Function at 0x180076520
Capabilities:
Create directory
Enumerate gui resources
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r13
push r14
push r15
lea rbp, [rsp - 0x8a0]
sub rsp, 0x9a0
movaps xmmword [rsp + 0x990], xmm6
mov rax, qword [0x18026b028]
xor rax, rsp
mov qword [rbp + 0x870], rax
movabs rax, 0xb809c3cf13b6c022
lea rcx, [rbp + 0x660]
mov qword [rsp + 0x40], rax
movabs r15, 0xca0b21d14b73a0ee
mov rax, qword [rsp + 0x40]
movabs r14, 0xb87bc3aa13c2c047
mov qword [rbp + 0x250], rax
movabs rsi, 0x4092d29bcc707c7c
movabs rax, 0x40ebd2efcc197c12
movabs rbx, 0x284597e0d4a24279
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x258], rax
movabs rax, 0x2822978fd4ce4257
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x260], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x268], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x330], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x338], rax
movdqa xmm6, xmmword [rbp + 0x330]
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x340], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp + 0x260]
xorps xmm6, xmmword [rbp + 0x250]
mov qword [rbp + 0x348], rax
xorps xmm0, xmmword [rbp + 0x340]
movdqa xmmword [rbp + 0x260], xmm0
movdqa xmmword [rbp + 0x250], xmm6
call fcn.180076050
test al, al
je 0x18007861f
cmp word [rbp + 0x660], 0
lea rax, [rbp + 0x660]
je 0x180076680
add rax, 2
cmp word [rax], 0
jne 0x180076676
movq rcx, xmm6
test cx, cx
je 0x1800766b0
lea rdx, [rbp + 0x250]
sub rdx, rax
nop dword [rax]
nop dword [rax + rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x1800766a0
xor r13d, r13d
lea rcx, [rbp + 0x660]
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov word [rax], r13w
lea r8d, [r13 + 1]
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x18034cf40], rax
cmp rax, 0xffffffffffffffff
je 0x18007861f
mov qword [rsp + 0x9d0], rdi
lea r8d, [r13 + 3]
mov qword [rsp + 0x9d8], r12
lea rdx, [0x18024d690]
xor r9d, r9d
movaps xmmword [rsp + 0x980], xmm7
mov rcx, rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
call fcn.1800f8110
movabs rax, 0x981cadc374a5af2b
lea rdx, [rbp + 0x220]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0x220]
mov rax, qword [rsp + 0x40]
movabs r12, 0xabdbdea77899cd00
mov qword [rbp + 0x220], rax
mov r8d, edx
movabs rax, 0x29b2bffeb803050f
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x228], rax
movabs rax, 0x522cfb81bdd62b17
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x230], rax
movabs rax, 0xa56801bf241ad48f
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x238], rax
movabs rax, 0x70cbdee29fa699e6
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x240], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x248], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x3f0], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rbx
mov qword [rbp + 0x3f8], rax
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp + 0x3f0]
mov qword [rbp + 0x400], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x408], rax
movabs rax, 0x70afbb96facae98b
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x410], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
xorps xmm2, xmmword [rbp + 0x220]
movdqa xmm0, xmmword [rbp + 0x230]
movdqa xmm1, xmmword [rbp + 0x240]
xorps xmm0, xmmword [rbp + 0x400]
mov qword [rbp + 0x418], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x410]
movdqa xmmword [rbp + 0x240], xmm1
movdqa xmmword [rbp + 0x220], xmm2
movdqa xmmword [rbp + 0x230], xmm0
test al, al
je 0x1800768ad
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x1800768a2
mov rcx, qword [0x18034cf40]
sub r8d, edx
lea rdx, [rbp + 0x220]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
movdqa xmm1, xmmword [0x18024db50]
lea rdi, [0x1803a0550]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xorps xmm0, xmm0
xor r8d, r8d
movups xmmword [rbp - 0x50], xmm0
xor ecx, ecx
mov byte [rbp - 0x50], r13b
lea edx, [r9 + 5]
movdqu xmmword [rbp - 0x40], xmm1
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
movabs rax, 0xcc12add876b6a51b
xorps xmm1, xmm1
mov qword [rsp + 0x40], rax
mov rbx, 0xffffffffffffffff
mov rax, qword [rsp + 0x40]
mov r8, rbx
mov qword [rbp - 0x60], rax
movabs rax, 0x4092d29bcc702005
