Function at 0x180043820
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rax - 0x128]
sub rsp, 0x200
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1800ac6c0]
xor rax, rsp
mov qword [rbp + 0xf0], rax
mov rdi, rdx
mov rsi, rcx
mov r12, qword [0x1800fb7c0]
xor r14d, r14d
mov dword [rdx + 0x58], r14d
mov rdx, rcx
lea rcx, [0x1800af740]
call fcn.180053030
cmp qword [rsi + 0x410], r14
jne 0x180044f03
cmp dword [r12 + 8], r14d
je 0x180043a6c
cmp qword [rsi + 0x2c0], r14
je 0x180043a6c
mov qword [rbp + 0x68], 0xf
mov qword [rbp + 0x60], r14
mov byte [rbp + 0x50], r14b
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsi + 0x2b0]
lea rcx, [rbp + 0x50]
call fcn.180002920
nop
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0xa0]
call fcn.180005e30
mov rbx, rax
lea rax, [rbp + 0x50]
cmp rax, rbx
je 0x180043945
cmp qword [rbp + 0x68], 0x10
jb 0x1800438f7
mov rcx, qword [rbp + 0x50]
call fcn.180064a00
mov qword [rbp + 0x68], 0xf
mov qword [rbp + 0x60], r14
mov byte [rbp + 0x50], 0
cmp qword [rbx + 0x18], 0x10
jae 0x180043923
mov r8, qword [rbx + 0x10]
inc r8
mov rdx, rbx
lea rcx, [rbp + 0x50]
call fcn.180064dc0
jmp 0x18004392d
mov rax, qword [rbx]
mov qword [rbp + 0x50], rax
mov qword [rbx], r14
mov rax, qword [rbx + 0x10]
mov qword [rbp + 0x60], rax
mov rax, qword [rbx + 0x18]
mov qword [rbp + 0x68], rax
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r14
cmp qword [rbp + 0xb8], 0x10
jb 0x18004395b
mov rcx, qword [rbp + 0xa0]
call fcn.180064a00
mov r9, qword [rbp + 0x68]
mov r10, qword [rbp + 0x50]
movsxd rax, dword [rbp + 0x60]
cmp eax, 7
jle 0x180043a5e
test eax, eax
je 0x180043a5e
mov rdx, r14
mov r8, rax
jle 0x180043a5e
nop word [rax + rax]
lea rax, [rbp + 0x50]
cmp r9, 0x10
cmovae rax, r10
movzx ecx, byte [rdx + rax]
cmp cl, 0x2e
je 0x1800439d0
cmp cl, 0x3a
je 0x1800439d0
cmp cl, 0x2c
je 0x1800439d0
cmp cl, 0x20
je 0x1800439d0
cmp cl, 0x30
jl 0x1800439be
cmp cl, 0x39
jle 0x1800439d0
cmp cl, 0x61
jl 0x1800439c8
cmp cl, 0x66
jle 0x1800439d0
sub cl, 0x41
cmp cl, 5
ja 0x1800439de
inc rdx
cmp rdx, r8
jge 0x180043a5e
jmp 0x180043990
lea rcx, [rdi + 0x88]
mov r8d, 0x13
lea rdx, [0x18008dbc8]
call fcn.180002a30
mov r8d, 6
lea rdx, [0x18008dbdc]
lea rcx, [rdi + 8]
call fcn.180002a30
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsi + 0x2b0]
lea rcx, [rdi + 8]
call fcn.18000c770
mov dword [rdi + 0x58], 1
mov dword [rdi + 0xbc], 1
mov qword [rdi + 0xb0], 4
mov dword [rsi + 0x3f8], 1
cmp qword [rbp + 0x68], 0x10
jb 0x180044f03
mov rcx, qword [rbp + 0x50]
jmp 0x180044efe
cmp r9, 0x10
jb 0x180043a6c
mov rcx, r10
call fcn.180064a00
cmp dword [r12 + 0xc], 0
je 0x180043dc7
lea rcx, [rsi + 0xf0]
mov r9d, 6
xor r8d, r8d
lea rdx, str..._.._
call fcn.18000ae20
cmp rax, 0xffffffffffffffff
je 0x180043af4
lea rcx, [rdi + 0x88]
mov r8d, 0xb
lea rdx, [0x18008dbf0]
call fcn.180002a30
lea rcx, [rdi + 8]
mov r8d, 0x14
lea rdx, [0x18008dc00]
call fcn.180002a30
mov qword [rdi + 0xb0], 4
mov dword [rdi + 0xbc], 1
mov dword [rdi + 0x58], 1
mov dword [rsi + 0x3f8], 1
jmp 0x180044f03
mov qword [rbp + 0x90], 0xf
