Function at 0x18001ed80
Capabilities:
Create thread
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x6b0]
sub rsp, 0x7b0
mov rax, qword [0x180033018]
xor rax, rsp
mov qword [rbp + 0x6a0], rax
xor edx, edx
xorps xmm0, xmm0
mov rdi, rcx
mov qword [rbp + 8], rdx
mov r13, r8
mov qword [rbp + 0x28], rdx
mov r8d, 0x400
mov qword [rbp - 0x58], rdx
lea ecx, [rdx + 0x11]
mov qword [rbp - 0x38], rdx
lea eax, [rdx + 0xa]
mov dword [rbp + 0x10], ecx
mov dword [rbp - 0x50], ecx
mov ebx, edx
mov dword [rbp - 0x20], ecx
mov r14d, edx
mov esi, edx
mov qword [rbp - 0x28], rdx
mov r12d, edx
mov qword [rbp - 8], rdx
mov r15d, edx
mov dword [rbp + 0x30], eax
lea rcx, [rbp - 0x58]
mov dword [rbp + 0x34], r8d
mov edx, 0x100
mov dword [rbp - 0x30], eax
movdqu xmmword [rbp + 0x18], xmm0
mov dword [rbp - 0x2c], r8d
movdqu xmmword [rbp - 0x48], xmm0
mov dword [rbp], eax
movdqu xmmword [rbp - 0x18], xmm0
mov dword [rbp + 4], r8d
call fcn.180020434
mov dword [rsp + 0x60], 0x400
lea rax, [0x180025bc8]
mov qword [rsp + 0x58], rax
test r13, r13
je 0x18001ee4f
mov rdx, r13
lea rcx, [rsp + 0x58]
call fcn.18001e50c
jmp 0x18001ee58
and dword [rsp + 0x64], ebx
and qword [rsp + 0x68], rbx
and dword [rsp + 0x40], ebx
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.help
lea rcx, [rsp + 0x58]
call fcn.18001e5f8
test eax, eax
je 0x18001f54b
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x18002ebe4]
lea rcx, [rsp + 0x58]
call fcn.18001e5f8
test eax, eax
je 0x18001f54b
lea rax, [rsp + 0x40]
mov dword [rsp + 0x48], esi
lea r9, [rbp + 0x38]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x40], 0x10
lea rdx, [0x18002ebe8]
mov r13d, esi
lea rcx, [rsp + 0x58]
call fcn.18001e5f8
test eax, eax
js 0x18001f535
jne 0x18001ef04
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x38]
call fcn.180021de0
test eax, eax
je 0x18001f535
mov r13d, dword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0x104
lea r8, [rbp + 0x80]
lea rcx, [rsp + 0x58]
lea r12, [rbp + 0x80]
call fcn.18001e798
or rcx, 0xffffffffffffffff
lea rbx, [0x180025c40]
mov r15d, 2
cmp eax, 0x8007007a
jne 0x18001ef98
mov ebx, dword [rsp + 0x40]
mov eax, r15d
inc ebx
mov r8d, ebx
mul r8
cmovo rax, rcx
mov rcx, rax
call fcn.180024008
mov r12, rax
test rax, rax
jne 0x18001ef74
mov edx, r15d
mov rcx, rdi
call fcn.18001e9a8
jmp 0x18001f5bf
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], ebx
mov r8, r12
lea rcx, [rsp + 0x58]
call fcn.18001e798
test eax, eax
je 0x18001efa2
mov rcx, r12
call fcn.180023ffc
jmp 0x18001ef64
test eax, eax
jne 0x18001f042
jmp 0x18001efa9
lea rbx, [0x180025c40]
mov ecx, 0x38
call fcn.180024008
mov r14, rax
test rax, rax
je 0x18001efd8
mov qword [rax], rbx
mov dword [rax + 0x20], r13d
mov qword [rax + 0x18], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x28], rsi
mov qword [rax + 0x30], rsi
jmp 0x18001efdb
mov r14, rsi
test r14, r14
jne 0x18001eff0
mov edx, r15d
mov rcx, rdi
call fcn.18001e9a8
jmp 0x18001f5a6
mov r9d, r15d
mov dword [rsp + 0x20], esi
mov r8d, 0x40000000
mov rdx, r12
mov rcx, r14
call fcn.1800214d4
test eax, eax
jne 0x18001f01f
mov r8, r12
lea edx, [rax + 3]
mov rcx, rdi
call fcn.18001e9a8
jmp 0x18001f58d
mov rcx, qword [r14 + 0x18]
lea r9, [rbp - 0x60]
mov r8d, r15d
mov qword [rsp + 0x20], rsi
lea rdx, [0x18002fca8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x4c], esi
lea r9, [rbp + 0x58]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x40], 0x10