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x58], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp - 0x60]
mov qword [rsp + 0x58], rax
xorps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp - 0x60], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x2f0], xmm0
movdqu xmmword [rbp + 0x300], xmm1
nop
inc r8
cmp byte [rdi + r8], r13b
jne 0x180076980
mov rdx, rdi
lea rcx, [rbp + 0x2f0]
call fcn.180069fd0
lea rax, [rbp - 0x60]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], r13b
jne 0x1800769a0
mov r8, rbx
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x2f0]
call fcn.180063f90
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
movups xmmword [rbp + 0x310], xmm6
movups xmmword [rbp + 0x320], xmm7
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], r13b
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x180076a1b
mov rcx, qword [rbp - 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180076a16
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18007862c
call fcn.18015cfec
mov rdx, qword [rbp + 0x308]
movups xmmword [rbp - 0x50], xmm6
movups xmmword [rbp - 0x40], xmm7
cmp rdx, 0x10
jb 0x180076a64
mov rcx, qword [rbp + 0x2f0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180076a5f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18007862c
call fcn.18015cfec
cmp qword [rbp - 0x38], 0x10
lea rcx, [rbp - 0x50]
movdqa xmm0, xmmword [0x18024db50]
cmovae rcx, qword [rbp - 0x50]
xor edx, edx
movdqu xmmword [rbp + 0x300], xmm0
mov byte [rbp + 0x2f0], r13b
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rcx, qword [0x18039ab68]
call fcn.18004b2d0
xor edx, edx
call fcn.1800f8110
movabs rax, 0xcb5ba4c375acaf24
lea rdx, [rbp + 0x40]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0x40]
mov rax, qword [rsp + 0x40]
movabs rbx, 0x284597e0d4a24279
mov qword [rbp + 0x40], rax
movabs rdi, 0x70afbb96facae98b
movabs rax, 0x2efbf2f6a9040f05
mov r8d, edx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x48], rax
movabs rax, 0x493ffe8cb5cb3610
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x50], rax
movabs rax, 0xa76442f1251cc99a
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x58], rax
movabs rax, 0x70afdff38eaf85fb
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x60], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x68], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x420], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rbx
mov qword [rbp + 0x428], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r15
mov qword [rbp + 0x430], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x438], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x440], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp + 0x40]
xorps xmm2, xmmword [rbp + 0x420]
movdqa xmm0, xmmword [rbp + 0x50]
movdqa xmm1, xmmword [rbp + 0x60]
xorps xmm0, xmmword [rbp + 0x430]
mov qword [rbp + 0x448], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x440]
movdqa xmmword [rbp + 0x40], xmm2
movdqa xmmword [rbp + 0x50], xmm0
movdqa xmmword [rbp + 0x60], xmm1
test al, al
je 0x180076bfb
nop dword [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180076bf0
mov rcx, qword [0x18034cf40]
sub r8d, edx
lea rdx, [rbp + 0x40]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.1800f8b40
test al, al
je 0x180077aa9
xor edx, edx
call fcn.1800f8110
movabs rax, 0xcb5bbad87cafa52a
lea rdx, [rbp + 0x70]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0x70]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp + 0x70], rax
movabs rax, 0x2efbf2f6a9040f05
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x78], rax
movabs rax, 0x493ffe8cb5cb3610
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x80], rax
movabs rax, 0xa76442f1251cc99a
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x88], rax
movabs rax, 0x70afdff38eaf85fb
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x90], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x98], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x450], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rbx
mov qword [rbp + 0x458], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r15
