Function at 0x1801470b0
Capabilities:
Resolve function by parsing pe exports
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rbx
push rdi
lea rbp, [rax - 0x118]
sub rsp, 0x200
movaps xmmword [rax - 0x38], xmm6
mov rdi, rcx
movaps xmmword [rax - 0x48], xmm7
call fcn.18014ab60
mov edx, eax
lea rcx, [rbp - 0x80]
call fcn.180001140
lea rdx, [rbp - 0x60]
mov dword [rbp - 0x60], 0xc44b8cc3
lea rcx, [rsp + 0x48]
mov dword [rbp - 0x5c], 0x717f9328
mov dword [rbp - 0x58], 0xfd45b564
movups xmm6, xmmword [rax]
mov dword [rbp - 0x54], 0xdf262cb5
movsd xmm7, qword [rax + 0x10]
mov eax, 0x2848
mov word [rbp - 0x48], ax
xor eax, eax
mov dword [rbp - 0x46], eax
mov word [rbp - 0x42], ax
movabs rax, 0xf5d06b73146ce1d
mov qword [rbp - 0x40], rax
movabs rax, 0xd0558573caa30d2a
mov qword [rbp - 0x38], rax
movabs rax, 0x38acc74ef4807902
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x50], 0x9083207a
mov dword [rbp - 0x4c], 0x6bac8b1c
call fcn.180004f90
lea rcx, [rbp + 0xa0]
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xa0], xmm0
movsd xmm1, qword [rax + 0x10]
movsd qword [rbp + 0xb0], xmm1
mov eax, dword [rax + 0x18]
mov dword [rbp + 0xb8], eax
call fcn.18014a9e0
lea r8, [rbp - 0x80]
mov dword [rsp + 0x30], 0x80847b4e
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], 0x7367bbe1
lea rcx, [rbp - 0x18]
mov dword [rsp + 0x38], 0x4f9267fb
mov rbx, rax
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.1800051a0
lea rdx, [rbp]
movsd xmm0, qword [rax]
movsd qword [rbp], xmm0
mov ecx, dword [rax + 8]
mov dword [rbp + 8], ecx
mov rcx, rbx
movzx eax, byte [rax + 0xc]
mov byte [rbp + 0xc], al
call fcn.18014a820
mov qword [rdi], rax
test rax, rax
jne 0x1801472d1
movdqa xmm0, xmmword [0x1801609f0]
movabs rax, 0xfb15fb380cc1731b
movdqa xmm1, xmmword [0x180161340]
mov qword [rbp - 0x30], rax
movabs rax, 0xd0ee5698be9b211a
mov qword [rbp - 0x28], rax
movabs rax, 0x2952731b0b374a25
movdqu xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x180160690]
lea rdx, [rbp - 0x60]
mov qword [rbp - 0x20], rax
lea rcx, [rbp + 0xa0]
movdqu xmmword [rbp - 0x40], xmm0
movdqu xmmword [rbp - 0x50], xmm1
call fcn.180005380
lea r9, [0x18015eb18]
movups xmm0, xmmword [rax]
lea r8, [rsp + 0x48]
mov edx, 0x100000
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
movsd xmm0, qword [rax + 0x20]
movsd qword [rsp + 0x68], xmm0
mov ecx, dword [rax + 0x28]
mov dword [rsp + 0x70], ecx
movzx ecx, word [rax + 0x2c]
mov word [rsp + 0x74], cx
lea rcx, [0x18017bd90]
movzx eax, byte [rax + 0x2e]
mov byte [rsp + 0x76], al
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
jmp 0x18014a7f1
movdqa xmm0, xmmword [0x1801622b0]
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x60]
mov dword [rbp + 0x70], 0x86c7334b
lea rcx, [rbp + 0x80]
mov dword [rbp + 0x74], 0x3ddf2f89
movdqu xmmword [rbp + 0x60], xmm0
mov byte [rbp + 0x78], 0x5d
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.180005720
lea rdx, [rbp + 0x40]
mov rcx, rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x40], xmm0
movsd xmm1, qword [rax + 0x10]
movsd qword [rbp + 0x50], xmm1
movzx eax, word [rax + 0x18]
mov word [rbp + 0x58], ax
call fcn.18014a820
mov qword [rdi + 0xe0], rax
test rax, rax
jne 0x1801473ab
movdqa xmm0, xmmword [0x1801609f0]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180161340]
lea rcx, [rbp + 0xa0]
movabs rax, 0xfb15fb380cc1731b
mov qword [rbp - 0x30], rax
movabs rax, 0xd0ee5698be9b211a
mov qword [rbp - 0x28], rax
movabs rax, 0x2952731b0b374a25
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160690]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.CreateToolhelp32Snapshot
jmp 0x180147253
movdqa xmm0, xmmword [0x1801618d0]
lea r8, [rbp + 0x60]
lea rdx, [rbp - 0x80]
mov dword [rbp - 0x70], 0x94c7346a
lea rcx, [rbp + 0x80]
mov dword [rbp - 0x6c], 0x49e72296
movdqu xmmword [rbp - 0x80], xmm0
movaps xmmword [rbp + 0x60], xmm6
movsd qword [rbp + 0x70], xmm7
call fcn.180005ac0
lea rdx, [rbp + 0x40]
mov rcx, rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x40], xmm0
movsd xmm1, qword [rax + 0x10]
movsd qword [rbp + 0x50], xmm1
movzx eax, byte [rax + 0x18]
mov byte [rbp + 0x58], al
call fcn.18014a820
mov qword [rdi + 0x18], rax
test rax, rax
jne 0x18014747d
movdqa xmm0, xmmword [0x1801620f0]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180162660]
lea rcx, [rbp + 0xa0]
movabs rax, 0xa8ce5db91a41f821
mov qword [rbp - 0x30], rax
movabs rax, 0x4cf0187ec878f74a
mov qword [rbp - 0x28], rax
movabs rax, 0x894524daef82810d
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160770]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.GetEnvironmentVariableW
jmp 0x180147253
movdqa xmm0, xmmword [0x1801618e0]
lea r8, [rbp + 0x60]
lea rdx, [rbp - 0x80]
mov dword [rbp - 0x70], 0x94c7346a
lea rcx, [rbp + 0x80]
mov dword [rbp - 0x6c], 0x49e72296
movdqu xmmword [rbp - 0x80], xmm0
movaps xmmword [rbp + 0x60], xmm6
movsd qword [rbp + 0x70], xmm7
call fcn.180005ac0
lea rdx, [rbp + 0x40]
mov rcx, rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x40], xmm0
movsd xmm1, qword [rax + 0x10]
movsd qword [rbp + 0x50], xmm1
movzx eax, byte [rax + 0x18]
mov byte [rbp + 0x58], al
call fcn.18014a820
mov qword [rdi + 0x20], rax
test rax, rax
jne 0x18014754f
movdqa xmm0, xmmword [0x1801620f0]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180162660]
lea rcx, [rbp + 0xa0]
movabs rax, 0xa8ce5db91a41f821
mov qword [rbp - 0x30], rax
movabs rax, 0x4cf0187ec878f74a
mov qword [rbp - 0x28], rax
movabs rax, 0x894524daef82810d
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160770]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, [0x18015eb60]
jmp 0x180147253
movdqa xmm0, xmmword [0x180161a50]
lea r8, [rbp + 0x80]
lea rdx, [rbp - 0x80]
mov dword [rbp - 0x70], 0x93cb344c
lea rcx, [rbp + 0x40]
mov byte [rbp - 0x6c], 0xfa
movdqu xmmword [rbp - 0x80], xmm0
movaps xmmword [rbp + 0x80], xmm6
movsd qword [rbp + 0x90], xmm7
call fcn.180005e40
lea rdx, [rbp + 0x60]
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x60], xmm0
mov ecx, dword [rax + 0x10]
mov dword [rbp + 0x70], ecx
mov rcx, rbx
movzx eax, word [rax + 0x14]
mov word [rbp + 0x74], ax
call fcn.18014a820
mov qword [rdi + 0x10], rax
test rax, rax
jne 0x180147621
movdqa xmm0, xmmword [0x180160e80]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180162240]
lea rcx, [rbp + 0xa0]
movabs rax, 0x4863e3ae9c06d2f
mov qword [rbp - 0x30], rax
movabs rax, 0x89f458adbf827efa
mov qword [rbp - 0x28], rax
movabs rax, 0x65b9bd3f516b1d6
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160820]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, [0x18015eb78]
jmp 0x180147253
lea r8, [rbp - 0x80]
mov dword [rsp + 0x30], 0x80847b4e
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], 0x7367bbe1
lea rcx, [rbp - 0x18]
mov dword [rsp + 0x38], 0x4f9267fb
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.1800051a0
lea rdx, [rbp]
movsd xmm0, qword [rax]
movsd qword [rbp], xmm0
mov ecx, dword [rax + 8]
mov dword [rbp + 8], ecx
mov rcx, rbx
movzx eax, byte [rax + 0xc]
mov byte [rbp + 0xc], al
call fcn.18014a820
mov qword [rdi], rax
test rax, rax
jne 0x1801476c6
movdqa xmm0, xmmword [0x180160e80]
movabs rax, 0x4863e3ae9c06d2f
movdqa xmm1, xmmword [0x180162240]
mov qword [rbp - 0x30], rax
movabs rax, 0x89f458adbf827efa
mov qword [rbp - 0x28], rax
movabs rax, 0x65b9bd3f516b1d6
movdqu xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x180160820]
jmp 0x18014722e
lea r8, [rbp - 0x80]
mov dword [rsp + 0x30], 0x80847b4e
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], 0x7367bbe1
lea rcx, [rbp - 0x18]
mov dword [rsp + 0x38], 0x4f8467fb
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.1800051a0
lea rdx, [rbp]
movsd xmm0, qword [rax]
movsd qword [rbp], xmm0
mov ecx, dword [rax + 8]
mov dword [rbp + 8], ecx
mov rcx, rbx
movzx eax, byte [rax + 0xc]
mov byte [rbp + 0xc], al
call fcn.18014a820
mov qword [rdi + 8], rax
test rax, rax
jne 0x180147791
movdqa xmm0, xmmword [0x180162120]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180160b80]