lea rdx, [0x18002fbd8]
lea rcx, [rsp + 0x58]
call fcn.18001e5f8
test eax, eax
jns 0x18001f082
lea r8, [0x18002fbd8]
mov edx, 4
jmp 0x18001f012
jne 0x18001f0d5
mov rax, qword [str.TRADITIONAL]
lea rbx, str.TRADITIONAL
jmp 0x18001f0c7
or dword [rsp + 0x28], 0xffffffff
lea r8, [rbp + 0x58]
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov ecx, 0x400
lea edx, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, r15d
je 0x18001f0ce
add rbx, 0x10
mov rax, qword [rbx]
test rax, rax
jne 0x18001f094
jmp 0x18001f074
mov eax, dword [rbx + 8]
mov dword [rsp + 0x4c], eax
lea rcx, [rsp + 0x58]
call fcn.18001e84c
mov dword [rbp - 0x80], eax
mov ebx, eax
test eax, eax
jne 0x18001f0f5
mov rcx, rdi
call fcn.18001e918
jmp 0x18001f58d
lea rax, [rsp + 0x44]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x18001ecd0]
xor edx, edx
mov dword [rsp + 0x20], esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop dword [rax + rax]
lea rcx, str.DictionaryGeneratorTerminate
mov r15, rax
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
nop dword [rax + rax]
mov ecx, esi
mov dword [0x180033744], eax
mov dword [rsp + 0x50], ecx
test ebx, ebx
jle 0x18001f46e
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0x208
mov r8d, ecx
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x58]
lea r9, [rbp + 0x290]
lea rdx, str.section
call fcn.18001e5f8
test eax, eax
js 0x18001f4fb
jne 0x18001f331
mov r8d, dword [rsp + 0x40]
lea rax, [0x180025b78]
or dword [rsp + 0x78], 0xffffffff
lea rdx, [rbp + 0x290]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
lea rax, [rbp - 0x78]
mov dword [rsp + 0x7c], 0x400
mov r9d, 0x3a
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], rsi
mov dword [rbp - 0x68], esi
call fcn.18001cdd0
mov rsi, rax
test rax, rax
je 0x18001f42a
mov rcx, qword [str.SettingFile]
lea rbx, str.SettingFile
test rcx, rcx
je 0x18001f42a
call qword [sym.imp.KERNEL32.dll_lstrlenW]
nop dword [rax + rax]
mov r9d, dword [rbp - 0x78]
mov edx, 1
mov r8, qword [rbp - 0x70]
mov ecx, 0x400
mov dword [rsp + 0x28], eax
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
je 0x18001f232
add rbx, 0x10
mov rcx, qword [rbx]
jmp 0x18001f1e5
mov eax, dword [rbx + 8]
mov ecx, 0x38
mov dword [rsp + 0x40], eax
call fcn.180024008
mov rbx, rax
test rax, rax
je 0x18001f274
and qword [rbx + 0x18], 0
lea rax, [0x180025c40]
and qword [rbx + 8], 0
and qword [rbx + 0x10], 0
and qword [rbx + 0x28], 0
and qword [rbx + 0x30], 0
mov qword [rbx], rax
mov dword [rbx + 0x20], r13d
jmp 0x18001f276
xor ebx, ebx
test rbx, rbx
je 0x18001f3fa
mov r9d, 3
mov dword [rsp + 0x20], 1
mov r8d, 0x80000000
lea rdx, [rsi + 2]
mov rcx, rbx
call fcn.1800214d4
test eax, eax
je 0x18001f3c6
mov ecx, 0x18
call fcn.180024008
mov rsi, rax
test rax, rax
je 0x18001f2c9
mov dword [rax], 0x400
mov qword [rax + 8], rbx
mov qword [rax + 0x10], r14
jmp 0x18001f2cb
xor esi, esi
test rsi, rsi
je 0x18001f393
mov r8d, dword [rsp + 0x40]
lea rax, [rbp - 0x28]
mov edx, dword [rsp + 0x4c]
lea r9, [rsp + 0x54]
and dword [rsp + 0x54], 0
mov rcx, rsi
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
call fcn.18001f6b0
mov r13d, eax
test eax, eax
jne 0x18001f34d
mov rcx, rsi
call fcn.180023ffc
mov rax, qword [rbx]
lea edx, [r13 + 1]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x180004b4f.0]
mov ebx, dword [rbp - 0x80]
xor esi, esi
mov ecx, dword [rsp + 0x50]
inc ecx