mov qword [rbp + 0x88], r14
mov byte [rbp + 0x78], 0
mov qword [rbp + 0xb8], 0xf
mov qword [rbp + 0xb0], r14
mov byte [rbp + 0xa0], 0
lea rdx, [rsi + 0xc8]
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rbp + 0xa0]
call fcn.180002920
lea rdx, [rbp + 0x78]
lea rcx, [rbp + 0xa0]
call fcn.180008030
test eax, eax
je 0x180043bd5
lea rcx, [rdi + 0x88]
mov r8d, 0xb
lea rdx, [0x18008dbf0]
call fcn.180002a30
mov r8d, 0xa
lea rdx, [0x18008dc18]
lea rcx, [rdi + 8]
call fcn.180002a30
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0x78]
lea rcx, [rdi + 8]
call fcn.18000c770
mov dword [rdi + 0x58], 1
mov dword [rdi + 0xbc], 1
mov qword [rdi + 0xb0], 4
mov dword [rsi + 0x3f8], 1
cmp qword [rbp + 0x90], 0x10
jb 0x180044f03
mov rcx, qword [rbp + 0x78]
jmp 0x180044efe
lea rax, vtable.CHwsFile.0
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x68], 0xf
mov qword [rbp + 0x60], r14
mov byte [rbp + 0x50], 0
mov qword [rbp + 0xb8], 0xf
mov qword [rbp + 0xb0], r14
mov byte [rbp + 0xa0], 0
lea rdx, [rsi + 0x50]
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rbp + 0xa0]
call fcn.180002920
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0xa0]
call fcn.18000f640
test eax, eax
je 0x180043cc7
lea rcx, [rdi + 0x88]
mov r8d, 0xb
lea rdx, [0x18008dbf0]
call fcn.180002a30
mov r8d, 0xc
lea rdx, [0x18008dc28]
lea rcx, [rdi + 8]
call fcn.180002a30
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0x50]
lea rcx, [rdi + 8]
call fcn.18000c770
mov dword [rdi + 0x58], 1
mov dword [rdi + 0xbc], 1
mov qword [rdi + 0xb0], 4
mov dword [rsi + 0x3f8], 1
cmp qword [rbp + 0x68], 0x10
jb 0x180043cb2
mov rcx, qword [rbp + 0x50]
call fcn.180064a00
mov qword [rbp + 0x68], 0xf
mov qword [rbp + 0x60], r14
mov byte [rbp + 0x50], 0
jmp 0x180043bbe
mov r9d, 1
xor r8d, r8d
lea rdx, [0x18008c4cc]
lea rcx, [rsi + 0x190]
call fcn.18000ae20
cmp rax, 0xffffffffffffffff
je 0x180043d94
lea rcx, [rdi + 0x88]
mov r8d, 0xb
lea rdx, [0x18008dbf0]
call fcn.180002a30
mov r8d, 6
lea rdx, [0x18008dc38]
lea rcx, [rdi + 8]
call fcn.180002a30
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsi + 0x190]
lea rcx, [rdi + 8]
call fcn.18000c770
mov r8d, 0xb
lea rdx, [0x18008dc40]
lea rcx, [rdi + 8]
call fcn.18000ab90
mov dword [rdi + 0x58], 1
mov dword [rdi + 0xbc], 1
mov qword [rdi + 0xb0], 4
mov dword [rsi + 0x3f8], 1
cmp qword [rbp + 0x68], 0x10
jb 0x180043d7f
mov rcx, qword [rbp + 0x50]
call fcn.180064a00
mov qword [rbp + 0x68], 0xf
mov qword [rbp + 0x60], r14
mov byte [rbp + 0x50], 0
jmp 0x180043bbe
cmp qword [rbp + 0x68], 0x10
jb 0x180043da4
mov rcx, qword [rbp + 0x50]
call fcn.180064a00
mov qword [rbp + 0x68], 0xf
mov qword [rbp + 0x60], r14
mov byte [rbp + 0x50], 0
cmp qword [rbp + 0x90], 0x10
jb 0x180043dc7
mov rcx, qword [rbp + 0x78]
call fcn.180064a00
cmp dword [r12 + 0x10], 0
je 0x180043f79
mov eax, dword [r12 + 0x14]
test eax, eax
je 0x180043eb3
cmp dword [rsi + 0xd8], eax
jle 0x180043eb3
lea rcx, [rdi + 0x88]
mov r8d, 0xc
lea rdx, [0x18008dc50]
call fcn.180002a30
mov r8d, 0x15
lea rdx, [0x18008dc60]
lea rcx, [rdi + 8]
call fcn.180002a30
mov edx, dword [rsi + 0xd8]
lea rcx, [rbp + 0xa0]
call fcn.180006a80
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rdi + 8]
call fcn.18000c770
nop
cmp qword [rbp + 0xb8], 0x10
jb 0x180043e58
mov rcx, qword [rbp + 0xa0]
call fcn.180064a00
mov r8d, 1
lea rdx, [0x18008bdf0]
lea rcx, [rdi + 8]
call fcn.18000ab90
mov edx, dword [r12 + 0x14]
lea rcx, [rbp + 0xa0]
call fcn.180006a80
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rdi + 8]
call fcn.18000c770
nop
cmp qword [rbp + 0xb8], 0x10
jb 0x180043ac9
mov rcx, qword [rbp + 0xa0]
call fcn.180064a00
jmp 0x180043ac9
mov eax, dword [r12 + 0x18]
test eax, eax
je 0x180043f79
cmp dword [rsi + 0x2a8], eax
jle 0x180043f79
lea rcx, [rdi + 0x88]
mov r8d, 0xc
lea rdx, [0x18008dc50]
call fcn.180002a30
mov r8d, 0x14
lea rdx, str.HTTP
lea rcx, [rdi + 8]
call fcn.180002a30
mov edx, dword [rsi + 0x2a8]
lea rcx, [rbp + 0xa0]
call fcn.1800069c0
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rdi + 8]
call fcn.18000c770
nop
cmp qword [rbp + 0xb8], 0x10
jb 0x180043f38
mov rcx, qword [rbp + 0xa0]
call fcn.180064a00
mov r8d, 1
lea rdx, [0x18008bdf0]
lea rcx, [rdi + 8]
call fcn.18000ab90
mov edx, dword [r12 + 0x18]
lea rcx, [rbp + 0xa0]
call fcn.180006a80
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rdi + 8]
call fcn.18000c770
nop
jmp 0x180043e94
cmp dword [r12 + 0x1c], 0
je 0x180044d2d
cmp dword [r12 + 0x20], 0
je 0x1800443c3
cmp qword [rsi + 0xb0], 0
je 0x1800443c3
mov qword [rsp + 0x60], 0xf
mov qword [rsp + 0x58], r14
mov byte [rsp + 0x48], 0
mov qword [rbp - 0x78], 0xf
mov qword [rbp - 0x80], r14
mov byte [rsp + 0x70], 0
mov qword [rbp - 0x50], 0xf
mov qword [rbp - 0x58], r14
mov byte [rbp - 0x68], 0
mov qword [rbp - 0x28], 0xf
mov qword [rbp - 0x30], r14
mov byte [rbp - 0x40], 0
mov qword [rbp], 0xf
mov qword [rbp - 8], r14
mov byte [rbp - 0x18], 0
mov qword [rbp + 0x40], 0xf
mov qword [rbp + 0x38], r14
mov byte [rbp + 0x28], 0
mov qword [rsp + 0x30], 1
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x3c], 2
mov dword [rsp + 0x40], 2
mov qword [rbp + 0x10], r14
mov qword [rbp + 0x18], r14
mov qword [rbp + 0x20], r14
lea rcx, [0x1800fac90]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsi + 0xa0]
lea rcx, [rbp + 0xa0]
call fcn.18000aa60
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [0x1800facb8]
call fcn.1800150c0
mov ebx, eax
lea rcx, [0x1800fac90]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x1800443b9
lea rcx, [rdi + 0x88]
mov r8d, 0xc
lea rdx, [0x18008dc90]
call fcn.180002a30
mov r8d, 0x15
lea rdx, [0x18008dca0]
lea rcx, [rdi + 8]
call fcn.180002a30
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rdi + 8]
cmp dword [rsp + 0x38], r8d
je 0x180044116
call fcn.18000c770
mov r8d, 1
lea rdx, [0x18008be44]
lea rcx, [rdi + 8]
call fcn.18000ab90
mov edx, dword [rsp + 0x38]
lea rcx, [rbp + 0xa0]
call fcn.1800069c0
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rdi + 8]
call fcn.18000c770
nop
cmp qword [rbp + 0xb8], 0x10
jb 0x18004411b
mov rcx, qword [rbp + 0xa0]
call fcn.180064a00
jmp 0x18004411b
call fcn.18000c770
mov r8d, 2
lea rdx, [0x18008dcb8]