mov qword [rbp + 0x460], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x468], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x470], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp + 0x70]
xorps xmm2, xmmword [rbp + 0x450]
movdqa xmm0, xmmword [rbp + 0x80]
movdqa xmm1, xmmword [rbp + 0x90]
xorps xmm0, xmmword [rbp + 0x460]
mov qword [rbp + 0x478], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x470]
movdqa xmmword [rbp + 0x70], xmm2
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmmword [rbp + 0x90], xmm1
test al, al
je 0x180076d8b
nop word [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180076d80
mov rcx, qword [0x18034cf40]
sub r8d, edx
lea rdx, [rbp + 0x70]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.1800f83e0
test al, al
je 0x180077aa9
xor edx, edx
call fcn.1800f8110
movabs rax, 0xcb02b08a7bb6a12a
lea rdx, [rbp + 0x190]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0x190]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp + 0x190], rax
movabs rax, 0x34fbbcf2ec1d1908
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x198], rax
movabs rax, 0x4131f69abdce2310
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x1a0], rax
movabs rax, 0xa67b4cbe2853ce81
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x1a8], rax
movabs rax, 0x70afbb969eaf9dee
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x1b0], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x1b8], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x480], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rbx
mov qword [rbp + 0x488], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r15
mov qword [rbp + 0x490], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x498], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x4a0], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp + 0x190]
xorps xmm2, xmmword [rbp + 0x480]
movdqa xmm0, xmmword [rbp + 0x1a0]
movdqa xmm1, xmmword [rbp + 0x1b0]
xorps xmm0, xmmword [rbp + 0x490]
mov qword [rbp + 0x4a8], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x4a0]
movdqa xmmword [rbp + 0x190], xmm2
movdqa xmmword [rbp + 0x1a0], xmm0
movdqa xmmword [rbp + 0x1b0], xmm1
test al, al
je 0x180076f2b
nop dword [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180076f20
mov rcx, qword [0x18034cf40]
sub r8d, edx
lea rdx, [rbp + 0x190]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.1800891b0
test al, al
je 0x180077aa9
xor edx, edx
call fcn.1800f8110
movabs rax, 0xdb1aa5d876b6ae2e
lea rdx, [rbp + 0xd0]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0xd0]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp + 0xd0], rax
movabs rax, 0x29e6bbf5a5500f19
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0xd8], rax
movabs rax, 0x472ce381aecb2e18
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0xe0], rax
movabs rax, 0xaf6751bc24108080
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0xe8], rax
movabs rax, 0x70afbb96faae8cff
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0xf0], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0xf8], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x4b0], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rbx
mov qword [rbp + 0x4b8], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r15
mov qword [rbp + 0x4c0], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x4c8], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x4d0], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp + 0xd0]
xorps xmm2, xmmword [rbp + 0x4b0]
movdqa xmm0, xmmword [rbp + 0xe0]
movdqa xmm1, xmmword [rbp + 0xf0]
xorps xmm0, xmmword [rbp + 0x4c0]
mov qword [rbp + 0x4d8], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x4d0]
movdqa xmmword [rbp + 0xd0], xmm2
movdqa xmmword [rbp + 0xe0], xmm0
movdqa xmmword [rbp + 0xf0], xmm1
test al, al
je 0x1800770cb
nop dword [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x1800770c0
mov rcx, qword [0x18034cf40]
sub r8d, edx
lea rdx, [rbp + 0xd0]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rax, 0xda45af14845634c1
lea rcx, [rbp + 0x270]
mov qword [rsp + 0x40], rax
movabs rbx, 0xb192b7d6b9d01424
mov rax, qword [rsp + 0x40]
movabs rdi, 0xda37af71843f34b5
mov qword [rbp + 0x270], rax
movabs r12, 0x23ee88f4043ba3ca
movabs rax, 0x238288900415a3fa