mov dword [rsp + 0x50], ecx
cmp ecx, ebx
jge 0x18001f468
mov r13d, dword [rsp + 0x48]
jmp 0x18001f147
test r15, r15
je 0x18001f36e
mov edx, dword [0x180033744]
xor r9d, r9d
mov ecx, dword [rsp + 0x44]
xor r8d, r8d
call qword [sym.imp.USER32.dll_PostThreadMessageW]
nop dword [rax + rax]
mov edx, 5
mov rcx, rdi
cmp r13d, edx
jne 0x18001f38e
mov r9d, dword [rsp + 0x54]
mov r8, qword [rbx + 0x30]
call fcn.18001e9a8
jmp 0x18001f553
mov edx, r13d
jmp 0x18001f3bc
test r15, r15
je 0x18001f3b4
mov edx, dword [0x180033744]
xor r9d, r9d
mov ecx, dword [rsp + 0x44]
xor r8d, r8d
call qword [sym.imp.USER32.dll_PostThreadMessageW]
nop dword [rax + rax]
mov edx, 2
mov rcx, rdi
call fcn.18001e9a8
jmp 0x18001f553
test r15, r15
je 0x18001f3e7
mov edx, dword [0x180033744]
xor r9d, r9d
mov ecx, dword [rsp + 0x44]
xor r8d, r8d
call qword [sym.imp.USER32.dll_PostThreadMessageW]
nop dword [rax + rax]
lea r8, [rsi + 2]
mov edx, 3
mov rcx, rdi
call fcn.18001e9a8
jmp 0x18001f461
test r15, r15
je 0x18001f41b
mov edx, dword [0x180033744]
xor r9d, r9d
mov ecx, dword [rsp + 0x44]
xor r8d, r8d
call qword [sym.imp.USER32.dll_PostThreadMessageW]
nop dword [rax + rax]
mov edx, 2
mov rcx, rdi
call fcn.18001e9a8
jmp 0x18001f461
test r15, r15
je 0x18001f44b
mov edx, dword [0x180033744]
xor r9d, r9d
mov ecx, dword [rsp + 0x44]
xor r8d, r8d
call qword [sym.imp.USER32.dll_PostThreadMessageW]
nop dword [rax + rax]
lea r8, str.section
mov edx, 4
mov rcx, rdi
call fcn.18001e9a8
xor ebx, ebx
xor esi, esi
jmp 0x18001f553
mov eax, dword [0x180033744]
test r15, r15
je 0x18001f48b
mov ecx, dword [rsp + 0x44]
xor r9d, r9d
xor r8d, r8d
mov edx, eax
call qword [sym.imp.USER32.dll_PostThreadMessageW]
nop dword [rax + rax]
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x70], 0x40
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x78], 0x32
mov qword [rbp - 0x70], rsi
call fcn.180022378
lea rcx, [rsp + 0x70]
mov rbx, rax
call fcn.180022378
mov r9d, 0x40040
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_MessageBoxW]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x18001f4e4
call fcn.180023ffc
mov rcx, qword [rsp + 0x78]
mov rbx, rsi
test rcx, rcx
je 0x18001f553
call fcn.180023ffc
jmp 0x18001f45f
test r15, r15
je 0x18001f51c
mov edx, dword [0x180033744]
xor r9d, r9d
mov ecx, dword [rsp + 0x44]
xor r8d, r8d
call qword [sym.imp.USER32.dll_PostThreadMessageW]
nop dword [rax + rax]
lea r8, str.section
mov edx, 4
mov rcx, rdi
call fcn.18001e9a8
mov rbx, rsi
jmp 0x18001f553
lea r8, [0x18002ebe8]
mov edx, 4
mov rcx, rdi
call fcn.18001e9a8
jmp 0x18001f5bf
mov rcx, rdi
call fcn.18001e918
test r15, r15
je 0x18001f567
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test rsi, rsi
je 0x18001f574
mov rcx, rsi
call fcn.180023ffc
test rbx, rbx
je 0x18001f58d
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x180004b4f.0]
test r14, r14
je 0x18001f5a6
mov rax, qword [r14]
mov edx, 1
mov rcx, r14
mov rax, qword [rax]
call qword [case.0x180004b4f.0]
test r12, r12
je 0x18001f5bf
lea rax, [rbp + 0x80]
cmp r12, rax
je 0x18001f5bf
mov rcx, r12
call fcn.180023ffc
lea rcx, [rsp + 0x58]
call fcn.18001e5c8
lea rcx, [rbp - 0x28]
call fcn.180020290
lea rcx, [rbp - 0x58]
call fcn.180020290
lea rcx, [rbp + 8]
call fcn.180020290
mov rcx, qword [rbp + 0x6a0]
xor rcx, rsp
call fcn.180024570
mov rbx, qword [rsp + 0x7f8]
add rsp, 0x7b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret