Function at 0x180032f10
Capabilities:
Get disk information
Get geographical location
Get hostname
Get memory capacity
Hash data using sha512

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1b70]
mov eax, 0x1c70
call fcn.1801eeca0
sub rsp, rax
mov rax, qword [0x1802943b0]
xor rax, rsp
mov qword [rbp + 0x1b60], rax
mov r13, rdx
mov r12, rcx
mov qword [rsp + 0x78], rcx
mov qword [rbp - 0x80], rdx
xorps xmm0, xmm0
movups xmmword [rbp + 0x6d8], xmm0
movups xmmword [rbp + 0x6e8], xmm0
mov ecx, dword [0x1802de924]
mov rax, qword gs:[0x58]
mov edx, 4
mov rdi, qword [rax + rcx*8]
mov qword [rbp + 0x6d0], rdi
xor r14d, r14d
lea r15d, [r14 + 0xf]
mov eax, dword [rdi + rdx]
cmp dword [0x18033c8a4], eax
jle 0x1800330f4
lea rcx, [0x18033c8a4]
call fcn.1801e64d8
cmp dword [0x18033c8a4], 0xffffffff
jne 0x1800330f4
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x60], r14
mov qword [rbp + 0x68], r15
mov byte [rbp + 0x50], r14b
mov qword [rbp + 0x70], r14
mov qword [rbp + 0x80], r14
mov qword [rbp + 0x88], r15
mov byte [rbp + 0x70], r14b
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r14
lea r8d, [r14 + 0x2c]
lea rdx, str.40_53_48_83_EC_20_33_DB_38_1D_________74_1C
lea rcx, [rbp + 0x50]
call fcn.1800bd1d0
nop
cmp byte [rbp + 0xb8], r14b
jne 0x18003302e
lea edx, [r14 + 1]
lea rcx, [rbp + 0x50]
call fcn.1800bd5e0
cmp byte [rbp + 0xb8], r14b
jne 0x18003302e
mov edx, 0x7fffffff
lea rcx, [rbp + 0x50]
call fcn.1800bd5e0
mov rdx, qword [rbp + 0xa8]
mov rax, rdx
mov rcx, qword [rbp + 0xa0]
sub rax, rcx
sar rax, 3
test rax, rax
jne 0x180033076
mov qword [rsp + 0x60], r14
cmp rdx, qword [rbp + 0xb0]
je 0x18003305e
mov qword [rdx], r14
jmp 0x180033076
lea r8, [rsp + 0x60]
lea rcx, [rbp + 0xa0]
call fcn.18003b880
mov rcx, qword [rbp + 0xa0]
mov rax, qword [rcx]
mov qword [0x18033c8a8], rax
mov rax, qword [rbp + 0xb0]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800330be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800330be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1801e62e0
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r14
lea rcx, [rbp + 0x70]
call fcn.18003bcb0
lea rcx, [rbp + 0x50]
call fcn.18003bcb0
nop
lea rcx, [0x18033c8a4]
call fcn.1801e6478
mov dword [0x1802bdc48], r14d
mov dword [0x1802bdc58], r14d
movabs rsi, 0x4f8644af03d0e0d6
mov qword [0x18033c890], rsi
call fcn.1800cdff0
mov ecx, dword [rax]
call qword [0x18033c8a8]
mov qword [rbp + 8], r14
mov rcx, r14
mov qword [rbp + 0x18], rcx
mov rdx, r15
mov qword [rbp + 0x20], rdx
mov byte [rbp + 8], cl
mov rbx, qword [rax + 0x10a8]
mov qword [rsp + 0x60], rbx
test rbx, rbx
je 0x180033366
movzx eax, byte [rbx + 0xc8]
movzx ecx, byte [rbx + 0xc9]
movzx edx, byte [rbx + 0xca]
movzx r9d, byte [rbx + 0xcb]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea r8, str.rIP:__u._u._u._u
mov edx, 0x1f
lea rcx, [rbp + 0x6d8]
call fcn.18003b700
movzx edx, byte [rbx + 0xc8]
lea rcx, [rbp + 0x180]
call fcn.18003b5c0
mov rsi, rax
movzx edx, byte [rbx + 0xc9]
lea rcx, [rbp + 0x1a0]
call fcn.18003b5c0
mov rdi, rax
movzx edx, byte [rbx + 0xca]
lea rcx, [rbp + 0x1c0]
call fcn.18003b5c0
mov rbx, rax
mov rax, qword [rsp + 0x60]
movzx edx, byte [rax + 0xcb]