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x278], rax
movabs rax, 0x52d298cbf764a86b
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x280], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x288], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x350], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x358], rax
movabs rax, 0x52d298cbf764a807
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x360], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp + 0x270]
xorps xmm0, xmmword [rbp + 0x350]
mov qword [rbp + 0x368], rax
movdqa xmm1, xmmword [rbp + 0x360]
xorps xmm1, xmmword [rbp + 0x280]
movdqa xmmword [rbp + 0x280], xmm1
movdqa xmmword [rbp + 0x270], xmm0
call fcn.1800f9820
mov r8, rax
test rax, rax
je 0x180077aa9
movabs rax, 0xb55bc032ea50778a
lea rdx, [rbp + 0x290]
mov qword [rsp + 0x40], rax
movabs rax, 0x62b7c8b46348eeb8
mov rcx, qword [rsp + 0x40]
mov qword [rbp + 0x290], rcx
mov qword [rsp + 0x40], rax
movabs rax, 0x3ebddb9db521e95f
mov rcx, qword [rsp + 0x40]
mov qword [rbp + 0x298], rcx
movabs rcx, 0x4d15f3e09e3d194e
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x2a0], rax
movabs rax, 0xf5d0f286f990664b
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x2a8], rax
movabs rax, 0xc616250dd45b6ac3
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x2b0], rax
mov qword [rsp + 0x40], rcx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x2b8], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov qword [rbp + 0x4e0], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x4e8], rax
movabs rax, 0x52d298cbf764a807
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x4f0], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x4f8], rax
movabs rax, 0xc616250dd45b3099
movdqa xmm1, xmmword [rbp + 0x4f0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rcx
mov rcx, r8
mov qword [rbp + 0x500], rax
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp + 0x290]
xorps xmm0, xmmword [rbp + 0x4e0]
xorps xmm1, xmmword [rbp + 0x2a0]
movdqa xmmword [rbp + 0x290], xmm0
mov qword [rbp + 0x508], rax
movdqa xmm0, xmmword [rbp + 0x500]
xorps xmm0, xmmword [rbp + 0x2b0]
movdqa xmmword [rbp + 0x2b0], xmm0
movdqa xmmword [rbp + 0x2a0], xmm1
call fcn.1800f9b00
mov qword [0x18039fc98], rax
test rax, rax
je 0x180077aa9
xor edx, edx
call fcn.1800f8110
movabs rax, 0xcc12adc333a9a434
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x10]
mov rax, qword [rsp + 0x40]
movabs rdi, 0x284597e0d4a24279
mov qword [rbp - 0x10], rax
mov r8d, edx
movabs rax, 0x29e6b3e1a51c1d15
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 8], rax
movabs rax, 0x4435fa8fb7822c16
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp], rax
movabs rax, 0xca0b21d12f16d48b
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 8], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x370], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x378], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x380], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
movdqa xmm1, xmmword [rbp - 0x10]
xorps xmm1, xmmword [rbp + 0x370]
movdqa xmm0, xmmword [rbp]
mov qword [rbp + 0x388], rax
movq rax, xmm1
xorps xmm0, xmmword [rbp + 0x380]
movdqa xmmword [rbp - 0x10], xmm1
movdqa xmmword [rbp], xmm0
test al, al
je 0x18007747b
nop dword [rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180077470
mov rcx, qword [0x18034cf40]
sub r8d, edx
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x18039f570]
test rcx, rcx
jne 0x1800774db
nop dword [rax]
nop word [rax + rax]
lea rdx, [0x18039f570]
lea rcx, [0x1800f7fd0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x18039f570]
test rcx, rcx
je 0x1800774b0
lea r8, [0x180081830]
mov edx, 0xfffffffc
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov qword [0x18039f710], rax
test rax, rax
je 0x180077aa9
xor edx, edx
call fcn.1800f8110
movabs rax, 0xc108e3de66b2ae2e
lea rdx, [rbp + 0x100]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0x100]
mov rax, qword [rsp + 0x40]
movabs rbx, 0xabdbdea77899cd00
mov qword [rbp + 0x100], rax
movabs r12, 0x70afbb96facae98b
movabs rax, 0x29fcbbbba115080f
mov r8d, edx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x108], rax