lea rcx, [rbp + 0xa0]
movabs rax, 0x28c0569f668d68fb
mov qword [rbp - 0x30], rax
movabs rax, 0x3654fe971cbf77e
mov qword [rbp - 0x28], rax
movabs rax, 0x925f15ff8f81bd95
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x1801606c0]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, [0x18015eb90]
jmp 0x180147253
lea r8, [rbp - 0x80]
mov dword [rsp + 0x30], 0x81897146
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], 0x7552bbc7
lea rcx, [rbp - 0x18]
mov dword [rsp + 0x38], 0x2ab070e2
mov byte [rsp + 0x3c], 0x43
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.180006150
lea rdx, [rbp]
movsd xmm0, qword [rax]
movsd qword [rbp], xmm0
mov ecx, dword [rax + 8]
mov dword [rbp + 8], ecx
mov rcx, rbx
movzx eax, word [rax + 0xc]
mov word [rbp + 0xc], ax
call fcn.18014a820
mov qword [rdi + 0x28], rax
test rax, rax
jne 0x180147862
movdqa xmm0, xmmword [0x180162120]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180160b80]
lea rcx, [rbp + 0xa0]
movabs rax, 0x28c0569f668d68fb
mov qword [rbp - 0x30], rax
movabs rax, 0x3654fe971cbf77e
mov qword [rbp - 0x28], rax
movabs rax, 0x925f15ff8f81bd95
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x1801606c0]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.LoadResource
jmp 0x180147253
lea r8, [rbp - 0x80]
mov dword [rsp + 0x30], 0x8186774c
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], 0x7552bbc7
lea rcx, [rbp - 0x18]
mov dword [rsp + 0x38], 0x2ab070e2
mov word [rsp + 0x3c], 0x3314
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.180006350
lea rdx, [rbp]
movsd xmm0, qword [rax]
movsd qword [rbp], xmm0
mov ecx, dword [rax + 8]
mov dword [rbp + 8], ecx
movzx ecx, word [rax + 0xc]
mov word [rbp + 0xc], cx
mov rcx, rbx
movzx eax, byte [rax + 0xe]
mov byte [rbp + 0xe], al
call fcn.18014a820
mov qword [rdi + 0x30], rax
test rax, rax
jne 0x18014793c
movdqa xmm0, xmmword [0x1801624e0]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180160c10]
lea rcx, [rbp + 0xa0]
movabs rax, 0x7439f41e740dfff1
mov qword [rbp - 0x30], rax
movabs rax, 0xf3d756d87b7191be
mov qword [rbp - 0x28], rax
movabs rax, 0x4b25c06201070021
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160750]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.FindResourceW
jmp 0x180147253
lea r8, [rbp - 0x80]
mov dword [rsp + 0x30], 0x80927759
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], 0x7f73b8fa
lea rcx, [rbp + 0x80]
mov dword [rsp + 0x38], 0x3da66de4
mov word [rsp + 0x3c], 0x5620
mov byte [rsp + 0x3e], 0x43
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.180006570
lea rdx, [rbp + 0x20]
mov rcx, rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
call fcn.18014a820
mov qword [rdi + 0x38], rax
test rax, rax
jne 0x180147a07
movdqa xmm0, xmmword [0x1801624e0]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180160c10]
lea rcx, [rbp + 0xa0]
movabs rax, 0x7439f41e740dfff1
mov qword [rbp - 0x30], rax
movabs rax, 0xf3d756d87b7191be
mov qword [rbp - 0x28], rax
movabs rax, 0x4b25c06201070021
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160750]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.SizeofResource
jmp 0x180147253
lea r8, [rbp - 0x80]
mov dword [rsp + 0x30], 0x81897146
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], 0x6843b7d9
lea rcx, [rbp - 0x18]
mov dword [rsp + 0x38], 0x18aa70f6
mov byte [rsp + 0x3c], 0x43
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.180006150
lea rdx, [rbp]
movsd xmm0, qword [rax]
movsd qword [rbp], xmm0
mov ecx, dword [rax + 8]
mov dword [rbp + 8], ecx
mov rcx, rbx
movzx eax, word [rax + 0xc]
mov word [rbp + 0xc], ax
call fcn.18014a820
mov qword [rdi + 0x40], rax
test rax, rax
jne 0x180147ad8
movdqa xmm0, xmmword [0x180161290]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x1801621f0]
lea rcx, [rbp + 0xa0]
movabs rax, 0x80710991498a42f7
mov qword [rbp - 0x30], rax
movabs rax, 0x5e887a845109cb36
mov qword [rbp - 0x28], rax
movabs rax, 0x478b46f794344230
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160630]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, [0x18015ebd0]
jmp 0x180147253
lea r8, [rbp - 0x80]
mov dword [rsp + 0x30], 0x808d6c4c
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], 0x6843b7d9
lea rcx, [rbp - 0x18]
mov dword [rsp + 0x38], 0x4faa70f6
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.1800051a0
lea rdx, [rbp]
movsd xmm0, qword [rax]
movsd qword [rbp], xmm0
mov ecx, dword [rax + 8]
mov dword [rbp + 8], ecx
mov rcx, rbx
movzx eax, byte [rax + 0xc]
mov byte [rbp + 0xc], al
call fcn.18014a820
mov qword [rdi + 0x48], rax
test rax, rax
jne 0x180147ba3
movdqa xmm0, xmmword [0x180161290]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x1801621f0]
lea rcx, [rbp + 0xa0]
movabs rax, 0x80710991498a42f7
mov qword [rbp - 0x30], rax
movabs rax, 0x5e887a845109cb36
mov qword [rbp - 0x28], rax
movabs rax, 0x478b46f794344230
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160630]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, [0x18015ebe0]
jmp 0x180147253
lea r8, [rbp - 0x80]
mov dword [rsp + 0x30], 0x8e8b7146
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], 0x7552bbc7
lea rcx, [rbp - 0x18]
mov dword [rsp + 0x38], 0x2ab070e2
mov byte [rsp + 0x3c], 0x43
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.180006150
lea rdx, [rbp]
movsd xmm0, qword [rax]
movsd qword [rbp], xmm0
mov ecx, dword [rax + 8]
mov dword [rbp + 8], ecx
mov rcx, rbx
movzx eax, word [rax + 0xc]
mov word [rbp + 0xc], ax
call fcn.18014a820
mov qword [rdi + 0x50], rax
test rax, rax
jne 0x180147c74
movdqa xmm0, xmmword [0x1801624a0]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180160da0]
lea rcx, [rbp + 0xa0]
movabs rax, 0xd3aaaf105f0ac9cd
mov qword [rbp - 0x30], rax
movabs rax, 0x25d65657171a4e76
mov qword [rbp - 0x28], rax
movabs rax, 0xab35ba060cebd937
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x1801607e0]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.LockResource
jmp 0x180147253
movdqa xmm0, xmmword [0x180161b90]
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x40]
mov byte [rbp + 0x50], 0x18
lea rcx, [rbp + 0x20]
movaps xmmword [rbp - 0x80], xmm6
movdqu xmmword [rbp + 0x40], xmm0
movsd qword [rbp - 0x70], xmm7
call fcn.1800067b0
lea rdx, [rbp + 0x80]
mov rcx, rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x80], xmm0
movzx eax, word [rax + 0x10]
mov word [rbp + 0x90], ax
call fcn.18014a820
mov qword [rdi + 0x58], rax
test rax, rax
jne 0x180147d39
movdqa xmm0, xmmword [0x1801624a0]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180160da0]
lea rcx, [rbp + 0xa0]
movabs rax, 0xd3aaaf105f0ac9cd
mov qword [rbp - 0x30], rax
movabs rax, 0x25d65657171a4e76
mov qword [rbp - 0x28], rax
movabs rax, 0xab35ba060cebd937
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x1801607e0]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, [0x18015ec00]
jmp 0x180147253
lea r8, [rbp - 0x80]
mov dword [rsp + 0x30], 0x8b8d6e45
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], 0x794eacc5
lea rcx, [rbp - 0x18]
mov dword [rsp + 0x38], 0x4fa071f2
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.1800051a0
lea rdx, [rbp]
movsd xmm0, qword [rax]
movsd qword [rbp], xmm0
mov ecx, dword [rax + 8]
mov dword [rbp + 8], ecx
mov rcx, rbx
movzx eax, byte [rax + 0xc]
mov byte [rbp + 0xc], al
call fcn.18014a820
mov qword [rdi + 0x60], rax
test rax, rax
jne 0x180147e04
movdqa xmm0, xmmword [0x180161d50]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180162150]
lea rcx, [rbp + 0xa0]
movabs rax, 0x7fe2cc93ac8b5cc3
mov qword [rbp - 0x30], rax
movabs rax, 0x5adaa15a62a8694e
mov qword [rbp - 0x28], rax
movabs rax, 0x66a0b7e73e3df300
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x1801606f0]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.OpenProcess
jmp 0x180147253
lea r8, [rbp - 0x80]
mov dword [rsp + 0x30], 0x848d6c49
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], 0x6871bbe1
lea rcx, [rbp + 0x80]
mov dword [rsp + 0x38], 0x3cb661f8
mov word [rsp + 0x3c], 0x6430
mov byte [rsp + 0x3e], 0x43
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.180006570
lea rdx, [rbp + 0x20]
mov rcx, rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
call fcn.18014a820
mov qword [rdi + 0x68], rax
test rax, rax
jne 0x180147ecf
movdqa xmm0, xmmword [0x180161d50]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180162150]
lea rcx, [rbp + 0xa0]
movabs rax, 0x7fe2cc93ac8b5cc3
mov qword [rbp - 0x30], rax
movabs rax, 0x5adaa15a62a8694e
mov qword [rbp - 0x28], rax
movabs rax, 0x66a0b7e73e3df300
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x1801606f0]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.CreateProcessW
jmp 0x180147253
lea r8, [rbp - 0x80]
mov dword [rsp + 0x30], 0x8186774c
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], 0x6953b7d3
lea rcx, [rbp + 0x80]
mov dword [rsp + 0x38], 0x23ba44e3
mov word [rsp + 0x3c], 0x6426
mov byte [rsp + 0x3e], 0x43
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.180006570
lea rdx, [rbp + 0x20]
mov rcx, rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
call fcn.18014a820
mov qword [rdi + 0x70], rax
test rax, rax
jne 0x180147f9a
movdqa xmm0, xmmword [0x180160b50]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180161e70]
lea rcx, [rbp + 0xa0]
movabs rax, 0x7439f41e740dfff1
mov qword [rbp - 0x30], rax
movabs rax, 0xae784d7351ac5bec
mov qword [rbp - 0x28], rax
movabs rax, 0x251547f5b6ad0ca8
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160620]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.FindFirstFileW
jmp 0x180147253
lea r8, [rbp - 0x80]
mov dword [rsp + 0x30], 0x8186774c
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], 0x6e59bbdb
lea rcx, [rbp - 0x18]
mov dword [rsp + 0x38], 0x2abf6bd1
mov word [rsp + 0x3c], 0x3314
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.180006350
lea rdx, [rbp]
movsd xmm0, qword [rax]
movsd qword [rbp], xmm0
mov ecx, dword [rax + 8]
mov dword [rbp + 8], ecx
movzx ecx, word [rax + 0xc]
mov word [rbp + 0xc], cx
mov rcx, rbx
movzx eax, byte [rax + 0xe]
mov byte [rbp + 0xe], al
call fcn.18014a820
mov qword [rdi + 0x78], rax
test rax, rax
jne 0x180148074
movdqa xmm0, xmmword [0x180160b50]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180161e70]
lea rcx, [rbp + 0xa0]
movabs rax, 0x7439f41e740dfff1
mov qword [rbp - 0x30], rax
movabs rax, 0xae784d7351ac5bec
mov qword [rbp - 0x28], rax
movabs rax, 0x251547f5b6ad0ca8
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160620]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, [0x18015ec48]
jmp 0x180147253
lea r8, [rbp - 0x80]
mov dword [rbp - 0x18], 0x8186774c
lea rdx, [rbp - 0x18]
mov dword [rbp - 0x14], 0x694eb2d6
lea rcx, [rbp]
mov word [rbp - 0x10], 0x2f2
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.180006a40
lea rdx, [rsp + 0x30]
movsd xmm0, qword [rax]
movsd qword [rsp + 0x30], xmm0
movzx ecx, word [rax + 8]
mov word [rsp + 0x38], cx
mov rcx, rbx
movzx eax, byte [rax + 0xa]
mov byte [rsp + 0x3a], al
call fcn.18014a820
mov qword [rdi + 0x80], rax
test rax, rax
jne 0x180148143
movdqa xmm0, xmmword [0x180161160]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180161a30]
lea rcx, [rbp + 0xa0]
movabs rax, 0x28c0569f668d68fb
mov qword [rbp - 0x30], rax
movabs rax, 0xaee67e61023f00f0
mov qword [rbp - 0x28], rax
movabs rax, 0x3ea57114e1337e28
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160600]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, [0x18015ec58]
jmp 0x180147253
lea r8, [rbp - 0x80]
mov dword [rsp + 0x30], 0xa39c7b4d
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], 0x4944b2fc
lea rcx, [rbp - 0x18]
mov dword [rsp + 0x38], 0x4fb678fe
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.1800051a0
lea rdx, [rbp]
movsd xmm0, qword [rax]
movsd qword [rbp], xmm0
mov ecx, dword [rax + 8]
mov dword [rbp + 8], ecx
mov rcx, rbx
movzx eax, byte [rax + 0xc]
mov byte [rbp + 0xc], al
call fcn.18014a820
mov qword [rdi + 0x88], rax
test rax, rax
jne 0x180148211
movdqa xmm0, xmmword [0x180161160]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180161a30]
lea rcx, [rbp + 0xa0]
movabs rax, 0x28c0569f668d68fb
mov qword [rbp - 0x30], rax
movabs rax, 0xaee67e61023f00f0
mov qword [rbp - 0x28], rax
movabs rax, 0x3ea57114e1337e28
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160600]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, [0x18015ec68]
jmp 0x180147253
lea r8, [rbp - 0x80]
mov dword [rsp + 0x30], 0x848d6c49
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], 0x7367bbe1
lea rcx, [rbp - 0x18]
mov dword [rsp + 0x38], 0x4f8467fb
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.1800051a0
lea rdx, [rbp]
movsd xmm0, qword [rax]
movsd qword [rbp], xmm0
mov ecx, dword [rax + 8]
mov dword [rbp + 8], ecx
mov rcx, rbx
movzx eax, byte [rax + 0xc]
mov byte [rbp + 0xc], al
call fcn.18014a820
mov qword [rdi + 0x90], rax
test rax, rax
jne 0x1801482df
movdqa xmm0, xmmword [0x180162190]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180161a60]
lea rcx, [rbp + 0xa0]
movabs rax, 0xdc88ab105b0ad5fd
mov qword [rbp - 0x30], rax
movabs rax, 0x50fd89a2e86dc9d4
mov qword [rbp - 0x28], rax
movabs rax, 0x3d73c78d57f0655f
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160810]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, [0x18015ec78]
jmp 0x180147253
lea r8, [rbp - 0x80]
mov dword [rbp - 0x18], 0x81897b58
lea rdx, [rbp - 0x18]
mov dword [rbp - 0x14], 0x7f4db7d3
lea rcx, [rsp + 0x30]
mov byte [rbp - 0x10], 0x97
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.180006bd0
lea rdx, [rbp]
mov rcx, rbx
movsd xmm0, qword [rax]
movsd qword [rbp], xmm0
movzx eax, word [rax + 8]
mov word [rbp + 8], ax
call fcn.18014a820
mov qword [rdi + 0x98], rax
test rax, rax
jne 0x1801483a2
movdqa xmm0, xmmword [0x180162190]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180161a60]
lea rcx, [rbp + 0xa0]
movabs rax, 0xdc88ab105b0ad5fd
mov qword [rbp - 0x30], rax
movabs rax, 0x50fd89a2e86dc9d4
mov qword [rbp - 0x28], rax
movabs rax, 0x3d73c78d57f0655f
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160810]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, [0x18015ec88]
jmp 0x180147253
lea r8, [rbp - 0x80]
mov dword [rbp - 0x18], 0x91816c5d
lea rdx, [rbp - 0x18]
mov dword [rbp - 0x14], 0x764898f0
lea rcx, [rbp]
mov word [rbp - 0x10], 0x2f2
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.180006a40
lea rdx, [rsp + 0x30]
movsd xmm0, qword [rax]
movsd qword [rsp + 0x30], xmm0
movzx ecx, word [rax + 8]
mov word [rsp + 0x38], cx
mov rcx, rbx
movzx eax, byte [rax + 0xa]
mov byte [rsp + 0x3a], al
call fcn.18014a820
mov qword [rdi + 0xa0], rax
test rax, rax
jne 0x180148471
movdqa xmm0, xmmword [0x180162500]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180161ee0]
lea rcx, [rbp + 0xa0]
movabs rax, 0x8f530d914d8a5ec7
mov qword [rbp - 0x30], rax
movabs rax, 0x5a42e6eeb47e91b8
mov qword [rbp - 0x28], rax
movabs rax, 0xcd6739f84e96bfe8
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160760]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, [0x18015ec98]
jmp 0x180147253
lea r8, [rbp - 0x80]
mov dword [rsp + 0x30], 0x96877249
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], 0x744096f0
lea rcx, [rbp - 0x18]
mov dword [rsp + 0x38], 0x4fb66ef3
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.1800051a0
lea rdx, [rbp]
movsd xmm0, qword [rax]
movsd qword [rbp], xmm0
mov ecx, dword [rax + 8]
mov dword [rbp + 8], ecx
mov rcx, rbx
movzx eax, byte [rax + 0xc]
mov byte [rbp + 0xc], al
call fcn.18014a820
mov qword [rdi + 0xa8], rax
test rax, rax
jne 0x18014853f
movdqa xmm0, xmmword [0x180162500]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180161ee0]
lea rcx, [rbp + 0xa0]
movabs rax, 0x8f530d914d8a5ec7
mov qword [rbp - 0x30], rax
movabs rax, 0x5a42e6eeb47e91b8
mov qword [rbp - 0x28], rax
movabs rax, 0xcd6739f84e96bfe8
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160760]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, [0x18015eca8]
jmp 0x180147253
lea r8, [rbp - 0x80]
mov dword [rbp - 0x18], 0x95897b42
