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x180003c28
cmp rsi, 0x27
jae 0x1800043c5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov rbx, rsi
mov rdi, rax
and ebx, 0x14d
jmp 0x180004544
cmp rsi, 0x3a
je 0x1800041e5
mov r11d, dword [rsp + 0xc0]
cmp rsi, 0x61
jbe 0x1800032c0
mov ecx, dword [rsp + 0x44]
cmp rsi, 0x259
jne 0x18000454e
mov eax, dword [rsp + 0x40]
imul eax, ecx
mov dword [rsp + 0x40], eax
jmp 0x18000454e
cmp rbx, 1
jne 0x180004414
imul rdi, rdi, 0x3cd
jmp 0x180004544
mov r11d, dword [rsp + 0xc0]
cmp rbx, 0x59
ja 0x1800032c0
cmp rbx, 0x37
ja 0x180004c3e
cmp rbx, 0x58
jae 0x180004503
cmp rbx, 0x2a
ja 0x180004cdf
cmp rbx, 0x43
jb 0x180004458
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_InitializeSListHead]
jmp 0x180004544
mov r11d, dword [rsp + 0xc0]
cmp rbx, 0x1c
ja 0x1800032c0
cmp rbx, 0x18
jbe 0x1800044a2
movabs rax, 0x83c977ab2bedd28f
mov rcx, rdi
mul rbx
mov rax, rbx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 9
imul rax, rax, 0x2a4
sub rcx, rax
add rbx, rcx
jmp 0x180004544
cmp rbx, 0x3c
jne 0x1800044b9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [rbx + 0x50]
jmp 0x180004544
cmp rbx, 1
jbe 0x1800044c9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
jmp 0x180004544
cmp rbx, 0x64
ja 0x180004d9a
cmp rbx, 0x44
jbe 0x1800044e7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
jmp 0x180003c28
cmp rbx, 6
jb 0x1800044fd
imul rax, rdi, 0x271
mov qword [section..data], rax
jmp 0x180004544
cmp rbx, 0xf
jbe 0x180004544
mov eax, ebx
jmp 0x180004dcc
mov r11d, dword [rsp + 0xc0]
cmp eax, 0xe
jb 0x1800032c0
cmp eax, 0x58
ja 0x180004544
mov r9d, eax
mov r8, rsi
mov rdx, rdi
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call fcn.180004de0
mov rdi, rax
jmp 0x180004544
cmp ebp, r10d
jb 0x180003c2e
mov ecx, dword [rsp + 0x44]
mov r10d, 0x14
mov r11d, dword [rsp + 0xc0]
mov rax, rbx
or rax, 1
mov r8d, 0x4c
or rsi, rax
mov qword [rsp + 0x48], rsi
cmp rsi, r8
jb 0x1800032c0
cmp rsi, 0x259
jne 0x180004654
test rbx, rbx
jne 0x18000459c
mov eax, dword [rsp + 0xc8]
imul eax, ecx
mov dword [rsp + 0xc8], eax
jmp 0x18000474f
cmp rbx, 0x18
ja 0x180004503
cmp rbx, 4
jne 0x1800045bf
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebp, eax
mov r8d, 0x4c
jmp 0x18000474f
cmp rbx, 0x28
je 0x180003c2e
mov eax, 0x2c
cmp rbx, rax
jbe 0x1800045e4
lea rcx, [rdi + 0x2c82]
mov qword [rsp + 0x48], rcx
jmp 0x180004754
cmp rbx, 4
jae 0x180004da6
cmp rbx, 8
ja 0x180004da6
cmp rbx, 0x61
ja 0x18000474f
cmp rbx, 0x64
je 0x180003c2e
cmp rbx, 0x20
jbe 0x180004623
mov eax, ebp
and eax, 0x1a6
or eax, 0x259
jmp 0x1800046c0
cmp rbx, 0x52
ja 0x180004d9f
cmp rbx, 0x44
jbe 0x18000474f
mov edx, dword [rsp + 0x50]