movabs rax, 0x5c24ed89b8c32b0d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x110], rax
movabs rax, 0xba664eb26b1dcf87
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x118], rax
movabs rax, 0x70afbbf29fbe8ce7
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x120], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x128], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x510], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x518], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r15
mov qword [rbp + 0x520], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x528], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x530], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp + 0x100]
xorps xmm2, xmmword [rbp + 0x510]
movdqa xmm0, xmmword [rbp + 0x110]
movdqa xmm1, xmmword [rbp + 0x120]
xorps xmm0, xmmword [rbp + 0x520]
mov qword [rbp + 0x538], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x530]
movdqa xmmword [rbp + 0x100], xmm2
movdqa xmmword [rbp + 0x110], xmm0
movdqa xmmword [rbp + 0x120], xmm1
test al, al
je 0x180077680
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180077675
mov rcx, qword [0x18034cf40]
sub r8d, edx
lea rdx, [rbp + 0x100]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8, qword [0x18039f560]
mov rdx, qword [0x18039f558]
mov rcx, qword [0x18039f570]
call fcn.1800eb960
cmp byte [0x18039f568], r13b
jne 0x1800776d6
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x18039f568], r13b
je 0x1800776c2
xor edx, edx
call fcn.1800f8110
movabs rax, 0xca1eb1cf77aca535
lea rdx, [rbp + 0x130]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0x130]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp + 0x130], rax
movabs rax, 0x24fcb7f0af111e5c
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x138], rax
movabs rax, 0x4424fe94bdcc2b59
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x140], rax
movabs rax, 0xea654eb83f12da87
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x148], rax
movabs rax, 0x15dbdefa8aa786e8
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x150], rax
movabs rax, 0xabdbdea77899cd64
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x158], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x540], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x548], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r15
mov qword [rbp + 0x550], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x558], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x560], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp + 0x130]
xorps xmm2, xmmword [rbp + 0x540]
movdqa xmm0, xmmword [rbp + 0x140]
movdqa xmm1, xmmword [rbp + 0x150]
xorps xmm0, xmmword [rbp + 0x550]
mov qword [rbp + 0x568], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x560]
movdqa xmmword [rbp + 0x130], xmm2
movdqa xmmword [rbp + 0x140], xmm0
movdqa xmmword [rbp + 0x150], xmm1
test al, al
je 0x18007784f
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180077844
mov rcx, qword [0x18034cf40]
sub r8d, edx
lea rdx, [rbp + 0x130]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.1800b1c40
test al, al
jne 0x180077b30
mov dl, 3
call fcn.1800f8110
movabs rax, 0xa5ce234651f3306f
lea rdx, [rbp + 0x10]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0x10]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp + 0x10], rax
movabs rax, 0xde434caf1c3d79a9
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x18], rax
movabs rax, 0x9a82975a2806dbf
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x20], rax
movabs rax, 0xb0989e5868f954e5
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x28], rax
movabs rax, 0xd1ee47233d9a5109
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x390], rax
movabs rax, 0xbf2a38c6725459c6
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x398], rax
movabs rax, 0x68c04a55c7fa04d3
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x3a0], rax
movabs rax, 0xb0989e5868f92788
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movdqa xmm1, xmmword [rbp + 0x10]
xorps xmm1, xmmword [rbp + 0x390]
mov qword [rbp + 0x3a8], rax
movq rax, xmm1
movdqa xmm0, xmmword [rbp + 0x3a0]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmmword [rbp + 0x10], xmm1
test al, al
je 0x18007798f
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180077984
mov rcx, qword [0x18034cf40]
sub r8d, edx
lea rdx, [rbp + 0x10]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dl, 3
call fcn.1800f8110
movabs rax, 0xcc5ba7cf7faba121
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x80]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp - 0x80], rax
movabs rax, 0x60e2a7efa9035c13
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x78], rax
movabs rax, 0x2836fb81a1d12b0f
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x3d0], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x3d8], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x3e0], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
movdqa xmm1, xmmword [rbp - 0x80]
xorps xmm1, xmmword [rbp + 0x3d0]
mov qword [rbp + 0x3e8], rax
movq rax, xmm1
movdqa xmm0, xmmword [rbp + 0x3e0]
xorps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmmword [rbp - 0x80], xmm1
test al, al
je 0x180077a8d
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180077a82
mov rcx, qword [0x18034cf40]
sub r8d, edx
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor bl, bl
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x180077ae6
mov rcx, qword [rbp - 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180077ae1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180078626
call fcn.18015cfec
mov r12, qword [rsp + 0x9d8]
movzx eax, bl
mov rdi, qword [rsp + 0x9d0]
movaps xmm7, xmmword [rsp + 0x980]
mov rcx, qword [rbp + 0x870]
xor rcx, rsp
call fcn.18015cd30
mov rbx, qword [rsp + 0x9e0]
movaps xmm6, xmmword [rsp + 0x990]
add rsp, 0x9a0
pop r15
pop r14
pop r13
pop rsi
pop rbp
ret
xor edx, edx
call fcn.1800f8110
movabs rax, 0xcb1eb1df67a3a521
lea rdx, [rbp + 0x160]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0x160]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp + 0x160], rax
movabs rax, 0x2cf3bbefa51e155c
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x168], rax
movabs rax, 0x82bf889a0c33810
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x170], rax
movabs rax, 0xaf7f44bd3b1ecf8d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x178], rax
movabs rax, 0x70afbb96facae9ef
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x180], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x188], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x570], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x578], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r15
mov qword [rbp + 0x580], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x588], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x590], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp + 0x160]
xorps xmm2, xmmword [rbp + 0x570]
movdqa xmm0, xmmword [rbp + 0x170]
movdqa xmm1, xmmword [rbp + 0x180]
xorps xmm0, xmmword [rbp + 0x580]
mov qword [rbp + 0x598], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x590]
movdqa xmmword [rbp + 0x160], xmm2
movdqa xmmword [rbp + 0x170], xmm0
movdqa xmmword [rbp + 0x180], xmm1
test al, al
je 0x180077c9f
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180077c94
mov rcx, qword [0x18034cf40]
sub r8d, edx
lea rdx, [rbp + 0x160]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rax, 0xdc55b7c476abac24
lea rdx, [rbp + 0x30]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0x2c0]
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x30], rax
movabs rax, 0x4092d29bcc701010
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x38], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp + 0x30]
mov qword [rsp + 0x68], rax
movabs rax, 0xb81ec3c213a1c034
xorps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp + 0x30], xmm0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x2c0], rax
movabs rax, 0x40f1d2c4cc117c11
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x2c8], rax
movabs rax, 0x282b9785d4cb4215
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x2d0], rax
movabs rax, 0xca7321a54b5da09a
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x2d8], rax
movabs rax, 0x70afbb96facae9ff