lea rdx, [rbp - 0x18]
mov dword [rbp - 0x14], 0x754db2d4
lea rcx, [rbp]
mov word [rbp - 0x10], 0x2f4
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.180006a40
lea rdx, [rsp + 0x30]
movsd xmm0, qword [rax]
movsd qword [rsp + 0x30], xmm0
movzx ecx, word [rax + 8]
mov word [rsp + 0x38], cx
mov rcx, rbx
movzx eax, byte [rax + 0xa]
mov byte [rsp + 0x3a], al
call fcn.18014a820
mov qword [rdi + 0xb0], rax
test rax, rax
jne 0x18014860e
movdqa xmm0, xmmword [0x180161ab0]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180160b70]
lea rcx, [rbp + 0xa0]
movabs rax, 0x231b6e12be0bcbc9
mov qword [rbp - 0x30], rax
movabs rax, 0x6475e05c4aa6f6ac
mov qword [rbp - 0x28], rax
movabs rax, 0x53ddb28d8b2a54d2
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x1801605f0]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, [0x18015ecb8]
jmp 0x180147253
lea r8, [rbp - 0x80]
mov dword [rsp + 0x30], 0x95897b42
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], 0x7660bbc7
lea rcx, [rbp - 0x18]
mov dword [rsp + 0x38], 0x4fb06dfb
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.1800051a0
lea rdx, [rbp]
movsd xmm0, qword [rax]
movsd qword [rbp], xmm0
mov ecx, dword [rax + 8]
mov dword [rbp + 8], ecx
mov rcx, rbx
movzx eax, byte [rax + 0xc]
mov byte [rbp + 0xc], al
call fcn.18014a820
mov qword [rdi + 0xb8], rax
test rax, rax
jne 0x1801486dc
movdqa xmm0, xmmword [0x180161ab0]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180160b70]
lea rcx, [rbp + 0xa0]
movabs rax, 0x231b6e12be0bcbc9
mov qword [rbp - 0x30], rax
movabs rax, 0x6475e05c4aa6f6ac
mov qword [rbp - 0x28], rax
movabs rax, 0x53ddb28d8b2a54d2
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x1801605f0]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, [0x18015ecc8]
jmp 0x180147253
lea r8, [rbp - 0x80]
mov dword [rbp - 0x18], 0x95897b42
lea rdx, [rbp - 0x18]
mov dword [rbp - 0x14], 0x7f44acd3
lea rcx, [rsp + 0x30]
mov byte [rbp - 0x10], 0x97
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.180006bd0
lea rdx, [rbp]
mov rcx, rbx
movsd xmm0, qword [rax]
movsd qword [rbp], xmm0
movzx eax, word [rax + 8]
mov word [rbp + 8], ax
call fcn.18014a820
mov qword [rdi + 0xc0], rax
test rax, rax
jne 0x18014879f
movdqa xmm0, xmmword [0x180160b50]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180161e70]
lea rcx, [rbp + 0xa0]
movabs rax, 0x7439f41e740dfff1
mov qword [rbp - 0x30], rax
movabs rax, 0xae784d7351ac5bec
mov qword [rbp - 0x28], rax
movabs rax, 0x251547f5b6ad0ca8
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160620]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, [0x18015ecd8]
jmp 0x180147253
lea r8, [rbp - 0x80]
mov dword [rsp + 0x30], 0xb59c7b4d
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], 0x7f42b1e7
lea rcx, [rbp + 0x80]
mov dword [rsp + 0x38], 0x2a9b71e4
mov word [rsp + 0x3c], 0x4322
mov byte [rsp + 0x3e], 0x43
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.180006570
lea rdx, [rbp + 0x20]
mov rcx, rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
call fcn.18014a820
mov qword [rdi + 0xc8], rax
test rax, rax
jne 0x18014886d
movdqa xmm0, xmmword [0x180160b50]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180161e70]
lea rcx, [rbp + 0xa0]
movabs rax, 0x7439f41e740dfff1
mov qword [rbp - 0x30], rax
movabs rax, 0xae784d7351ac5bec
mov qword [rbp - 0x28], rax
movabs rax, 0x251547f5b6ad0ca8
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160620]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, [0x18015ece8]
jmp 0x180147253
movdqa xmm0, xmmword [0x180162380]
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x20]
movaps xmmword [rbp - 0x80], xmm6
lea rcx, [rbp + 0x80]
movsd qword [rbp - 0x70], xmm7
movdqu xmmword [rbp + 0x20], xmm0
call fcn.180006d40
lea rdx, [rbp + 0x40]
mov rcx, rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x40], xmm0
movzx eax, byte [rax + 0x10]
mov byte [rbp + 0x50], al
call fcn.18014a820
mov qword [rdi + 0xd0], rax
test rax, rax
jne 0x18014892a
movdqa xmm0, xmmword [0x180161160]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180161a30]
lea rcx, [rbp + 0xa0]
movabs rax, 0x28c0569f668d68fb
mov qword [rbp - 0x30], rax
movabs rax, 0xaee67e61023f00f0
mov qword [rbp - 0x28], rax
movabs rax, 0x3ea57114e1337e28
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160600]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.Process32FirstW
jmp 0x180147253
lea r8, [rbp - 0x80]
mov dword [rsp + 0x30], 0x86876c5a
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], 0x2952adf0
lea rcx, [rbp + 0x80]
mov dword [rsp + 0x38], 0x37b64ca5
mov word [rsp + 0x3c], 0x6437
mov byte [rsp + 0x3e], 0x43
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.180006570
lea rdx, [rbp + 0x20]
mov rcx, rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
call fcn.18014a820
mov qword [rdi + 0xd8], rax
test rax, rax
jne 0x1801489f8
movdqa xmm0, xmmword [0x180161160]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180161a30]
lea rcx, [rbp + 0xa0]
movabs rax, 0x28c0569f668d68fb
mov qword [rbp - 0x30], rax
movabs rax, 0xaee67e61023f00f0
mov qword [rbp - 0x28], rax
movabs rax, 0x3ea57114e1337e28
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160600]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.Process32NextW
jmp 0x180147253
movdqa xmm0, xmmword [0x180161930]
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x40]
mov word [rbp + 0x50], 0x1c6b
lea rcx, [rbp + 0x60]
mov byte [rbp + 0x52], 0xa6
movdqu xmmword [rbp + 0x40], xmm0
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.180006fa0
lea rdx, [rbp + 0x80]
mov rcx, rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x80], xmm0
mov eax, dword [rax + 0x10]
mov dword [rbp + 0x90], eax
call fcn.18014a820
mov qword [rdi + 0xe8], rax
test rax, rax
jne 0x180148ac4
movdqa xmm0, xmmword [0x180162190]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180161a60]
lea rcx, [rbp + 0xa0]
movabs rax, 0xdc88ab105b0ad5fd
mov qword [rbp - 0x30], rax
movabs rax, 0x50fd89a2e86dc9d4
mov qword [rbp - 0x28], rax
movabs rax, 0x3d73c78d57f0655f
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160810]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, [0x18015ed18]
jmp 0x180147253
movdqa xmm0, xmmword [0x180161930]
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x40]
mov word [rbp + 0x50], 0xa6b
lea rcx, [rbp + 0x60]
mov byte [rbp + 0x52], 0xa6
movdqu xmmword [rbp + 0x40], xmm0
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.180006fa0
lea rdx, [rbp + 0x80]
mov rcx, rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x80], xmm0
mov eax, dword [rax + 0x10]
mov dword [rbp + 0x90], eax
call fcn.18014a820
mov qword [rdi + 0xf0], rax
test rax, rax
jne 0x180148b90
movdqa xmm0, xmmword [0x180162190]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180161a60]
lea rcx, [rbp + 0xa0]
movabs rax, 0xdc88ab105b0ad5fd
mov qword [rbp - 0x30], rax
movabs rax, 0x50fd89a2e86dc9d4
mov qword [rbp - 0x28], rax
movabs rax, 0x3d73c78d57f0655f
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160810]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, [0x18015ed30]
jmp 0x180147253
lea r8, [rbp - 0x80]
mov dword [rbp - 0x18], 0x848b7146
lea rdx, [rbp - 0x18]
mov dword [rbp - 0x14], 0x7f5398f9
lea rcx, [rbp]
mov word [rbp - 0x10], 0x2f2
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.180006a40
lea rdx, [rsp + 0x30]
movsd xmm0, qword [rax]
movsd qword [rsp + 0x30], xmm0
movzx ecx, word [rax + 8]
mov word [rsp + 0x38], cx
mov rcx, rbx
movzx eax, byte [rax + 0xa]
mov byte [rsp + 0x3a], al
call fcn.18014a820
mov qword [rdi + 0xf8], rax
test rax, rax
jne 0x180148c5f
movdqa xmm0, xmmword [0x180162500]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180161ee0]
lea rcx, [rbp + 0xa0]
movabs rax, 0x8f530d914d8a5ec7
mov qword [rbp - 0x30], rax
movabs rax, 0x5a42e6eeb47e91b8
mov qword [rbp - 0x28], rax
movabs rax, 0xcd6739f84e96bfe8
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160760]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, [0x18015ed48]
jmp 0x180147253