mov r9d, 0x259
mov ecx, ebp
mov qword [rsp + 0x20], 0x259
mov r8d, ebp
jmp 0x180004c81
mov r11d, dword [rsp + 0xc0]
cmp rsi, 1
jb 0x1800032c0
cmp rsi, 0x15
jne 0x18000468b
mov r8d, dword [rsp + 0x50]
mov edx, esi
mov rcx, rbx
call fcn.180003298
mov ecx, eax
lea r8d, [rsi + 0x37]
mov qword [rsp + 0x48], rcx
jmp 0x180004754
mov r11d, dword [rsp + 0xc0]
cmp rsi, 0x58
jb 0x1800032c0
cmp rsi, 0x18
je 0x180004dca
cmp rsi, 0x64
jne 0x1800046ca
movabs rax, 0x4e04e04e04e04e05
mul rdi
shr rdx, 8
mov eax, edx
mov rcx, qword [rsp + 0x48]
jmp 0x180004759
mov r11d, dword [rsp + 0xc0]
cmp rsi, 0x52
jb 0x1800032c0
mov r9d, 0x57
cmp rsi, r9
jne 0x180004708
mov r8d, r9d
mov edx, r9d
mov ecx, r9d
call qword [sym.imp.KERNEL32.dll_HeapSize]
mov ebp, ebx
mov rdi, rax
xor ebp, 0xcb
or ebp, ebx
jmp 0x1800045b4
cmp rsi, 0x60
ja 0x180004722
mov edx, dword [rsp + 0x50]
mov ecx, ebp
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x1800045b4
cmp rsi, 0x30
jb 0x180003c2e
cmp rsi, r10
je 0x180004cdf
cmp rsi, 0x1f
jb 0x18000474f
cmp rsi, 0xb
jbe 0x180004cdf
cmp rsi, 0x2e
je 0x180004c54
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x50]
mov esi, ebp
and esi, 0x2eb
mov r9d, ebp
cmp ebp, 0x366
jne 0x180004911
cmp rdi, 6
jb 0x180004c6d
mov r11d, dword [rsp + 0xc0]
cmp rdi, 0x24
jbe 0x1800032c0
cmp rdi, 0x2f
jae 0x1800047c5
mov r9, qword [rsp + 0x48]
movabs rax, 0x1ecf43c7fb84c2f1
mul r9
mov rax, r9
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c9
sub r9, rax
mov qword [rsp + 0x48], r9
jmp 0x1800047f5
cmp rdi, 0x60
je 0x180004db0
cmp rdi, 0x61
jne 0x18000482d
mov edx, 0x366
mov eax, eax
mov r9d, edx
mov qword [rsp + 0x20], rax
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapQueryInformation]
movsxd rdi, eax
mov r9, qword [rsp + 0x48]
mov ecx, dword [rsp + 0xc8]
mov ebx, ebp
and ebx, 0x386
cmp ebp, 0x366
jne 0x1800049b1
cmp r9, 0x259
jne 0x180004988
xor ecx, dword [rsp + 0x40]
mov dword [rsp + 0xc8], ecx
jmp 0x180004a9a
mov r11d, dword [rsp + 0xc0]
cmp rdi, 0x27
jb 0x1800032c0
cmp rdi, 0x49
je 0x180003c2e
cmp rdi, 0x40
jne 0x180004861
mov edx, ecx
mov r8, rsi
mov ecx, 0x366
call qword [sym.imp.KERNEL32.dll_HeapSize]
jmp 0x1800047f0
cmp rdi, 0x1e
jb 0x180003c2e
cmp rdi, 0x6ad
jne 0x18000489f
mov ecx, dword [rsp + 0xc8]
mov r9, qword [rsp + 0x48]
lea eax, [r9 + 0x366]
and eax, 0x9057b
sub eax, 0x53b
xor ecx, eax
mov dword [rsp + 0xc8], ecx
jmp 0x1800047fc
cmp rdi, 0x45
je 0x180004dac
cmp rdi, 0x50
ja 0x1800048e2
mov ecx, eax
movabs rax, 0xa01a01a01a01a01b
imul rcx, rdi
mul rcx
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 8
xor rcx, 0x9d
mov qword [0x18002e010], rcx
jmp 0x1800047f0
cmp rdi, 0xe
jb 0x180004c65
cmp rdi, 0x57