lea rcx, [rdi + 8]
call fcn.18000ab90
mov r9d, 4
xor r8d, r8d
lea rdx, [0x18008dcbc]
lea rcx, [rdi + 8]
call fcn.18000ae20
cmp rax, 0xffffffffffffffff
je 0x1800441f3
mov qword [rbp + 0x68], 0xf
mov qword [rbp + 0x60], r14
mov byte [rbp + 0x50], 0
mov r8d, 2
lea rdx, [0x18008dcc4]
lea rcx, [rbp + 0x50]
call fcn.180002a30
nop
mov qword [rbp + 0x90], 0xf
mov qword [rbp + 0x88], r14
mov byte [rbp + 0x78], 0
mov r8d, 4
lea rdx, [0x18008dcbc]
lea rcx, [rbp + 0x78]
call fcn.180002a30
nop
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0x78]
lea rcx, [rdi + 8]
call fcn.180003cf0
nop
cmp qword [rbp + 0x90], 0x10
jb 0x1800441cd
mov rcx, qword [rbp + 0x78]
call fcn.180064a00
mov qword [rbp + 0x90], 0xf
mov qword [rbp + 0x88], r14
mov byte [rbp + 0x78], 0
cmp qword [rbp + 0x68], 0x10
jb 0x1800441f3
mov rcx, qword [rbp + 0x50]
call fcn.180064a00
mov r9d, 4
xor r8d, r8d
lea rdx, [0x18008dcc8]
lea rcx, [rdi + 8]
call fcn.18000ae20
cmp rax, 0xffffffffffffffff
je 0x1800442b5
mov qword [rbp + 0x68], 0xf
mov qword [rbp + 0x60], r14
mov byte [rbp + 0x50], 0
mov r8d, 2
lea rdx, [0x18008dcb8]
lea rcx, [rbp + 0x50]
call fcn.180002a30
nop
mov qword [rbp + 0x90], 0xf
mov qword [rbp + 0x88], r14
mov byte [rbp + 0x78], 0
mov r8d, 4
lea rdx, [0x18008dcc8]
lea rcx, [rbp + 0x78]
call fcn.180002a30
nop
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0x78]
lea rcx, [rdi + 8]
call fcn.180003cf0
nop
cmp qword [rbp + 0x90], 0x10
jb 0x18004428f
mov rcx, qword [rbp + 0x78]
call fcn.180064a00
mov qword [rbp + 0x90], 0xf
mov qword [rbp + 0x88], r14
mov byte [rbp + 0x78], 0
cmp qword [rbp + 0x68], 0x10
jb 0x1800442b5
mov rcx, qword [rbp + 0x50]
call fcn.180064a00
mov dword [rdi + 0x58], 1
mov dword [rdi + 0xbc], 1
mov eax, dword [rsp + 0x3c]
mov dword [rdi + 0xb0], eax
mov dword [rdi + 0xb4], r14d
mov qword [rbp + 0x90], 0xf
mov qword [rbp + 0x88], r14
mov byte [rbp + 0x78], 0
mov r8d, 6
lea rdx, str.trojan
lea rcx, [rbp + 0x78]
call fcn.180002a30
nop
mov edx, dword [rsp + 0x38]
lea rcx, [rbp + 0x50]
call fcn.180006a80
mov rbx, rax
mov edx, dword [rsi + 0x300]
lea rcx, [rbp + 0xc8]
call fcn.1800069c0
nop
mov r9, rbx
mov r8, rax
lea rdx, [rbp + 0x78]
lea rcx, [0x1800af740]
call fcn.1800553b0
nop
cmp qword [rbp + 0xe0], 0x10
jb 0x180044354
mov rcx, qword [rbp + 0xc8]
call fcn.180064a00
mov qword [rbp + 0xe0], 0xf
mov qword [rbp + 0xd8], r14
mov byte [rbp + 0xc8], 0
cmp qword [rbp + 0x68], 0x10
jb 0x18004437d
mov rcx, qword [rbp + 0x50]
call fcn.180064a00
mov qword [rbp + 0x68], 0xf
mov qword [rbp + 0x60], r14
mov byte [rbp + 0x50], 0
cmp qword [rbp + 0x90], 0x10
jb 0x1800443a0
mov rcx, qword [rbp + 0x78]
call fcn.180064a00
mov dword [rsi + 0x3f8], 1
lea rcx, [rsp + 0x30]
call fcn.180045050
jmp 0x180044f03
lea rcx, [rsp + 0x30]
call fcn.180045050
cmp dword [r12 + 0x24], 0
je 0x180044801
cmp qword [rsi + 0x128], 0
je 0x180044801
mov qword [rsp + 0x60], 0xf
mov qword [rsp + 0x58], r14
mov byte [rsp + 0x48], 0
mov qword [rbp - 0x78], 0xf
mov qword [rbp - 0x80], r14
mov byte [rsp + 0x70], 0
mov qword [rbp - 0x50], 0xf
mov qword [rbp - 0x58], r14