movdqa xmm0, xmmword [0x180161fe0]
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x40]
mov byte [rbp + 0x50], 0x18
lea rcx, [rbp + 0x20]
movaps xmmword [rbp - 0x80], xmm6
movdqu xmmword [rbp + 0x40], xmm0
movsd qword [rbp - 0x70], xmm7
call fcn.1800067b0
lea rdx, [rbp + 0x80]
mov rcx, rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x80], xmm0
movzx eax, word [rax + 0x10]
mov word [rbp + 0x90], ax
call fcn.18014a820
mov qword [rdi + 0x100], rax
test rax, rax
jne 0x180148d27
movdqa xmm0, xmmword [0x180162500]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180161ee0]
lea rcx, [rbp + 0xa0]
movabs rax, 0x8f530d914d8a5ec7
mov qword [rbp - 0x30], rax
movabs rax, 0x5a42e6eeb47e91b8
mov qword [rbp - 0x28], rax
movabs rax, 0xcd6739f84e96bfe8
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160760]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, [0x18015ed58]
jmp 0x180147253
movdqa xmm0, xmmword [0x180161a90]
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x60]
mov dword [rbp + 0x70], 0x84d20e6c
lea rcx, [rbp + 0x80]
mov dword [rbp + 0x74], 0x3ad72993
movdqu xmmword [rbp + 0x60], xmm0
mov word [rbp + 0x78], 0x950a
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.180007270
lea rdx, [rbp + 0x40]
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x40], xmm0
movsd xmm1, qword [rax + 0x10]
movsd qword [rbp + 0x50], xmm1
movzx ecx, word [rax + 0x18]
mov word [rbp + 0x58], cx
mov rcx, rbx
movzx eax, byte [rax + 0x1a]
mov byte [rbp + 0x5a], al
call fcn.18014a820
mov qword [rdi + 0x108], rax
test rax, rax
jne 0x180148e0a
movdqa xmm0, xmmword [0x180161ab0]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180160b70]
lea rcx, [rbp + 0xa0]
movabs rax, 0x231b6e12be0bcbc9
mov qword [rbp - 0x30], rax
movabs rax, 0x6475e05c4aa6f6ac
mov qword [rbp - 0x28], rax
movabs rax, 0x53ddb28d8b2a54d2
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x1801605f0]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.ExpandEnvironmentStringsW
jmp 0x180147253
lea r8, [rbp - 0x80]
mov dword [rbp - 0x18], 0x9c987149
lea rdx, [rbp - 0x18]
mov dword [rbp - 0x14], 0x7f4db7d3
lea rcx, [rbp]
mov word [rbp - 0x10], 0x2c0
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.180006a40
lea rdx, [rsp + 0x30]
movsd xmm0, qword [rax]
movsd qword [rsp + 0x30], xmm0
movzx ecx, word [rax + 8]
mov word [rsp + 0x38], cx
mov rcx, rbx
movzx eax, byte [rax + 0xa]
mov byte [rsp + 0x3a], al
call fcn.18014a820
mov qword [rdi + 0x198], rax
test rax, rax
jne 0x180148ed9
movdqa xmm0, xmmword [0x180161ab0]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180160b70]
lea rcx, [rbp + 0xa0]
movabs rax, 0x231b6e12be0bcbc9
mov qword [rbp - 0x30], rax
movabs rax, 0x6475e05c4aa6f6ac
mov qword [rbp - 0x28], rax
movabs rax, 0x53ddb28d8b2a54d2
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x1801605f0]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.CopyFileW
jmp 0x180147253
mov rbx, qword [rdi + 0x40]
lea r8, [rbp + 0x40]
mov eax, 0xaf97
mov qword [rsp + 0x220], rsi
lea rdx, [rbp + 0x80]
mov word [rbp + 0x90], ax
lea rcx, [rbp - 0x80]
mov dword [rbp + 0x80], 0x9c7a6b6b
mov dword [rbp + 0x84], 0x8f843e9e
mov dword [rbp + 0x88], 0xb0b73ae5
mov dword [rbp + 0x8c], 0x5a28a812
movaps xmmword [rbp + 0x40], xmm6
movsd qword [rbp + 0x50], xmm7
call fcn.180007630
lea rcx, [rbp + 0x60]
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x60], xmm0
mov eax, dword [rax + 0x10]
mov dword [rbp + 0x70], eax
call rbx
mov rbx, rax
test rax, rax
jne 0x180148fc7
movdqa xmm0, xmmword [0x180160fc0]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180160860]
lea rcx, [rbp + 0xa0]
movabs rax, 0x80710991498a42f7
mov qword [rbp - 0x40], rax
movabs rax, 0x6b5fd27d0c1800ca
mov qword [rbp - 0x38], rax
movabs rax, 0x479cf0dbb12942eb
mov qword [rbp - 0x30], rax
movdqu xmmword [rbp - 0x60], xmm0
movdqu xmmword [rbp - 0x50], xmm1
call fcn.1800077b0
lea r9, [0x18015eda0]
lea r8, [rsp + 0x48]
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
jmp 0x180149324
lea r8, [rbp + 0x40]
mov dword [rsp + 0x30], 0xb09c7b4d
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], 0x5453bbe6
lea rcx, [rbp - 0x18]
mov dword [rsp + 0x38], 0xeb66ff6
mov byte [rsp + 0x3c], 0x43
movaps xmmword [rbp + 0x40], xmm6
movsd qword [rbp + 0x50], xmm7
call fcn.180006150
lea rdx, [rbp]
movsd xmm0, qword [rax]
movsd qword [rbp], xmm0
mov ecx, dword [rax + 8]
mov dword [rbp + 8], ecx
mov rcx, rbx
movzx eax, word [rax + 0xc]
mov word [rbp + 0xc], ax
call fcn.18014a820
mov qword [rdi + 0x118], rax
test rax, rax
jne 0x18014909b
movdqa xmm0, xmmword [0x180160f90]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180160a50]
lea rcx, [rbp + 0xa0]
movabs rax, 0x80710991498a42f7
mov qword [rbp - 0x30], rax
movabs rax, 0x6b5fd27d0c1800ca
mov qword [rbp - 0x28], rax
movabs rax, 0x479cf0dbb12942eb
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x1801607b0]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.GetUserNameA
jmp 0x1801492eb
movdqa xmm0, xmmword [0x180161a80]
lea r8, [rbp]
lea rdx, [rbp + 0x40]
mov byte [rbp + 0x50], 0x18
lea rcx, [rsp + 0x30]
movaps xmmword [rbp], xmm6
movdqu xmmword [rbp + 0x40], xmm0
movsd qword [rbp + 0x10], xmm7
call fcn.1800067b0
lea rdx, [rbp + 0x20]
mov rcx, rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movzx eax, word [rax + 0x10]
mov word [rbp + 0x30], ax
call fcn.18014a820
mov qword [rdi + 0x120], rax
test rax, rax
jne 0x18014915b
movdqa xmm0, xmmword [0x180162090]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180161430]
lea rcx, [rbp + 0xa0]
movabs rax, 0xdc88ab105b0ad5fd
mov qword [rbp - 0x30], rax
movabs rax, 0xeacbc0ec4ae66f3a
mov qword [rbp - 0x28], rax
movabs rax, 0xaefea0beae8bb335
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160610]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.OpenProcessToken
jmp 0x1801492eb
movdqa xmm0, xmmword [0x180161be0]
lea r8, [rbp]
lea rdx, [rbp + 0x40]
mov dword [rbp + 0x50], 0xf6c83271
lea rcx, [rsp + 0x30]
movaps xmmword [rbp], xmm6
movdqu xmmword [rbp + 0x40], xmm0
movsd qword [rbp + 0x10], xmm7
call fcn.180007830
lea rdx, [rbp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
mov ecx, dword [rax + 0x10]
mov dword [rbp + 0x30], ecx
mov rcx, rbx
movzx eax, byte [rax + 0x14]
mov byte [rbp + 0x34], al
call fcn.18014a820
mov qword [rdi + 0x128], rax
test rax, rax
jne 0x180149223
movdqa xmm0, xmmword [0x180162090]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180161430]
lea rcx, [rbp + 0xa0]
movabs rax, 0xdc88ab105b0ad5fd
mov qword [rbp - 0x30], rax
movabs rax, 0xeacbc0ec4ae66f3a
mov qword [rbp - 0x28], rax
movabs rax, 0xaefea0beae8bb335
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160610]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.GetTokenInformation
jmp 0x1801492eb
movdqa xmm0, xmmword [0x180161910]
lea r8, [rbp]
lea rdx, [rbp + 0x40]
mov word [rbp + 0x50], 0x5d59
lea rcx, [rsp + 0x30]
movaps xmmword [rbp], xmm6
movdqu xmmword [rbp + 0x40], xmm0
movsd qword [rbp + 0x10], xmm7
call fcn.180007b20
lea rdx, [rbp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movzx ecx, word [rax + 0x10]
mov word [rbp + 0x30], cx
mov rcx, rbx
movzx eax, byte [rax + 0x12]
mov byte [rbp + 0x32], al
call fcn.18014a820
mov qword [rdi + 0x130], rax
test rax, rax
jne 0x180149369
movdqa xmm0, xmmword [0x180160cb0]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180160c60]
lea rcx, [rbp + 0xa0]
movabs rax, 0x28c0569f668d68fb
mov qword [rbp - 0x30], rax
movabs rax, 0x76f158a626e87daa
mov qword [rbp - 0x28], rax
movabs rax, 0x5440673b33e0748b
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x1801606e0]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.LookupAccountSidA
movups xmm0, xmmword [rax]
lea r8, [rsp + 0x48]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
movsd xmm0, qword [rax + 0x20]
movsd qword [rsp + 0x68], xmm0
mov ecx, dword [rax + 0x28]
mov dword [rsp + 0x70], ecx
movzx ecx, word [rax + 0x2c]
mov word [rsp + 0x74], cx
movzx eax, byte [rax + 0x2e]
mov byte [rsp + 0x76], al
mov edx, 0x100000