lea rcx, [rbp + 0x1e0]
call fcn.18003b5c0
nop
lea rdx, [0x18020749c]
mov rcx, rax
call fcn.180035df0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xe0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xf0], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], r15
mov byte [rax], 0
mov r9, rbx
lea r8, [rbp + 0xe0]
lea rcx, [rbp + 0x28]
call fcn.180035960
nop
lea rdx, [0x18020749c]
lea rcx, [rbp + 0x28]
call fcn.180035df0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x100], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x110], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], r15
mov byte [rax], 0
mov r9, rdi
lea r8, [rbp + 0x100]
lea rcx, [rbp - 0x18]
call fcn.180035960
nop
lea rdx, [0x18020749c]
lea rcx, [rbp - 0x18]
call fcn.180035df0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x120], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x130], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], r15
mov byte [rax], 0
mov r9, rsi
lea r8, [rbp + 0x120]
lea rcx, [rbp - 0x78]
call fcn.180035960
lea rcx, [rbp + 8]
call fcn.18003bcb0
movups xmm0, xmmword [rbp - 0x78]
movups xmmword [rbp + 8], xmm0
movups xmm1, xmmword [rbp - 0x68]
movups xmmword [rbp + 0x18], xmm1
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], r15
mov byte [rbp - 0x78], 0
lea rcx, [rbp - 0x78]
call fcn.18003bcb0
nop
lea rcx, [rbp + 0x120]
call fcn.18003bcb0
nop
lea rcx, [rbp - 0x18]
call fcn.18003bcb0
nop
lea rcx, [rbp + 0x100]
call fcn.18003bcb0
nop
lea rcx, [rbp + 0x28]
call fcn.18003bcb0
nop
lea rcx, [rbp + 0xe0]
call fcn.18003bcb0
nop
lea rcx, [rbp + 0x1e0]
call fcn.18003bcb0
nop
lea rcx, [rbp + 0x1c0]
call fcn.18003bcb0
nop
lea rcx, [rbp + 0x1a0]
call fcn.18003bcb0
nop
lea rcx, [rbp + 0x180]
call fcn.18003bcb0
mov rdx, qword [rbp + 0x20]
mov rcx, qword [rbp + 0x18]
mov rdi, qword [rbp + 0x6d0]
movabs rsi, 0x4f8644af03d0e0d6
mov qword [rbp + 0x28], r14
mov qword [rbp + 0x38], r14
mov qword [rbp + 0x40], r15
mov byte [rbp + 0x28], 0
mov qword [rbp + 0x120], r14
mov qword [rbp + 0x130], r14
mov qword [rbp + 0x138], r15
mov byte [rbp + 0x120], 0
mov qword [rbp + 0x100], r14
mov qword [rbp + 0x110], r14
mov qword [rbp + 0x118], r15
mov byte [rbp + 0x100], 0
mov qword [rbp + 0xe0], r14
mov qword [rbp + 0xf0], r14
mov qword [rbp + 0xf8], r15
mov byte [rbp + 0xe0], 0
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
sub rax, rcx
cmp rax, 0x16
jb 0x18003457e
lea rax, [rbp + 8]
cmp rdx, 0x10
cmovae rax, qword [rbp + 8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x16
lea r9, str.http:__ip_api.com_php_
lea rcx, [rbp - 0x18]
call fcn.180035b60
nop
lea rdx, str._fields
lea rcx, [rbp - 0x18]
call fcn.180035df0
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], r15
mov byte [rax], 0
lea rdx, str.city
lea rcx, [rbp - 0x78]
call fcn.180035df0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1e0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1f0], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], r15
mov byte [rax], 0
lea rcx, [rbp - 0x78]
call fcn.18003bcb0
nop
lea rcx, [rbp - 0x18]
call fcn.18003bcb0
mov rax, rbx
mov rcx, qword [rbp + 0x18]
sub rax, rcx
cmp rax, 0x16
jb 0x180034584
lea rax, [rbp + 8]