jb 0x180004d8a
cmp rdi, 0x5b
jne 0x1800047f0
mov edx, edi
mov rcx, rsi
call fcn.180006240
mov ebp, eax
jmp 0x1800047f0
mov r11d, dword [rsp + 0xc0]
cmp ebp, r8d
je 0x1800032c0
cmp ebp, 0x5c
jb 0x180004dcc
cmp ebp, 0x5f
je 0x180003c2e
cmp ebp, 0x3a
ja 0x18000494f
mov r8d, eax
mov qword [rsp + 0x20], r9
mov rdx, rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x18000490a
cmp ebp, 0x52
jae 0x18000496a
lea rax, [rsi + 0x21d]
add rax, rdi
mov qword [0x18002e008], rax
jmp 0x1800047f0
cmp ebp, 0x1e
ja 0x1800047f0
mov edx, ecx
mov r8d, ebp
mov rcx, rdi
call fcn.180003298
mov r9d, eax
jmp 0x1800047be
cmp r9, 0x3e
je 0x180004503
cmp r9, 0x58
jb 0x180004d8a
mov r8d, 0x4c
cmp r9, 0x30
jb 0x180003c2e
jmp 0x180004a83
cmp ebp, 0x4e
je 0x180004c99
mov eax, 0x53
lea r8d, [rax - 7]
cmp ebp, eax
je 0x180003c2e
cmp ebp, 0x64
jb 0x180004c8b
cmp ebp, 0x43
jae 0x1800049e8
mov edx, esi
mov rcx, rdi
call fcn.180006240
mov r9, rax
jmp 0x180004a5d
cmp ebp, 0x2d
jae 0x1800049fd
mov ecx, ebx
mov r8d, r9d
mov edx, edi
call fcn.180003298
mov ebp, eax
jmp 0x180004a26
cmp ebp, 0x36
jae 0x180004a14
xor edx, edx
mov rax, r9
div rsi
mov edi, 0x21e
sub rdi, rdx
jmp 0x180004a5d
cmp ebp, 0x3b
jae 0x180004a2d
mov edx, edi
mov rcx, r9
call fcn.180006240
mov rdi, rax
mov r9, qword [rsp + 0x48]
jmp 0x180004a5d
mov eax, 0x4a
cmp ebp, eax
jae 0x180004a47
mov ecx, ebx
mov r8d, r9d
mov edx, edi
call fcn.180003298
mov r9d, eax
jmp 0x180004a5d
cmp ebp, 0x4f
je 0x180004cdf
mov eax, 0x14
cmp ebp, eax
jb 0x180004d8a
cmp ebp, 5
jb 0x180004b85
mov r11d, dword [rsp + 0xc0]
cmp ebp, 0x4f
jb 0x1800032c0
cmp ebp, 0x366
jne 0x180004b6a
cmp r9, 0x2a
jbe 0x180004b4c
cmp r9, 0x259
jne 0x180004b30
cmp rdi, 0x1b
jb 0x180004b85
mov r8d, 0x4c
cmp rdi, 0x32
jb 0x180003c2e
cmp rdi, 2
jb 0x180004503
cmp rdi, 0x6ad
je 0x180004b25
cmp rdi, 0x59
jb 0x180004b18
cmp rdi, 0x21
jbe 0x180004b09
cmp rdi, 0x34
jbe 0x180003c2e
cmp rdi, 0x49
je 0x180004b85
cmp rdi, 0x62
je 0x180004d8a
cmp rdi, 0x3c
jbe 0x180004b85
cmp rdi, 0x43
jne 0x180004b85
xor ebp, ebp
jmp 0x180004b85
mov edx, ebx
mov ecx, 0x366
call qword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x180004b85
mov qword [0x18002e018], 0x66
jmp 0x180004b85
add qword [rsp + 0xb0], 4
jmp 0x180004b85
cmp r9, 4
jne 0x180004b40
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
jmp 0x180004b85
cmp r9, 0x58
jb 0x180004503
jmp 0x180004b85
mov ecx, ebx
mov r9, rsi
mov r8d, 0x366
mov qword [rsp + 0x20], 0x366
mov rdx, rdi
call fcn.180004de0
jmp 0x180004b85
cmp ebp, 0x60
jae 0x180004b85
mov r8, rdi
mov edx, esi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
add ebp, esi
or ebp, 0x3b6
mov r8d, dword [rsp + 0xb8]
xor edx, edx