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x2e0], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x2e8], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x5a0], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x5a8], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r15
mov qword [rbp + 0x5b0], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x5b8], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x5c0], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp + 0x2c0]
xorps xmm0, xmmword [rbp + 0x5a0]
movdqa xmm1, xmmword [rbp + 0x2d0]
xorps xmm1, xmmword [rbp + 0x5b0]
movdqa xmmword [rbp + 0x2c0], xmm0
movdqa xmm0, xmmword [rbp + 0x2e0]
mov qword [rbp + 0x5c8], rax
xorps xmm0, xmmword [rbp + 0x5c0]
movdqa xmmword [rbp + 0x2e0], xmm0
movdqa xmmword [rbp + 0x2d0], xmm1
call fcn.18009cbe0
test al, al
je 0x180077aa9
xor edx, edx
call fcn.1800f8110
movabs rax, 0xcb5ba2c776aaa334
lea rdx, [rbp + 0x1c0]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0x1c0]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp + 0x1c0], rax
movabs rax, 0x2efbf2f6a9040f05
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x1c8], rax
movabs rax, 0x493ffe8cb5cb3610
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x1d0], rax
movabs rax, 0xa76442f1251cc99a
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x1d8], rax
movabs rax, 0x70afdff38eaf85fb
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x1e0], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x1e8], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x5d0], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x5d8], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r15
mov qword [rbp + 0x5e0], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x5e8], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x5f0], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp + 0x1c0]
xorps xmm2, xmmword [rbp + 0x5d0]
movdqa xmm0, xmmword [rbp + 0x1d0]
movdqa xmm1, xmmword [rbp + 0x1e0]
xorps xmm0, xmmword [rbp + 0x5e0]
mov qword [rbp + 0x5f8], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x5f0]
movdqa xmmword [rbp + 0x1c0], xmm2
movdqa xmmword [rbp + 0x1d0], xmm0
movdqa xmmword [rbp + 0x1e0], xmm1
test al, al
je 0x180077feb
nop word [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180077fe0
mov rcx, qword [0x18034cf40]
sub r8d, edx
lea rdx, [rbp + 0x1c0]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rdx, 0x68045f57217a8e71
call fcn.1800789f0
movabs rdx, 0x8b4a6c039af717a8
mov qword [0x18039f578], rax
mov r12, rax
call fcn.1800789f0
movabs rdx, 0xe2d2563b91bdc56c
mov qword [0x18039f590], rax
mov r15, rax
call fcn.1800789f0
movabs rdx, 0xd5db34823d6f1c40
mov qword [0x18039f588], rax
mov r14, rax
call fcn.1800789f0
movabs rdx, 0xb231a1bea995f83b
mov qword [0x18039f598], rax
mov rsi, rax
call fcn.1800789f0
movabs rdx, 0x5f0720d54e5f164
mov qword [0x18039f580], rax
mov rdi, rax
call fcn.1800789f0
movabs rdx, 0x483047d5ed936395
mov qword [0x18039f5a0], rax
mov rbx, rax
call fcn.1800789f0
test rax, rax
mov qword [0x18039f5a8], rax
mov edx, r13d
mov r8d, r13d
setne cl
test rbx, rbx
setne al
and cl, al
test rdi, rdi
movzx eax, cl
mov ecx, r13d
cmovne edx, eax
test rsi, rsi
setne al
and dl, al
test r14, r14
movzx eax, dl
cmovne r8d, eax
test r15, r15
setne al
and r8b, al
test r12, r12
movzx eax, r8b
cmovne ecx, eax
test cl, cl
je 0x180077aa9
xor edx, edx
call fcn.1800f8110
movabs rax, 0x9808b1cb65acaf24
lea rdx, [rbp + 0xa0]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0xa0]
mov rax, qword [rsp + 0x40]
movabs r14, 0xabdbdea77899cd00
mov qword [rbp + 0xa0], rax
movabs rdi, 0xb87bc3aa13c2c047
movabs rax, 0x29b2bffeb803050f
movabs rbx, 0x4092d29bcc707c7c
mov qword [rsp + 0x40], rax
movabs r15, 0x284597e0d4a24279
mov rax, qword [rsp + 0x40]
movabs rsi, 0xca0b21d14b73a0ee
mov qword [rbp + 0xa8], rax
movabs r12, 0x70afbb96facae98b
movabs rax, 0x522cfb81bdd62b17
mov r8d, edx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0xb0], rax
movabs rax, 0xa56801bf241ad48f
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0xb8], rax
movabs rax, 0x70cbdee29fa699e6
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0xc0], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0xc8], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rbx
mov qword [rbp + 0x600], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r15
mov qword [rbp + 0x608], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x610], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x618], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x620], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp + 0xa0]
xorps xmm2, xmmword [rbp + 0x600]
movdqa xmm0, xmmword [rbp + 0xb0]
movdqa xmm1, xmmword [rbp + 0xc0]
xorps xmm0, xmmword [rbp + 0x610]
mov qword [rbp + 0x628], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x620]
movdqa xmmword [rbp + 0xa0], xmm2
movdqa xmmword [rbp + 0xb0], xmm0
movdqa xmmword [rbp + 0xc0], xmm1
test al, al
je 0x1800782ae
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x1800782a3
mov rcx, qword [0x18034cf40]
sub r8d, edx
lea rdx, [rbp + 0xa0]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.18007b510
test al, al
je 0x180077aa9
xor edx, edx
call fcn.1800f8110
movabs rax, 0xd612e3d978adaf2f
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x30]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp - 0x30], rax
movabs rax, 0x21e8bbf7ad190815
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x28], rax
movabs rax, 0x452af4c0bacd2b0d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x20], rax
movabs rax, 0xca0b45b43f16cc9e
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x18], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rbx
mov qword [rbp + 0x3b0], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x3b8], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x3c0], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
movdqa xmm1, xmmword [rbp - 0x30]
xorps xmm1, xmmword [rbp + 0x3b0]
movdqa xmm0, xmmword [rbp - 0x20]
mov qword [rbp + 0x3c8], rax
movq rax, xmm1
xorps xmm0, xmmword [rbp + 0x3c0]
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmmword [rbp - 0x20], xmm0
test al, al
je 0x1800783cb
nop dword [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x1800783c0
mov rcx, qword [0x18034cf40]
sub r8d, edx
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
call fcn.1800f8110
movabs rax, 0xc10faac461a7b422
lea rdx, [rbp + 0x1f0]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0x1f0]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp + 0x1f0], rax
movabs rax, 0x2cf3bbefa51e155c
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x1f8], rax
movabs rax, 0x82bf889a0c33810
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x200], rax
movabs rax, 0xaf7f44bd3b1ecf8d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x208], rax
movabs rax, 0x19dcc9f38ceac5ef
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x210], rax
movabs rax, 0xabdbdea758a3a36f
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x218], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rbx
mov qword [rbp + 0x630], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r15
mov qword [rbp + 0x638], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x640], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x648], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x650], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp + 0x1f0]
xorps xmm2, xmmword [rbp + 0x630]
movdqa xmm0, xmmword [rbp + 0x200]
movdqa xmm1, xmmword [rbp + 0x210]
xorps xmm0, xmmword [rbp + 0x640]
mov qword [rbp + 0x658], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x650]
movdqa xmmword [rbp + 0x1f0], xmm2
movdqa xmmword [rbp + 0x200], xmm0
movdqa xmmword [rbp + 0x210], xmm1
test al, al
je 0x180078560
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180078555
mov rcx, qword [0x18034cf40]
sub r8d, edx
lea rdx, [rbp + 0x1f0]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rax, 0xb80da6ce33f0b324
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x70]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rsp + 0x70]
mov qword [rbp - 0x78], rax
xorps xmm0, xmmword [rbp - 0x80]
movq rax, xmm0
movdqa xmmword [rsp + 0x70], xmm0
test al, al
je 0x1800785fb
nop dword [rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x1800785f0
mov rcx, qword [0x18034cf40]
sub r8d, edx
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov bl, 1
jmp 0x180077aab
xor al, al
jmp 0x180077b01
call fcn.18016c8a4
int3
call fcn.18016c8a4
int3