cmp qword [rbp + 0x20], 0x10
cmovae rax, qword [rbp + 8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x16
lea r9, str.http:__ip_api.com_php_
lea rcx, [rbp + 0xc0]
call fcn.180035b60
nop
lea rdx, str._fields
lea rcx, [rbp + 0xc0]
call fcn.180035df0
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], r15
mov byte [rax], 0
lea rdx, str.country
lea rcx, [rbp - 0x58]
call fcn.180035df0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1c0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1d0], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], r15
mov byte [rax], 0
lea rcx, [rbp - 0x58]
call fcn.18003bcb0
nop
lea rcx, [rbp + 0xc0]
call fcn.18003bcb0
mov rax, rbx
mov rcx, qword [rbp + 0x18]
sub rax, rcx
cmp rax, 0x16
jb 0x18003458a
lea rax, [rbp + 8]
cmp qword [rbp + 0x20], 0x10
cmovae rax, qword [rbp + 8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x16
lea r9, str.http:__ip_api.com_php_
lea rcx, [rbp - 0x18]
call fcn.180035b60
nop
lea rdx, str._fields
lea rcx, [rbp - 0x18]
call fcn.180035df0
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], r15
mov byte [rax], 0
lea rdx, [0x180206a80]
lea rcx, [rbp - 0x78]
call fcn.180035df0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1a0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1b0], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], r15
mov byte [rax], 0
lea rcx, [rbp - 0x78]
call fcn.18003bcb0
nop
lea rcx, [rbp - 0x18]
call fcn.18003bcb0
mov rcx, qword [rbp + 0x18]
sub rbx, rcx
cmp rbx, 0x16
jb 0x180034565
lea rax, [rbp + 8]
cmp qword [rbp + 0x20], 0x10
cmovae rax, qword [rbp + 8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x16
lea r9, str.http:__ip_api.com_php_
lea rcx, [rbp + 0xc0]
call fcn.180035b60
nop
lea rdx, str._fields
lea rcx, [rbp + 0xc0]
call fcn.180035df0
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], r15
mov byte [rax], 0
lea rdx, str.regionName
lea rcx, [rbp - 0x58]
call fcn.180035df0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x180], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x190], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], r15
mov byte [rax], 0
lea rcx, [rbp - 0x58]
call fcn.18003bcb0
nop
lea rcx, [rbp + 0xc0]
call fcn.18003bcb0
xorps xmm0, xmm0
movups xmmword [rbp + 0x6f8], xmm0
movups xmmword [rbp + 0x708], xmm0
mov eax, 4
mov eax, dword [rdi + rax]
cmp dword [0x18033c8b0], eax
jle 0x18003385b
lea rcx, [0x18033c8b0]
call fcn.1801e64d8
cmp dword [0x18033c8b0], 0xffffffff
jne 0x18003385b
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x60], r14
mov qword [rbp + 0x68], r15
mov byte [rbp + 0x50], 0
mov qword [rbp + 0x70], r14
mov qword [rbp + 0x80], r14
mov qword [rbp + 0x88], r15
mov byte [rbp + 0x70], 0
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r14
mov r8d, 0x2c
lea rdx, str.40_53_48_83_EC_20_33_DB_38_1D_________74_1C
lea rcx, [rbp + 0x50]
call fcn.1800bd1d0
nop
cmp byte [rbp + 0xb8], 0
jne 0x180033795
mov edx, 1
lea rcx, [rbp + 0x50]
call fcn.1800bd5e0
cmp byte [rbp + 0xb8], 0
jne 0x180033795
mov edx, 0x7fffffff
lea rcx, [rbp + 0x50]
call fcn.1800bd5e0
mov rdx, qword [rbp + 0xa8]
mov rax, rdx
mov rcx, qword [rbp + 0xa0]
sub rax, rcx
sar rax, 3
test rax, rax
jne 0x1800337dd
mov qword [rsp + 0x60], r14
cmp rdx, qword [rbp + 0xb0]
je 0x1800337c5
mov qword [rdx], r14
jmp 0x1800337dd
lea r8, [rsp + 0x60]
lea rcx, [rbp + 0xa0]
call fcn.18003b880
mov rcx, qword [rbp + 0xa0]
mov rax, qword [rcx]
mov qword [0x18033c8b8], rax
mov rax, qword [rbp + 0xb0]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180033825
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180033825
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1801e62e0
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r14
lea rcx, [rbp + 0x70]
call fcn.18003bcb0
lea rcx, [rbp + 0x50]
call fcn.18003bcb0
nop
lea rcx, [0x18033c8b0]
call fcn.1801e6478
mov dword [0x1802bdc48], r14d
mov dword [0x1802bdc58], r14d
mov qword [0x18033c890], rsi
call fcn.1800cdff0
mov ecx, dword [rax]
call qword [0x18033c8b8]
mov rbx, qword [rax + 0x10a8]
test rbx, rbx
je 0x1800339f0
movzx eax, byte [rbx + 0xc8]
movzx ecx, byte [rbx + 0xc9]
movzx r8d, byte [rbx + 0xca]
movzx r9d, byte [rbx + 0xcb]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], r8d
lea r8, str._u._u._u._u
mov edx, 0x1f
lea rcx, [rbp + 0x6f8]
call fcn.18003b700
movzx edx, byte [rbx + 0xcb]
lea rcx, [rbp - 0x18]
call fcn.18003b5c0
mov rdi, rax
lea rax, [rbp + 0x28]
cmp rax, rdi
je 0x18003390f
lea rcx, [rbp + 0x28]
call fcn.18003bcb0
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp + 0x38], xmm1
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r15
mov byte [rdi], 0
lea rcx, [rbp - 0x18]
call fcn.18003bcb0
movzx edx, byte [rbx + 0xca]
lea rcx, [rbp - 0x18]
call fcn.18003b5c0
mov rdi, rax
lea rax, [rbp + 0x28]
cmp rax, rdi
je 0x180033957
lea rcx, [rbp + 0x28]
call fcn.18003bcb0
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp + 0x38], xmm1
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r15
mov byte [rdi], 0
lea rcx, [rbp - 0x18]
call fcn.18003bcb0
movzx edx, byte [rbx + 0xc9]
lea rcx, [rbp - 0x18]
call fcn.18003b5c0
mov rdi, rax
lea rax, [rbp + 0x28]
cmp rax, rdi
je 0x18003399f
lea rcx, [rbp + 0x28]
call fcn.18003bcb0
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp + 0x38], xmm1
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r15
mov byte [rdi], 0
lea rcx, [rbp - 0x18]
call fcn.18003bcb0
movzx edx, byte [rbx + 0xc8]
lea rcx, [rbp - 0x18]
call fcn.18003b5c0
mov rbx, rax
lea rax, [rbp + 0x28]
cmp rax, rbx
je 0x1800339e7
lea rcx, [rbp + 0x28]
call fcn.18003bcb0
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x38], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r15
mov byte [rbx], 0
lea rcx, [rbp - 0x18]
call fcn.18003bcb0
mov dword [0x1802bdc48], r14d
mov dword [0x1802bdc58], r14d
mov qword [0x18033c890], rsi
call fcn.1800cdff0
mov ecx, dword [rax]
mov dword [0x1802bdc58], r14d
movabs rax, 0x388eb2b86c73b6b3
mov qword [0x18033c890], rax
mov qword [rbp + 0x6d0], r14
mov dword [rbp + 0x6d0], ecx
mov rax, qword [rbp + 0x6d0]
mov qword [0x1802bdd20], rax
lea rax, [rbp + 0x5a0]
mov qword [0x1802bdd28], rax
mov qword [rbp + 0x6d0], r14
mov dword [rbp + 0x6d0], 0xd
mov rax, qword [rbp + 0x6d0]
mov qword [0x1802bdd30], rax
mov dword [0x1802bdc48], 3
call fcn.1800cdff0
mov dword [0x1802bdc58], r14d
movabs rax, 0x6f79b93b0a8e4133
mov qword [0x18033c890], rax
lea rax, [rbp + 0x5a0]
mov qword [0x1802bdd20], rax
mov qword [rbp + 0x6d0], r14
mov dword [rbp + 0x6d0], 0xd
mov rax, qword [rbp + 0x6d0]
mov qword [0x1802bdd28], rax
mov dword [0x1802bdc48], 2
call fcn.1800cdff0
mov dword [rbp + 0x360], 0x40
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov r8, qword [rbp + 0x368]
shr r8, 0xa
lea rdx, str._I64i
lea rcx, [rbp + 0xb60]
call fcn.180035900
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x950]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x740]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x6c], r14d
mov dword [rsp + 0x68], r14d
mov dword [rsp + 0x70], r14d
mov dword [rsp + 0x38], 0x105
lea rax, [rbp + 0x740]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x6c]
mov r8d, 0x105
lea rdx, [rbp + 0x950]
lea rcx, [0x180206ab0]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x740]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x6c]
lea r8, [rbp + 0xb60]
lea rdx, str._s_li_ws_li
lea rcx, [rbp + 0xb60]
call fcn.180035900
mov dword [rsp + 0x74], 0x10
lea rdx, [rsp + 0x74]
lea rcx, [rbp + 0x718]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rbp + 0x718]
lea r8, [rbp + 0xb60]
lea rdx, str._s_ws
lea rcx, [rbp + 0xb60]
call fcn.180035900
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [0x18026c430]
mulsd xmm0, qword [0x18026c840]
cvttsd2si rax, xmm0
mov qword [rsp + 0x60], rax
lea rcx, [rbp - 0x18]
call fcn.180032610
nop
mov rcx, rax
call fcn.18003c570
mov r9d, 8
mov r8, rax
mov edx, 0xff
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov byte [rbp + 0x59e], 0
lea rcx, [rbp - 0x18]
call fcn.18003bcb0
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], r15
mov byte [rbp - 0x78], 0
lea rax, [rbp + 0xb60]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180033c84
lea rdx, [rbp + 0xb60]
lea rcx, [rbp - 0x78]
call fcn.18003be70
nop
lea rax, vtable.sw::templates::basic_sha512_char_.0
mov qword [rbp + 0x200], rax
movabs rax, 0x6a09e667f3bcc908
mov qword [rbp + 0x210], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rbp + 0x218], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rbp + 0x220], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rbp + 0x228], rax
movabs rax, 0x510e527fade682d1
mov qword [rbp + 0x230], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rbp + 0x238], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rbp + 0x240], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rbp + 0x248], rax
mov dword [rbp + 0x250], r14d
mov qword [rbp + 0x208], r14
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x254]
call sub.VCRUNTIME140.dll_memset
nop
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rdx, qword [rbp - 0x78]
mov qword [rbp + 0x6d0], rdx
mov edi, 0x80
mov ecx, dword [rbp + 0x250]
sub edi, ecx
mov eax, edi
mov esi, dword [rbp - 0x68]
cmp qword [rbp - 0x68], rax
cmovb edi, esi
mov r8d, edi
mov qword [rsp + 0x50], r8
mov eax, ecx
lea rcx, [rbp + 0x254]
add rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [rbp + 0x250]
mov eax, ecx
add rax, qword [rbp - 0x68]
cmp rax, 0x80
jae 0x180033dbd
add ecx, esi
mov dword [rbp + 0x250], ecx
jmp 0x180033e2b
sub esi, edi
mov edi, esi
shr edi, 7
mov rbx, qword [rsp + 0x50]
add rbx, qword [rbp + 0x6d0]
mov r8d, 1
lea rdx, [rbp + 0x254]
lea rcx, [rbp + 0x200]
call fcn.180034ef0
mov r8d, edi
mov rdx, rbx
lea rcx, [rbp + 0x200]
call fcn.180034ef0
and esi, 0x7f
mov r8d, esi
mov edx, edi
shl edx, 7
add rdx, rbx
lea rcx, [rbp + 0x254]
call sub.VCRUNTIME140.dll_memcpy
mov dword [rbp + 0x250], esi
shl edi, 7
lea eax, [rdi + 0x80]
add qword [rbp + 0x208], rax
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x200]
call fcn.1800345d0
nop
lea rcx, [rbp + 0x160]
call fcn.1800327f0
mov rbx, rax
lea rsi, [rbp - 0x18]
cmp qword [rbp], 0x10
cmovae rsi, qword [rbp - 0x18]
mov qword [rbp + 0x6d0], r13
cmp qword [r13 + 0x18], 0x10
jb 0x180033e72
mov rax, qword [r13]
mov qword [rbp + 0x6d0], rax
mov qword [rsp + 0x58], r12
cmp qword [r12 + 0x18], 0x10
jb 0x180033e88
mov rax, qword [r12]
mov qword [rsp + 0x58], rax
mov edi, dword [rbx + 0x10]
mov r8, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x180033e98
mov r8, qword [rbx]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
lea r9d, [rdi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x50], eax
movsxd rcx, eax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1801e65f0
mov rcx, rax
mov qword [rbp - 0x58], rax
cmp qword [rbx + 0x18], 0x10
jb 0x180033ee3
mov rbx, qword [rbx]
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
lea r9d, [rdi + 1]
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rax, qword [rsp + 0x60]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rsi
mov rax, qword [rbp + 0x6d0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, str.username_spassword_shwid_sreference_u
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x58]
xor r8d, r8d
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x3a0]
call fcn.18003b1e0
nop
lea rcx, [rbp + 0x160]
call fcn.18003bcb0
nop
lea rcx, [rbp - 0x18]
call fcn.18003bcb0
nop
lea rcx, [rbp - 0x78]
call fcn.18003bcb0
lea rcx, [rbp + 0xc0]
call fcn.180032a20
mov rbx, rax
mov dword [0x1802bdc48], r14d
mov dword [0x1802bdc58], r14d
movabs rax, 0x4f8644af03d0e0d6
mov qword [0x18033c890], rax
call fcn.1800cdff0
mov eax, dword [rax]
mov dword [rsp + 0x58], eax
mov qword [rbp + 0x6d0], r13
cmp qword [r13 + 0x18], 0x10
jb 0x180033fbe
mov rax, qword [r13]
mov qword [rbp + 0x6d0], rax
mov rsi, r12
cmp qword [r12 + 0x18], 0x10
jb 0x180033fcd
mov rsi, qword [r12]
mov edi, dword [rbx + 0x10]
mov r8, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x180033fdd
mov r8, qword [rbx]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
lea r9d, [rdi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x50], eax
movsxd rcx, eax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1801e65f0
mov rcx, rax
mov qword [rbp - 0x58], rax
cmp qword [rbx + 0x18], 0x10
jb 0x180034028
mov rbx, qword [rbx]
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
lea r9d, [rdi + 1]
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [rsp + 0x58]
call qword [0x180333738]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp + 0x6d0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
lea rax, str.username_spassword_sSocialClub_sreference_u
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x58]
xor r8d, r8d
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x3a0]
call fcn.18003b1e0
nop
lea rcx, [rbp + 0xc0]
call fcn.18003bcb0
lea rcx, [rbp + 0x160]
call fcn.180032ca0
mov rbx, rax
mov dword [0x1802bdc58], r14d
movabs rax, 0xc82630132081bb6f
mov qword [0x18033c890], rax
lea rax, [rbp + 0x5a0]
mov qword [0x1802bdd20], rax
mov dword [0x1802bdc48], 1
call fcn.1800cdff0
mov rax, qword [rax]
mov qword [rbp - 0x58], rax
mov qword [rbp + 0x6d0], r13
cmp qword [r13 + 0x18], 0x10
jb 0x1800340fa
mov rax, qword [r13]
mov qword [rbp + 0x6d0], rax
mov rsi, r12
cmp qword [r12 + 0x18], 0x10
jb 0x180034109
mov rsi, qword [r12]
mov edi, dword [rbx + 0x10]
mov r8, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x180034119
mov r8, qword [rbx]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
lea r9d, [rdi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x50], eax
movsxd rcx, eax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1801e65f0
mov qword [rsp + 0x58], rax
cmp qword [rbx + 0x18], 0x10
jb 0x180034162
mov rbx, qword [rbx]
mov ecx, dword [rsp + 0x50]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 1]
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rax, qword [rbp - 0x58]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp + 0x6d0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
lea rax, str.username_spassword_sRID_sreference_u
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x58]
xor r8d, r8d
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x3a0]
call fcn.18003b1e0
nop
lea rcx, [rbp + 0x160]
call fcn.18003bcb0
lea rcx, [rbp + 0x140]
mov rax, qword [rbp + 0x150]
cmp qword [rbp + 0x158], 8
jb 0x1800341f3
mov rdi, qword [rbp + 0x140]
lea rbx, [rdi + rax*2]
jmp 0x1800341fe
lea rbx, [rcx + rax*2]
lea rdi, [rbp + 0x140]
mov qword [rbp - 0x38], r14
mov rcx, r14
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x20], r15
mov byte [rbp - 0x38], cl
mov rdx, rbx
sub rdx, rdi
sar rdx, 1
cmp rdx, 0x10
jb 0x180034233
lea rcx, [rbp - 0x38]
call fcn.180035c80
mov rcx, r14
mov qword [rbp - 0x28], rcx
mov r15, qword [rbp - 0x20]
lea rax, [rbp - 0x38]
mov qword [rbp - 0x58], rax
cmp rdi, rbx
je 0x180034285
movzx r9d, byte [rdi]
cmp rcx, r15
jae 0x180034269
lea rax, [rcx + 1]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x38]
cmp r15, 0x10
cmovae rax, qword [rbp - 0x38]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x180034272
lea rcx, [rbp - 0x38]
call fcn.18003bb40
add rdi, 2
cmp rdi, rbx
je 0x180034285
mov r15, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x28]
jmp 0x180034240
mov cl, 1
call qword [sym.imp.MSVCP140.dll_private:_static_class_std::locale::_Locimp____ptr64___cdecl_std::locale::_Init_bool_]
mov qword [rbp - 0x50], rax
lea rbx, [rbp - 0x38]
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
cmovae rbx, rcx
mov esi, 4
nop word [rax + rax]
lea rax, [rbp - 0x38]
cmp rdx, 0x10
cmovae rax, rcx
mov r8, qword [rbp - 0x28]
add rax, r8
cmp rbx, rax
je 0x1800342f9
movzx edi, byte [rbx]
lea rcx, [rbp - 0x58]
call fcn.180036010
mov rcx, rax
movzx r8d, dil
movzx edx, si
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ctype_char_::is_short_int__char_const___ptr64]
mov rdx, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x38]
test al, al
je 0x1800342f5
inc rbx
jmp 0x1800342b0
mov r8, qword [rbp - 0x28]
test r8, r8
je 0x180034316
lea rax, [rbp - 0x38]
cmp rdx, 0x10
cmovae rax, rcx
add rax, r8
cmp rbx, rax
jne 0x180034316
mov bl, 1
jmp 0x180034318
xor bl, bl
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x18003433a
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x18003433a
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
test bl, bl
je 0x180034573
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 0x160]
call fcn.180036220
mov rbx, rax
mov qword [rbp + 0x6d0], rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rsi, rax
mov rdi, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x180034372
mov rdi, qword [rbx]
mov dword [rax], r14d
mov r8d, 0xa
lea rdx, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoull]
mov rdx, rax
cmp rdi, qword [rbp - 0x58]
jne 0x18003439f
lea rcx, str.invalid_stoull_argument
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const____ptr64_]
int3
cmp dword [rsi], 0x22
jne 0x1800343b2
lea rcx, str.stoull_argument_out_of_range
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
int3
shr rax, 0x20
mov byte [rsp + 0x58], dl
mov byte [rsp + 0x50], al
mov rcx, rdx
shr rcx, 8
mov rax, rdx
shr rax, 0x28
mov byte [rsp + 0x51], cl
mov byte [rsp + 0x59], al
mov rcx, rdx
shr rcx, 0x10
mov rax, rdx
shr rax, 0x30
mov byte [rsp + 0x5a], cl
mov byte [rsp + 0x52], al
mov rax, rdx
shr rax, 0x18
shr rdx, 0x38
mov byte [rsp + 0x53], al
mov byte [rsp + 0x5b], dl
mov ecx, dword [rsp + 0x60]
mov byte [rbp + 0x6d0], cl
mov eax, ecx
shr rax, 8
mov byte [rbp + 0x6d1], al
mov eax, ecx
shr rax, 0x10
mov byte [rbp + 0x6d2], al
mov eax, ecx
shr rax, 0x18
mov byte [rbp + 0x6d3], al
mov eax, ecx
shr rax, 0x20
mov byte [rbp + 0x6d4], al
mov eax, ecx
shr rax, 0x28
mov byte [rbp + 0x6d5], al
mov eax, ecx
shr rax, 0x30
mov byte [rbp + 0x6d6], al
shr rcx, 0x38
mov byte [rbp + 0x6d7], cl
nop dword [rax]
movzx ecx, byte [rsp + r14 + 0x58]
movzx eax, byte [rsp + r14 + 0x50]
cmp byte [rbp + rcx + 0x6cf], al
jne 0x18003456b
inc r14
cmp r14, 4
jl 0x180034460
mov rcx, rbx
call fcn.18003bcb0
nop
lea rcx, [rbp - 0x38]
call fcn.18003bcb0
nop
lea rcx, [rbp + 0xc0]
call fcn.18003b160
nop
lea rcx, [rbp - 0x18]
call fcn.18003b160
nop
lea rcx, [rbp + 0x140]
call fcn.18003b160
nop
lea rcx, [rbp + 0x180]
call fcn.18003bcb0
nop
lea rcx, [rbp + 0x1a0]
call fcn.18003bcb0
nop
lea rcx, [rbp + 0x1c0]
call fcn.18003bcb0
nop
lea rcx, [rbp + 0x1e0]
call fcn.18003bcb0
nop
lea rcx, [rbp + 0xe0]
call fcn.18003bcb0
nop
lea rcx, [rbp + 0x100]
call fcn.18003bcb0
nop
lea rcx, [rbp + 0x120]
call fcn.18003bcb0
nop
lea rcx, [rbp + 0x28]
call fcn.18003bcb0
nop
lea rcx, [rbp + 8]
call fcn.18003bcb0
nop
mov rcx, r12
call fcn.18003bcb0
nop
mov rcx, r13
call fcn.18003bcb0
mov al, 1
mov rcx, qword [rbp + 0x1b60]
xor rcx, rsp
call fcn.1801e62c0
mov rbx, qword [rsp + 0x1cc0]
add rsp, 0x1c70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18003bd20
nop
mov rcx, rbx
call fcn.18003bcb0
call fcn.180061630
call fcn.180061660
nop
call fcn.18003bd20
nop
call fcn.18003bd20
nop
call fcn.18003bd20
int3