lea rcx, [0x18017bd90]
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
jmp 0x18014a7e9
mov rbx, qword [rdi + 0x40]
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x20]
mov qword [rsp + 0x230], r13
lea rcx, [rbp + 0x80]
mov dword [rbp + 0x20], 0x9c6c6b69
mov dword [rbp + 0x24], 0x8f953e91
mov dword [rbp + 0x28], 0xb0ed3ae1
mov dword [rbp + 0x2c], 0x5a1aa813
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.180007dd0
lea rcx, [rbp + 0x40]
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x40], xmm0
movzx eax, word [rax + 0x10]
mov word [rbp + 0x50], ax
call rbx
mov rbx, rax
test rax, rax
jne 0x180149441
movdqa xmm0, xmmword [0x180160cf0]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180160840]
lea rcx, [rbp + 0xa0]
movabs rax, 0x28c0569f668d68fb
mov qword [rbp - 0x40], rax
movabs rax, 0x76f158a626e87daa
mov qword [rbp - 0x38], rax
movabs rax, 0x5440673b33e0748b
mov qword [rbp - 0x30], rax
movdqu xmmword [rbp - 0x60], xmm0
movdqu xmmword [rbp - 0x50], xmm1
call fcn.1800077b0
lea r9, str.crypt32
lea r8, [rsp + 0x48]
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
jmp 0x180149540
movdqa xmm0, xmmword [0x1801618c0]
lea r8, [rbp]
lea rdx, [rsp + 0x30]
mov word [rsp + 0x40], 0x3c6c
lea rcx, [rbp - 0x80]
mov byte [rsp + 0x42], 0xa6
movdqu xmmword [rsp + 0x30], xmm0
movaps xmmword [rbp], xmm6
movsd qword [rbp + 0x10], xmm7
call fcn.180006fa0
lea rdx, [rbp + 0x60]
mov rcx, rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x60], xmm0
mov eax, dword [rax + 0x10]
mov dword [rbp + 0x70], eax
call fcn.18014a820
mov qword [rdi + 0x110], rax
test rax, rax
jne 0x180149585
movdqa xmm0, xmmword [0x1801614b0]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x1801616e0]
lea rcx, [rbp + 0xa0]
movabs rax, 0x7b1bf01e700de3c1
mov qword [rbp - 0x30], rax
movabs rax, 0x25097505d01946fa
mov qword [rbp - 0x28], rax
movabs rax, 0xbb6a5e0a1c2f4b84
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x1801606b0]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, [0x18015ee10]
lea r8, [rsp + 0x48]
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
movsd xmm0, qword [rax + 0x20]
movsd qword [rsp + 0x68], xmm0
mov ecx, dword [rax + 0x28]
mov dword [rsp + 0x70], ecx
movzx ecx, word [rax + 0x2c]
mov word [rsp + 0x74], cx
movzx eax, byte [rax + 0x2e]
mov byte [rsp + 0x76], al
mov edx, 0x100000
lea rcx, [0x18017bd90]
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
jmp 0x18014a7e1
mov rbx, qword [rdi + 0x40]
lea r8, [rbp - 0x80]
mov qword [rsp + 0x1f0], r15
lea rdx, [rbp]
mov r15d, 0xa821
mov dword [rbp], 0x9c7d6b68
lea rcx, [rbp + 0x40]
mov word [rbp + 0xc], r15w
mov dword [rbp + 4], 0x8f9c3e9a
mov dword [rbp + 8], 0xb0aa3ae5
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.180007f30
lea rcx, [rbp + 0x80]
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x80], xmm0
call rbx
mov rbx, rax
test rax, rax
jne 0x18014965c
movdqa xmm0, xmmword [0x1801614f0]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180160960]
lea rcx, [rbp + 0xa0]
movabs rax, 0x7b1bf01e700de3c1
mov qword [rbp - 0x40], rax
movabs rax, 0x25097505d01946fa
mov qword [rbp - 0x38], rax
movabs rax, 0xbb6a5e0a1c2f4b84
mov qword [rbp - 0x30], rax
movdqu xmmword [rbp - 0x60], xmm0
movdqu xmmword [rbp - 0x50], xmm1
call fcn.1800077b0
lea r9, str.bcrypt
lea r8, [rsp + 0x48]
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
jmp 0x180149b9c
movdqa xmm0, xmmword [0x180162390]
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x20]
movaps xmmword [rbp - 0x80], xmm6
lea rcx, [rbp - 0x18]
movsd qword [rbp - 0x70], xmm7
movdqu xmmword [rbp + 0x20], xmm0
call fcn.180006d40
lea rdx, [rsp + 0x30]
mov rcx, rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movzx eax, byte [rax + 0x10]
mov byte [rsp + 0x40], al
call fcn.18014a820
mov qword [rdi + 0x148], rax
test rax, rax
jne 0x180149719
movdqa xmm0, xmmword [0x180161e80]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x1801617c0]
lea rcx, [rbp + 0xa0]
movabs rax, 0xd753939d838c76cf
mov qword [rbp - 0x30], rax
movabs rax, 0xa7f47dbfb26e6c6a
mov qword [rbp - 0x28], rax
movabs rax, 0xf18374935c7aade6
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x1801606a0]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.BCryptImportKey
jmp 0x180149b63
lea r8, [rbp - 0x80]
mov dword [rsp + 0x30], 0x9c9a5d48
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], 0x7f65aae5
lea rcx, [rbp + 0x20]
mov dword [rsp + 0x38], 0x3faa70f4
mov word [rsp + 0x3c], 0x3337
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.180006350
lea rdx, [rbp - 0x18]
movsd xmm0, qword [rax]
movsd qword [rbp - 0x18], xmm0
mov ecx, dword [rax + 8]
mov dword [rbp - 0x10], ecx
movzx ecx, word [rax + 0xc]
mov word [rbp - 0xc], cx
mov rcx, rbx
movzx eax, byte [rax + 0xe]
mov byte [rbp - 0xa], al
call fcn.18014a820
mov qword [rdi + 0x150], rax
test rax, rax
jne 0x1801497f6
movdqa xmm0, xmmword [0x180161e80]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x1801617c0]
lea rcx, [rbp + 0xa0]
movabs rax, 0xd753939d838c76cf
mov qword [rbp - 0x30], rax
movabs rax, 0xa7f47dbfb26e6c6a
mov qword [rbp - 0x28], rax
movabs rax, 0xf18374935c7aade6
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x1801606a0]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.BCryptDecrypt
jmp 0x180149b63
movdqa xmm0, xmmword [0x1801619a0]
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x60]
mov dword [rbp + 0x70], 0xa6cb356c
lea rcx, [rbp + 0xa0]
mov dword [rbp + 0x74], 0x20c62888
movdqu xmmword [rbp + 0x60], xmm0
mov dword [rbp + 0x78], 0x6e5ef039
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.180008070
lea rdx, [rsp + 0x48]
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movsd xmm1, qword [rax + 0x10]
movsd qword [rsp + 0x58], xmm1
mov ecx, dword [rax + 0x18]
mov dword [rsp + 0x60], ecx
mov rcx, rbx
movzx eax, byte [rax + 0x1c]
mov byte [rsp + 0x64], al
call fcn.18014a820
mov qword [rdi + 0x158], rax
test rax, rax
jne 0x1801498dd
movdqa xmm0, xmmword [0x180160f90]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180160a50]
lea rcx, [rbp + 0xa0]
movabs rax, 0x80710991498a42f7
mov qword [rbp - 0x30], rax
movabs rax, 0x6b5fd27d0c1800ca
mov qword [rbp - 0x28], rax
movabs rax, 0x479cf0dbb12942eb
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x1801607b0]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.BCryptOpenAlgorithmProvider
jmp 0x180149b63
movdqa xmm0, xmmword [0x180161c00]
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x20]
mov word [rbp + 0x30], 0x5d61
lea rcx, [rbp - 0x18]
movaps xmmword [rbp - 0x80], xmm6
movdqu xmmword [rbp + 0x20], xmm0
movsd qword [rbp - 0x70], xmm7
call fcn.180007b20
lea rdx, [rsp + 0x30]
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movzx ecx, word [rax + 0x10]
mov word [rsp + 0x40], cx
mov rcx, rbx
movzx eax, byte [rax + 0x12]
mov byte [rsp + 0x42], al
call fcn.18014a820
mov qword [rdi + 0x160], rax
test rax, rax
jne 0x1801499a9
movdqa xmm0, xmmword [0x180160f90]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180160a50]
lea rcx, [rbp + 0xa0]
movabs rax, 0x80710991498a42f7
mov qword [rbp - 0x30], rax
movabs rax, 0x6b5fd27d0c1800ca
mov qword [rbp - 0x28], rax
movabs rax, 0x479cf0dbb12942eb
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x1801607b0]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.BCryptSetProperty
jmp 0x180149b63
movdqa xmm0, xmmword [0x180161c90]
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x20]
mov byte [rbp + 0x30], 0x18
lea rcx, [rbp - 0x18]
movaps xmmword [rbp - 0x80], xmm6
movdqu xmmword [rbp + 0x20], xmm0
movsd qword [rbp - 0x70], xmm7
call fcn.1800067b0
lea rdx, [rsp + 0x30]
mov rcx, rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movzx eax, word [rax + 0x10]
mov word [rsp + 0x40], ax
call fcn.18014a820
mov qword [rdi + 0x168], rax
test rax, rax
jne 0x180149a6b
movdqa xmm0, xmmword [0x180162090]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180161430]
lea rcx, [rbp + 0xa0]
movabs rax, 0xdc88ab105b0ad5fd
mov qword [rbp - 0x30], rax
movabs rax, 0xeacbc0ec4ae66f3a