mov byte [rbp - 0x68], 0
mov qword [rbp - 0x28], 0xf
mov qword [rbp - 0x30], r14
mov byte [rbp - 0x40], 0
mov qword [rbp], 0xf
mov qword [rbp - 8], r14
mov byte [rbp - 0x18], 0
mov qword [rbp + 0x40], 0xf
mov qword [rbp + 0x38], r14
mov byte [rbp + 0x28], 0
mov qword [rsp + 0x30], 1
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x3c], 2
mov dword [rsp + 0x40], 2
mov qword [rbp + 0x10], r14
mov qword [rbp + 0x18], r14
mov qword [rbp + 0x20], r14
lea rcx, [0x1800fac90]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsi + 0x118]
lea rcx, [rbp + 0xa0]
call fcn.18000aa60
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [0x1800facb8]
call fcn.1800150c0
mov ebx, eax
lea rcx, [0x1800fac90]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x1800447f7
lea rcx, [rdi + 0x88]
mov r8d, 0xc
lea rdx, [0x18008dc90]
call fcn.180002a30
mov r8d, 0x12
lea rdx, [0x18008dcd8]
lea rcx, [rdi + 8]
call fcn.180002a30
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rdi + 8]
cmp dword [rsp + 0x38], r8d
je 0x180044554
call fcn.18000c770
mov r8d, 1
lea rdx, [0x18008be44]
lea rcx, [rdi + 8]
call fcn.18000ab90
mov edx, dword [rsp + 0x38]
lea rcx, [rbp + 0xa0]
call fcn.1800069c0
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rdi + 8]
call fcn.18000c770
nop
cmp qword [rbp + 0xb8], 0x10
jb 0x180044559
mov rcx, qword [rbp + 0xa0]
call fcn.180064a00
jmp 0x180044559
call fcn.18000c770
mov r8d, 2
lea rdx, [0x18008dcb8]
lea rcx, [rdi + 8]
call fcn.18000ab90
mov r9d, 4
xor r8d, r8d
lea rdx, [0x18008dcbc]
lea rcx, [rdi + 8]
call fcn.18000ae20
cmp rax, 0xffffffffffffffff
je 0x180044631
mov qword [rbp + 0x68], 0xf
mov qword [rbp + 0x60], r14
mov byte [rbp + 0x50], 0
mov r8d, 2
lea rdx, [0x18008dcc4]
lea rcx, [rbp + 0x50]
call fcn.180002a30
nop
mov qword [rbp + 0x90], 0xf
mov qword [rbp + 0x88], r14
mov byte [rbp + 0x78], 0
mov r8d, 4
lea rdx, [0x18008dcbc]
lea rcx, [rbp + 0x78]
call fcn.180002a30
nop
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0x78]
lea rcx, [rdi + 8]
call fcn.180003cf0
nop
cmp qword [rbp + 0x90], 0x10
jb 0x18004460b
mov rcx, qword [rbp + 0x78]
call fcn.180064a00
mov qword [rbp + 0x90], 0xf
mov qword [rbp + 0x88], r14
mov byte [rbp + 0x78], 0
cmp qword [rbp + 0x68], 0x10
jb 0x180044631
mov rcx, qword [rbp + 0x50]
call fcn.180064a00
mov r9d, 4
xor r8d, r8d
lea rdx, [0x18008dcc8]
lea rcx, [rdi + 8]
call fcn.18000ae20
cmp rax, 0xffffffffffffffff
je 0x1800446f3
mov qword [rbp + 0x68], 0xf
mov qword [rbp + 0x60], r14
mov byte [rbp + 0x50], 0
mov r8d, 2
lea rdx, [0x18008dcb8]
lea rcx, [rbp + 0x50]
call fcn.180002a30
nop
mov qword [rbp + 0x90], 0xf
mov qword [rbp + 0x88], r14
mov byte [rbp + 0x78], 0
mov r8d, 4
lea rdx, [0x18008dcc8]
lea rcx, [rbp + 0x78]
call fcn.180002a30
nop
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0x78]
lea rcx, [rdi + 8]
call fcn.180003cf0
nop
cmp qword [rbp + 0x90], 0x10
jb 0x1800446cd
mov rcx, qword [rbp + 0x78]
call fcn.180064a00
mov qword [rbp + 0x90], 0xf
mov qword [rbp + 0x88], r14
mov byte [rbp + 0x78], 0
cmp qword [rbp + 0x68], 0x10
jb 0x1800446f3
mov rcx, qword [rbp + 0x50]