mov rbx, qword [rsp + 0x60]
mov eax, 0x1a7
mov rdi, qword [rsp + 0x68]
mov esi, dword [rsp + 0xc8]
mov ecx, ebp
mov rbp, qword [rsp + 0x58]
div rcx
mov rcx, rax
movabs rax, 0x709ad4e4ba80709b
mul rcx
shr rdx, 8
imul rax, rdx, 0x246
sub rcx, rax
mov eax, 0xfffffffc
sub eax, ecx
add r8d, eax
mov dword [rsp + 0xb8], r8d
jmp 0x180003560
movzx r8d, di
mov edx, 0x27
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x180004c02
mov edx, ebx
mov rcx, rsi
call fcn.180006240
mov r11d, dword [rsp + 0xc0]
jmp 0x1800032c0
mov ecx, ebp
mov qword [rsp + 0x20], rcx
mov r9d, ebp
mov r8d, ebp
mov edx, ebp
jmp 0x180004c81
mov qword [rsp + 0x20], rcx
mov r9d, 0x3b
mov r8, rdi
jmp 0x180004c7e
mov rdx, rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
jmp 0x180004c02
mov r9d, 0x366
mov edx, edi
mov r8d, r9d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x180004c02
mov ecx, ebp
mov r8d, edi
mov edx, 0x2e
call fcn.180003298
jmp 0x180004c02
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180004c02
mov ecx, eax
mov r9, rdi
mov qword [rsp + 0x20], 0x366
mov r8, rsi
mov rdx, rdi
call fcn.180004de0
jmp 0x180004c02
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x180004c02
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x180004c02
mov eax, edi
jmp 0x180004d37
mov ecx, edi
xor r8d, r8d
xor edx, edx
call fcn.180003298
mov eax, 0x3af
jmp 0x180004dcc
cmp edi, 0x2b
je 0x180004cf4
cmp edi, 0x3e
jb 0x180004ced
cmp edi, 0xe2
je 0x180004ce6
cmp edi, 0x32
jb 0x180004ced
cmp edi, 2
ja 0x180004d26
mov eax, edi
jmp 0x180004dcc
imul esi, dword [rsp + 0x44]
jmp 0x180004d26
xor eax, eax
jmp 0x180004dcc
mov ecx, 0x2b
call qword [sym.imp.KERNEL32.dll_InitializeSListHead]
jmp 0x180004d26
mov eax, 0x38
jmp 0x180004dcc
mov ecx, 0x3b7
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 0x3b7
jmp 0x180004dcc
test rbx, rbx
jne 0x180004d88
mov eax, esi
shr eax, 0xf
xor esi, eax
jmp 0x180004d88
mov rax, rbx
and eax, 0x2ba
mov qword [0x18002e010], rax
jmp 0x180004d88
mov r9, rbp
mov qword [rsp + 0x20], rdi
mov r8d, edi
mov rdx, rbp
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
and ebx, 0xa1
or rbx, 0x35e
jmp 0x180004d88
mov rax, rbx
xor rax, 0x245
jmp 0x180004d81
lea rax, [rbp*8 + 0x28e]
add rax, rbp
and rax, rbp
mov qword [str.m2e], rax
xor esi, ebx
mov eax, esi
jmp 0x180004dcc
mov eax, 0x12
jmp 0x180004dcc
mov eax, r8d
jmp 0x180004dcc
mov eax, r9d
jmp 0x180004dcc
mov eax, 0x259
jmp 0x180004dcc
mov eax, dword [rsp + 0x50]
jmp 0x180004dcc
mov eax, ecx
jmp 0x180004dcc
mov ecx, 0x366
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 0xa
jmp 0x180004dcc
mov eax, 0x50
jmp 0x180004dcc
mov eax, ebp
add rsp, 0x88
pop rdi
pop rsi
pop rbp
pop rbx
ret