mov qword [rbp - 0x28], rax
movabs rax, 0xaefea0beae8bb335
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160610]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.BCryptDestroyKey
jmp 0x180149b63
movdqa xmm0, xmmword [0x180161b30]
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x58], 0x9bce2971
lea rcx, [rbp + 0x60]
mov dword [rsp + 0x5c], 0x3fdf35aa
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x60], 0x1c49f134
mov byte [rsp + 0x64], 0xe8
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.180008480
lea rdx, [rbp + 0xa0]
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xa0], xmm0
movsd xmm1, qword [rax + 0x10]
movsd qword [rbp + 0xb0], xmm1
mov ecx, dword [rax + 0x18]
mov dword [rbp + 0xb8], ecx
mov rcx, rbx
movzx eax, word [rax + 0x1c]
mov word [rbp + 0xbc], ax
call fcn.18014a820
mov qword [rdi + 0x170], rax
test rax, rax
jne 0x180149be1
movdqa xmm0, xmmword [0x180162090]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180161430]
lea rcx, [rbp + 0xa0]
movabs rax, 0xdc88ab105b0ad5fd
mov qword [rbp - 0x30], rax
movabs rax, 0xeacbc0ec4ae66f3a
mov qword [rbp - 0x28], rax
movabs rax, 0xaefea0beae8bb335
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160610]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.BCryptCloseAlgorithmProvider
movups xmm0, xmmword [rax]
lea r8, [rsp + 0x48]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
movsd xmm0, qword [rax + 0x20]
movsd qword [rsp + 0x68], xmm0
mov ecx, dword [rax + 0x28]
mov dword [rsp + 0x70], ecx
movzx ecx, word [rax + 0x2c]
mov word [rsp + 0x74], cx
movzx eax, byte [rax + 0x2e]
mov byte [rsp + 0x76], al
mov edx, 0x100000
lea rcx, [0x18017bd90]
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
jmp 0x18014a7d9
mov rbx, qword [rdi + 0x40]
lea r8, [rbp - 0x80]
mov qword [rsp + 0x228], r12
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x1f8], r14
mov dword [rsp + 0x30], 0x9c6d6b7f
mov dword [rsp + 0x34], 0x8f973e8d
mov dword [rsp + 0x38], 0xb0ec3aa6
mov word [rsp + 0x3c], r15w
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.180007f30
lea rcx, [rbp + 0x80]
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x80], xmm0
call rbx
mov rbx, rax
test rax, rax
jne 0x180149cbf
movdqa xmm0, xmmword [0x180160cf0]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180160840]
lea rcx, [rbp + 0xa0]
movabs rax, 0x28c0569f668d68fb
mov qword [rbp - 0x40], rax
movabs rax, 0x76f158a626e87daa
mov qword [rbp - 0x38], rax
movabs rax, 0x5440673b33e0748b
mov qword [rbp - 0x30], rax
movdqu xmmword [rbp - 0x60], xmm0
movdqu xmmword [rbp - 0x50], xmm1
call fcn.1800077b0
lea r9, [0x18015eec0]
lea r8, [rsp + 0x48]
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
jmp 0x18014a782
movdqa xmm0, xmmword [0x180161c60]
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x20]
mov word [rbp + 0x30], 0x5d4f
lea rcx, [rbp - 0x18]
movaps xmmword [rbp - 0x80], xmm6
movdqu xmmword [rbp + 0x20], xmm0
movsd qword [rbp - 0x70], xmm7
call fcn.180007b20
lea rdx, [rbp]
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movzx ecx, word [rax + 0x10]
mov word [rbp + 0x10], cx
mov rcx, rbx
movzx eax, byte [rax + 0x12]
mov byte [rbp + 0x12], al
call fcn.18014a820
mov qword [rdi + 0x138], rax
test rax, rax
jne 0x180149d87
movdqa xmm0, xmmword [0x180160cb0]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180160c60]
lea rcx, [rbp + 0xa0]
movabs rax, 0x28c0569f668d68fb
mov qword [rbp - 0x30], rax
movabs rax, 0x76f158a626e87daa
mov qword [rbp - 0x28], rax
movabs rax, 0x5440673b33e0748b
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x1801606e0]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, [0x18015eec8]
jmp 0x18014a749
movdqa xmm0, xmmword [0x180161ae0]
lea r8, [rbp]
lea rdx, [rbp + 0x20]
mov dword [rbp + 0x30], 0xf6de1873
lea rcx, [rbp + 0x60]
movaps xmmword [rbp], xmm6
movdqu xmmword [rbp + 0x20], xmm0
movsd qword [rbp + 0x10], xmm7
call fcn.180007830
lea rdx, [rbp - 0x80]
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
mov ecx, dword [rax + 0x10]
mov dword [rbp - 0x70], ecx
mov rcx, rbx
movzx eax, byte [rax + 0x14]
mov byte [rbp - 0x6c], al
call fcn.18014a820
mov qword [rdi + 0x140], rax
test rax, rax
jne 0x180149e4e
movdqa xmm0, xmmword [0x1801614b0]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x1801616e0]
lea rcx, [rbp + 0xa0]
movabs rax, 0x7b1bf01e700de3c1
mov qword [rbp - 0x30], rax
movabs rax, 0x25097505d01946fa
mov qword [rbp - 0x28], rax
movabs rax, 0xbb6a5e0a1c2f4b84
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x1801606b0]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.UnhookWindowsHookEx
jmp 0x18014a749
mov rbx, qword [rdi + 0x40]
lea r8, [rbp + 0x40]
mov eax, 0xaf97
mov dword [rbp + 0x20], 0x9c6d6b78
lea rdx, [rbp + 0x20]
mov word [rbp + 0x30], ax
lea rcx, [rbp - 0x80]
mov dword [rbp + 0x24], 0x8f973e9c
mov dword [rbp + 0x28], 0xb0b33ae1
mov dword [rbp + 0x2c], 0x5a68a846
movaps xmmword [rbp + 0x40], xmm6
movsd qword [rbp + 0x50], xmm7
call fcn.180007630
lea rcx, [rbp + 0x60]
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x60], xmm0
mov eax, dword [rax + 0x10]
mov dword [rbp + 0x70], eax
call rbx
mov rbx, rax
test rax, rax
jne 0x180149f22
movdqa xmm0, xmmword [0x1801614f0]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180160960]
lea rcx, [rbp + 0xa0]
movabs rax, 0x7b1bf01e700de3c1
mov qword [rbp - 0x40], rax
movabs rax, 0x25097505d01946fa
mov qword [rbp - 0x38], rax
movabs rax, 0xbb6a5e0a1c2f4b84
mov qword [rbp - 0x30], rax
movdqu xmmword [rbp - 0x60], xmm0
movdqu xmmword [rbp - 0x50], xmm1
call fcn.1800077b0
lea r9, str.rstrtmgr
lea r8, [rsp + 0x48]
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
jmp 0x18014a782
lea r8, [rbp]
mov dword [rsp + 0x30], 0x91bb7358
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], 0x4955acf4
lea rcx, [rbp + 0x40]
mov dword [rsp + 0x38], 0x26a071f2
mov word [rsp + 0x3c], 0x5d2c
mov byte [rsp + 0x3e], 0x43
movaps xmmword [rbp], xmm6
movsd qword [rbp + 0x10], xmm7
call fcn.180006570
lea rdx, [rbp + 0x80]
mov rcx, rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x80], xmm0
call fcn.18014a820
mov qword [rdi + 0x178], rax
test rax, rax
jne 0x180149ff3
movdqa xmm0, xmmword [0x180161e80]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x1801617c0]
lea rcx, [rbp + 0xa0]
movabs rax, 0xd753939d838c76cf
mov qword [rbp - 0x30], rax
movabs rax, 0xa7f47dbfb26e6c6a
mov qword [rbp - 0x28], rax
movabs rax, 0xf18374935c7aade6
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x1801606a0]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.RmStartSession
jmp 0x18014a749
movdqa xmm0, xmmword [0x180161b40]
lea r8, [rbp]
lea rdx, [rbp + 0x40]
mov dword [rbp + 0x50], 0xf6d5387b
lea rcx, [rsp + 0x30]
movaps xmmword [rbp], xmm6
movdqu xmmword [rbp + 0x40], xmm0
movsd qword [rbp + 0x10], xmm7
call fcn.180007830
lea rdx, [rbp + 0x80]
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x80], xmm0
mov ecx, dword [rax + 0x10]
mov dword [rbp + 0x90], ecx
mov rcx, rbx
movzx eax, byte [rax + 0x14]
mov byte [rbp + 0x94], al
call fcn.18014a820
mov qword [rdi + 0x180], rax
test rax, rax
jne 0x18014a0c7
movdqa xmm0, xmmword [0x180161e80]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x1801617c0]
lea rcx, [rbp + 0xa0]
movabs rax, 0xd753939d838c76cf
mov qword [rbp - 0x30], rax
movabs rax, 0xa7f47dbfb26e6c6a
mov qword [rbp - 0x28], rax
movabs rax, 0xf18374935c7aade6
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x1801606a0]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.RmRegisterResources
jmp 0x18014a749
lea r8, [rbp + 0x40]
mov dword [rbp - 0x18], 0x80af7358
lea rdx, [rbp - 0x18]
mov dword [rbp - 0x14], 0x694892e1
lea rcx, [rbp]
mov word [rbp - 0x10], 0x2e3
movaps xmmword [rbp + 0x40], xmm6
movsd qword [rbp + 0x50], xmm7
call fcn.180006a40
lea rdx, [rsp + 0x30]
movsd xmm0, qword [rax]
movsd qword [rsp + 0x30], xmm0
movzx ecx, word [rax + 8]
mov word [rsp + 0x38], cx
mov rcx, rbx
movzx eax, byte [rax + 0xa]
mov byte [rsp + 0x3a], al
call fcn.18014a820
mov qword [rdi + 0x188], rax
test rax, rax
jne 0x18014a196
movdqa xmm0, xmmword [0x180160ab0]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180161750]
lea rcx, [rbp + 0xa0]
movabs rax, 0xd3aaaf105f0ac9cd
mov qword [rbp - 0x30], rax
movabs rax, 0xad414e7969836928
mov qword [rbp - 0x28], rax
movabs rax, 0x9d67a411dcf3d8c0
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160720]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.RmGetList
jmp 0x18014a749
lea r8, [rbp + 0x40]
mov dword [rsp + 0x30], 0x8bad7358
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], 0x69448df1
lea rcx, [rbp - 0x18]
mov dword [rsp + 0x38], 0x21bc6be4
mov byte [rsp + 0x3c], 0x43
movaps xmmword [rbp + 0x40], xmm6
movsd qword [rbp + 0x50], xmm7
call fcn.180006150
lea rdx, [rbp]
movsd xmm0, qword [rax]
movsd qword [rbp], xmm0
mov ecx, dword [rax + 8]
mov dword [rbp + 8], ecx
mov rcx, rbx
movzx eax, word [rax + 0xc]
mov word [rbp + 0xc], ax
call fcn.18014a820
mov qword [rdi + 0x190], rax
test rax, rax
jne 0x18014a26a
movdqa xmm0, xmmword [0x180160ab0]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180161750]
lea rcx, [rbp + 0xa0]
movabs rax, 0xd3aaaf105f0ac9cd
mov qword [rbp - 0x30], rax
movabs rax, 0xad414e7969836928
mov qword [rbp - 0x28], rax
movabs rax, 0x9d67a411dcf3d8c0
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160720]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.RmEndSession
jmp 0x18014a749
mov rbx, qword [rdi + 0x40]
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x20]
mov dword [rbp + 0x20], 0x9c766b79
lea rcx, [rbp + 0x80]
mov dword [rbp + 0x24], 0x8f893e8d
mov dword [rbp + 0x28], 0xb0ed3af9
mov dword [rbp + 0x2c], 0x5a1aa813
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.180007dd0
lea rcx, [rbp + 0x40]
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x40], xmm0
movzx eax, word [rax + 0x10]
mov word [rbp + 0x50], ax
call rbx
mov rbx, rax
test rax, rax
jne 0x18014a33a
movdqa xmm0, xmmword [0x180161ff0]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x1801608c0]
lea rcx, [rbp + 0xa0]
movabs rax, 0x8f530d914d8a5ec7
mov qword [rbp - 0x40], rax
movabs rax, 0x64e96d6cae3c5d5c
mov qword [rbp - 0x38], rax
movabs rax, 0xefb0dec03845c666
mov qword [rbp - 0x30], rax
movdqu xmmword [rbp - 0x60], xmm0
movdqu xmmword [rbp - 0x50], xmm1
call fcn.1800077b0
lea r9, str.shell32
lea r8, [rsp + 0x48]
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
jmp 0x18014a782
movdqa xmm0, xmmword [0x180161b20]
lea r8, [rbp]
lea rdx, [rbp - 0x80]
mov dword [rbp - 0x70], 0x9ed23c48
lea rcx, [rsp + 0x30]
mov byte [rbp - 0x6c], 0xfa
movdqu xmmword [rbp - 0x80], xmm0
movaps xmmword [rbp], xmm6
movsd qword [rbp + 0x10], xmm7
call fcn.180005e40
lea rdx, [rbp + 0x60]
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x60], xmm0
mov ecx, dword [rax + 0x10]
mov dword [rbp + 0x70], ecx
mov rcx, rbx
movzx eax, word [rax + 0x14]
mov word [rbp + 0x74], ax
call fcn.18014a820
mov qword [rdi + 0x1a0], rax
test rax, rax
jne 0x18014a407
movdqa xmm0, xmmword [0x180161fc0]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180160890]
lea rcx, [rbp + 0xa0]
movabs rax, 0x8f530d914d8a5ec7
mov qword [rbp - 0x30], rax
movabs rax, 0x64e96d6cae3c5d5c
mov qword [rbp - 0x28], rax
movabs rax, 0xefb0dec03845c666
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160640]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.SHGetKnownFolderPath
jmp 0x18014a749
mov rbx, qword [rdi + 0x40]
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x20]
mov dword [rbp + 0x20], 0x9c7b6b7c
lea rcx, [rbp - 0x18]
mov dword [rbp + 0x24], 0x8f963e9a
mov dword [rbp + 0x28], 0xb0b13afc
mov dword [rbp + 0x2c], 0x5a1aa84f
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.180007dd0
lea rcx, [rbp]
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movzx eax, word [rax + 0x10]
mov word [rbp + 0x10], ax
call rbx
mov rbx, rax
test rax, rax
jne 0x18014a4d4
movdqa xmm0, xmmword [0x180160b00]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x1801608d0]
lea rcx, [rbp + 0xa0]
movabs rax, 0x7b1bf01e700de3c1
mov qword [rbp - 0x40], rax
movabs rax, 0x75f9d01b35ea4778
mov qword [rbp - 0x38], rax
movabs rax, 0x9ed3d8d1642ae47b
mov qword [rbp - 0x30], rax
movdqu xmmword [rbp - 0x60], xmm0
movdqu xmmword [rbp - 0x50], xmm1
call fcn.1800077b0
lea r9, str.version
lea r8, [rsp + 0x48]
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
jmp 0x18014a782
movdqa xmm0, xmmword [0x180161a70]
lea r8, [rbp + 0x60]
lea rdx, [rbp - 0x80]
mov dword [rbp - 0x70], 0x9ff5327e
lea rcx, [rbp + 0x80]
mov dword [rbp - 0x6c], 0x49f12280
movdqu xmmword [rbp - 0x80], xmm0
movaps xmmword [rbp + 0x60], xmm6
movsd qword [rbp + 0x70], xmm7
call fcn.180005ac0
lea rdx, [rbp + 0x40]
mov rcx, rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x40], xmm0
movsd xmm1, qword [rax + 0x10]
movsd qword [rbp + 0x50], xmm1
movzx eax, byte [rax + 0x18]
mov byte [rbp + 0x58], al
call fcn.18014a820
mov qword [rdi + 0x1a8], rax
test rax, rax
jne 0x18014a5a9
movdqa xmm0, xmmword [0x180160b40]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180162570]
lea rcx, [rbp + 0xa0]
movabs rax, 0x7b1bf01e700de3c1
mov qword [rbp - 0x30], rax
movabs rax, 0x75f9d01b35ea4778
mov qword [rbp - 0x28], rax
movabs rax, 0x9ed3d8d1642ae47b
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [str.1qu_]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.GetFileVersionInfoSizeA
jmp 0x18014a749
movdqa xmm0, xmmword [0x180161a70]
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0x40]
mov dword [rbp + 0x50], 0xf6e7327e
lea rcx, [rbp + 0x60]
movaps xmmword [rbp + 0x80], xmm6
movdqu xmmword [rbp + 0x40], xmm0
movsd qword [rbp + 0x90], xmm7
call fcn.180007830
lea rdx, [rbp - 0x80]
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
mov ecx, dword [rax + 0x10]
mov dword [rbp - 0x70], ecx
mov rcx, rbx
movzx eax, byte [rax + 0x14]
mov byte [rbp - 0x6c], al
call fcn.18014a820
mov qword [rdi + 0x1b0], rax
test rax, rax
jne 0x18014a679
movdqa xmm0, xmmword [0x180161390]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x1801622e0]
lea rcx, [rbp + 0xa0]
movabs rax, 0x28c0569f668d68fb
mov qword [rbp - 0x30], rax
movabs rax, 0xd4e8db436895128c
mov qword [rbp - 0x28], rax
movabs rax, 0xa620eecc1455531b
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160780]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.GetFileVersionInfoA
jmp 0x18014a749
lea r8, [rbp - 0x80]
mov dword [rsp + 0x30], 0xb49a7b5c
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], 0x6353bbe0
lea rcx, [rbp + 0x40]
mov dword [rsp + 0x38], 0x3abf63c1
mov word [rsp + 0x3c], 0x7226
mov byte [rsp + 0x3e], 0x43
movaps xmmword [rbp - 0x80], xmm6
movsd qword [rbp - 0x70], xmm7
call fcn.180006570
lea rdx, [rbp + 0x80]
mov rcx, rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x80], xmm0
call fcn.18014a820
mov qword [rdi + 0x1b8], rax
test rax, rax
jne 0x18014a7c4
movdqa xmm0, xmmword [0x180161390]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x1801622e0]
lea rcx, [rbp + 0xa0]
movabs rax, 0x28c0569f668d68fb
mov qword [rbp - 0x30], rax
movabs rax, 0xd4e8db436895128c
mov qword [rbp - 0x28], rax
movabs rax, 0xa620eecc1455531b
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x180160780]
movdqu xmmword [rbp - 0x50], xmm1
movdqu xmmword [rbp - 0x40], xmm0
call fcn.180005380
lea r9, str.VerQueryValueA
movups xmm0, xmmword [rax]
lea r8, [rsp + 0x48]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
movsd xmm0, qword [rax + 0x20]
movsd qword [rsp + 0x68], xmm0
mov ecx, dword [rax + 0x28]
mov dword [rsp + 0x70], ecx
movzx ecx, word [rax + 0x2c]
mov word [rsp + 0x74], cx
movzx eax, byte [rax + 0x2e]
mov byte [rsp + 0x76], al
mov edx, 0x100000
lea rcx, [0x18017bd90]
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
jmp 0x18014a7c9
mov eax, 1
mov r14, qword [rsp + 0x1f8]
mov r12, qword [rsp + 0x228]
mov r15, qword [rsp + 0x1f0]
mov r13, qword [rsp + 0x230]
mov rsi, qword [rsp + 0x220]
movaps xmm6, xmmword [rsp + 0x1e0]
movaps xmm7, xmmword [rsp + 0x1d0]
add rsp, 0x200
pop rdi
pop rbx
pop rbp
ret