call fcn.180064a00
mov dword [rdi + 0x58], 1
mov dword [rdi + 0xbc], 1
mov eax, dword [rsp + 0x3c]
mov dword [rdi + 0xb0], eax
mov dword [rdi + 0xb4], r14d
mov qword [rbp + 0x90], 0xf
mov qword [rbp + 0x88], r14
mov byte [rbp + 0x78], 0
mov r8d, 6
lea rdx, str.trojan
lea rcx, [rbp + 0x78]
call fcn.180002a30
nop
mov edx, dword [rsp + 0x38]
lea rcx, [rbp + 0x50]
call fcn.180006a80
mov rbx, rax
mov edx, dword [rsi + 0x300]
lea rcx, [rbp + 0xc8]
call fcn.1800069c0
nop
mov r9, rbx
mov r8, rax
lea rdx, [rbp + 0x78]
lea rcx, [0x1800af740]
call fcn.1800553b0
nop
cmp qword [rbp + 0xe0], 0x10
jb 0x180044792
mov rcx, qword [rbp + 0xc8]
call fcn.180064a00
mov qword [rbp + 0xe0], 0xf
mov qword [rbp + 0xd8], r14
mov byte [rbp + 0xc8], 0
cmp qword [rbp + 0x68], 0x10
jb 0x1800447bb
mov rcx, qword [rbp + 0x50]
call fcn.180064a00
mov qword [rbp + 0x68], 0xf
mov qword [rbp + 0x60], r14
mov byte [rbp + 0x50], 0
cmp qword [rbp + 0x90], 0x10
jb 0x1800447de
mov rcx, qword [rbp + 0x78]
call fcn.180064a00
mov dword [rsi + 0x3f8], 1
lea rcx, [rsp + 0x30]
call fcn.180045050
jmp 0x180044f03
lea rcx, [rsp + 0x30]
call fcn.180045050
cmp dword [r12 + 0x28], 0
je 0x180044d2d
cmp qword [rsi + 0x270], 0
je 0x180044d2d
lea rcx, [rsp + 0x30]
call fcn.180043770
nop
lea rcx, [0x1800fac90]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsi + 0x260]
lea rcx, [rbp + 0xa0]
call fcn.18000aa60
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [0x1800facb8]
call fcn.1800150c0
mov ebx, eax
lea rcx, [0x1800fac90]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x180044d23
lea rcx, [rdi + 0x88]
mov r8d, 0xc
lea rdx, [0x18008dc90]
call fcn.180002a30
mov qword [rbp + 0x90], 0xf
mov qword [rbp + 0x88], r14
mov byte [rbp + 0x78], 0
mov r9, qword [rsp + 0x58]
test r9, r9
je 0x18004497a
mov rbx, r14
mov rcx, qword [rsi + 0x290]
sub rcx, qword [rsi + 0x288]
movabs r13, 0x2e8ba2e8ba2e8ba3
mov rax, r13
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x18004497a
mov r12, r14
nop word [rax + rax]
mov rax, qword [rsi + 0x288]
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rdx, qword [rsp + 0x48]
lea rcx, [r12 + rax + 0x30]
xor r8d, r8d
call fcn.18000ae20
cmp rax, 0xffffffffffffffff
jne 0x180044950
inc rbx
add r12, 0x58
mov rcx, qword [rsi + 0x290]
sub rcx, qword [rsi + 0x288]
mov rax, r13
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rbx, rdx
jae 0x180044970
mov r9, qword [rsp + 0x58]
jmp 0x1800448f0
imul rbx, rbx, 0x58
mov rax, qword [rsi + 0x288]
lea rdx, [rbx + rax + 8]
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rbp + 0x78]
call fcn.180002920
cmp qword [rbp + 0x88], 0
jne 0x180044990
mov r8d, 8
lea rdx, [0x18008dcf0]
lea rcx, [rbp + 0x78]
call fcn.180002a30
mov r8d, 0xb
lea rdx, [0x18008dd00]
lea rcx, [rdi + 8]
call fcn.180002a30
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0x78]
lea rcx, [rdi + 8]
call fcn.18000c770
mov r8d, 0xf
lea rdx, [0x18008dd10]
lea rcx, [rdi + 8]
call fcn.18000ab90
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rdi + 8]
cmp dword [rsp + 0x38], r8d
je 0x180044a3f
call fcn.18000c770
mov r8d, 1
lea rdx, [0x18008be44]
lea rcx, [rdi + 8]
call fcn.18000ab90
mov edx, dword [rsp + 0x38]
lea rcx, [rbp + 0xa0]
call fcn.1800069c0
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rdi + 8]
call fcn.18000c770
nop
cmp qword [rbp + 0xb8], 0x10
jb 0x180044a44
mov rcx, qword [rbp + 0xa0]
call fcn.180064a00
jmp 0x180044a44
call fcn.18000c770
mov r8d, 2
lea rdx, [0x18008dcb8]
lea rcx, [rdi + 8]
call fcn.18000ab90
mov r9d, 4
xor r8d, r8d
lea rdx, [0x18008dcbc]
lea rcx, [rdi + 8]
call fcn.18000ae20
cmp rax, 0xffffffffffffffff
je 0x180044b22
mov qword [rbp + 0xe0], 0xf
mov qword [rbp + 0xd8], r14
mov byte [rbp + 0xc8], 0
mov r8d, 2
lea rdx, [0x18008dcc4]
lea rcx, [rbp + 0xc8]
call fcn.180002a30
nop
mov qword [rbp + 0x68], 0xf
mov qword [rbp + 0x60], r14
mov byte [rbp + 0x50], 0
mov r8d, 4
lea rdx, [0x18008dcbc]
lea rcx, [rbp + 0x50]
call fcn.180002a30
nop
lea r8, [rbp + 0xc8]
lea rdx, [rbp + 0x50]
lea rcx, [rdi + 8]
call fcn.180003cf0
nop
cmp qword [rbp + 0x68], 0x10
jb 0x180044afc
mov rcx, qword [rbp + 0x50]
call fcn.180064a00
mov qword [rbp + 0x68], 0xf
mov qword [rbp + 0x60], r14
mov byte [rbp + 0x50], 0
cmp qword [rbp + 0xe0], 0x10
jb 0x180044b22
mov rcx, qword [rbp + 0xc8]
call fcn.180064a00
mov r9d, 4
xor r8d, r8d
lea rdx, [0x18008dcc8]
lea rcx, [rdi + 8]
call fcn.18000ae20
cmp rax, 0xffffffffffffffff
je 0x180044bea
mov qword [rbp + 0xe0], 0xf
mov qword [rbp + 0xd8], r14
mov byte [rbp + 0xc8], 0
mov r8d, 2
lea rdx, [0x18008dcb8]
lea rcx, [rbp + 0xc8]
call fcn.180002a30
nop
mov qword [rbp + 0x68], 0xf
mov qword [rbp + 0x60], r14
mov byte [rbp + 0x50], 0
mov r8d, 4
lea rdx, [0x18008dcc8]
lea rcx, [rbp + 0x50]
call fcn.180002a30
nop
lea r8, [rbp + 0xc8]
lea rdx, [rbp + 0x50]
lea rcx, [rdi + 8]
call fcn.180003cf0
nop
cmp qword [rbp + 0x68], 0x10
jb 0x180044bc4
mov rcx, qword [rbp + 0x50]
call fcn.180064a00
mov qword [rbp + 0x68], 0xf
mov qword [rbp + 0x60], r14
mov byte [rbp + 0x50], 0
cmp qword [rbp + 0xe0], 0x10
jb 0x180044bea
mov rcx, qword [rbp + 0xc8]
call fcn.180064a00
mov dword [rdi + 0x58], 1
mov dword [rdi + 0xbc], 1
mov eax, dword [rsp + 0x3c]
mov dword [rdi + 0xb0], eax
mov dword [rdi + 0xb4], r14d
mov qword [rbp + 0xe0], 0xf
mov qword [rbp + 0xd8], r14
mov byte [rbp + 0xc8], 0
mov r8d, 6
lea rdx, str.trojan
lea rcx, [rbp + 0xc8]
call fcn.180002a30
nop
mov edx, dword [rsp + 0x38]
lea rcx, [rbp + 0xa0]
call fcn.180006a80
mov rbx, rax
mov edx, dword [rsi + 0x300]
lea rcx, [rbp + 0x50]
call fcn.1800069c0
nop
mov r9, rbx
mov r8, rax
lea rdx, [rbp + 0xc8]
lea rcx, [0x1800af740]
call fcn.1800553b0
nop
cmp qword [rbp + 0x68], 0x10
jb 0x180044c8c
mov rcx, qword [rbp + 0x50]
call fcn.180064a00
mov qword [rbp + 0x68], 0xf
mov qword [rbp + 0x60], r14
mov byte [rbp + 0x50], 0
cmp qword [rbp + 0xb8], 0x10
jb 0x180044cb2
mov rcx, qword [rbp + 0xa0]
call fcn.180064a00
mov qword [rbp + 0xb8], 0xf
mov qword [rbp + 0xb0], r14
mov byte [rbp + 0xa0], 0
cmp qword [rbp + 0xe0], 0x10
jb 0x180044ce1
mov rcx, qword [rbp + 0xc8]
call fcn.180064a00
mov dword [rsi + 0x3f8], 1
cmp qword [rbp + 0x90], 0x10
jb 0x180044cfe
mov rcx, qword [rbp + 0x78]
call fcn.180064a00
mov qword [rbp + 0x90], 0xf
mov qword [rbp + 0x88], r14
mov byte [rbp + 0x78], 0
lea rcx, [rsp + 0x30]
call fcn.180045050
jmp 0x180044f03
lea rcx, [rsp + 0x30]
call fcn.180045050
cmp dword [r12 + 0x50], 0
je 0x180044ef6
cmp dword [r12 + 0x54], 0
je 0x180044e26
cmp dword [rsi + 0x334], 0
je 0x180044e26
lea rcx, [rdi + 0x88]
mov r8d, 0xc
lea rdx, [0x18008dd20]
call fcn.180002a30
mov r8d, 0x10
lea rdx, [0x18008dd30]
lea rcx, [rdi + 8]
call fcn.180002a30
cmp qword [rsi + 0x350], 0
je 0x180044db8
mov r8d, 0xa
lea rdx, [0x18008dd48]
lea rcx, [rdi + 8]
call fcn.18000ab90
lea rdx, [rsi + 0x340]
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rdi + 8]
call fcn.18000c770
cmp qword [rsi + 0x368], 0
je 0x180044e16
mov r8d, 8
lea rdx, [0x18008dd58]
lea rcx, [rdi + 8]
call fcn.18000ab90
mov rdx, qword [rsi + 0x368]
lea rcx, [rbp + 0xa0]
call fcn.180004da0
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rdi + 8]
call fcn.18000c770
nop
cmp qword [rbp + 0xb8], 0x10
jb 0x180044e16
mov rcx, qword [rbp + 0xa0]
call fcn.180064a00
mov qword [rdi + 0xb0], 2
jmp 0x180043ad4
cmp dword [r12 + 0x58], 0
je 0x180044ef6
cmp dword [rsi + 0x338], 0
je 0x180044ef6
lea rcx, [rdi + 0x88]
mov r8d, 0xc
lea rdx, [0x18008dd20]
call fcn.180002a30
mov r8d, 0x12
lea rdx, [0x18008dd68]
lea rcx, [rdi + 8]
call fcn.180002a30
cmp qword [rsi + 0x350], 0
je 0x180044ea5
mov r8d, 0xa
lea rdx, [0x18008dd48]
lea rcx, [rdi + 8]
call fcn.18000ab90
lea rdx, [rsi + 0x340]
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rdi + 8]
call fcn.18000c770
cmp qword [rsi + 0x368], 0
je 0x180044e16
mov r8d, 8
lea rdx, [0x18008dd58]
lea rcx, [rdi + 8]
call fcn.18000ab90
mov rdx, qword [rsi + 0x368]
lea rcx, [rbp + 0xa0]
call fcn.180004da0
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rdi + 8]
call fcn.18000c770
nop
jmp 0x180044e00
mov dword [rdi], r14d
jmp 0x18004501b
call fcn.180064a00
lea rcx, [rdi + 0x60]
mov r8d, 8
lea rdx, [0x18008dd80]
call fcn.180002a30
mov qword [rbp + 0xe0], 0xf
mov qword [rbp + 0xd8], r14
mov byte [rbp + 0xc8], 0
mov r8d, 1
lea rdx, [0x18008be44]
lea rcx, [rbp + 0xc8]
call fcn.180002a30
nop
mov qword [rbp + 0x90], 0xf
mov qword [rbp + 0x88], r14
mov byte [rbp + 0x78], 0
mov r8d, 6
lea rdx, str.invade
lea rcx, [rbp + 0x78]
call fcn.180002a30
nop
mov edx, dword [rsi + 0x300]
lea rcx, [rbp + 0xa0]
call fcn.1800069c0
nop
lea r9, [rbp + 0xc8]
mov r8, rax
lea rdx, [rbp + 0x78]
lea rcx, [0x1800af740]
call fcn.1800553b0
nop
cmp qword [rbp + 0xb8], 0x10
jb 0x180044fbd
mov rcx, qword [rbp + 0xa0]
call fcn.180064a00
mov qword [rbp + 0xb8], 0xf
mov qword [rbp + 0xb0], r14
mov byte [rbp + 0xa0], 0
cmp qword [rbp + 0x90], 0x10
jb 0x180044fe9
mov rcx, qword [rbp + 0x78]
call fcn.180064a00
mov qword [rbp + 0x90], 0xf
mov qword [rbp + 0x88], r14
mov byte [rbp + 0x78], 0
cmp qword [rbp + 0xe0], 0x10
jb 0x180045015
mov rcx, qword [rbp + 0xc8]
call fcn.180064a00
mov dword [rdi], 2
mov eax, 1
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.1800649e0
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret