Function at 0x1800510e0
Capabilities:
Enumerate gui resources
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2a8]
sub rsp, 0x380
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x180177040]
xor rax, rsp
mov qword [rbp + 0x260], rax
movabs rax, 0xcd54e9e4f7ff477a
lea rcx, [rbp + 0x50]
mov qword [rsp + 0x40], rax
movabs rsi, 0x2cdd8aa76880c676
mov rax, qword [rsp + 0x40]
movabs r14, 0xcd3ce994f78c471b
mov qword [rbp - 0x70], rax
movabs rdi, 0xab0233a545d5cf34
movabs rax, 0xab6333cc45adcf4d
movabs r15, 0x7c953a565dc97fd5
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
movabs rax, 0x7cf23a395da57ffb
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x58], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x20], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp - 0x60]
movdqa xmm6, xmmword [rbp - 0x70]
xorps xmm6, xmmword [rbp + 0x20]
mov qword [rbp + 0x38], rax
xorps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmmword [rbp - 0x70], xmm6
call fcn.180050c10
test al, al
je 0x180052557
cmp word [rbp + 0x50], 0
lea rax, [rbp + 0x50]
je 0x18005121a
nop dword [rax]
add rax, 2
cmp word [rax], 0
jne 0x180051210
movq rcx, xmm6
test cx, cx
je 0x180051240
lea rdx, [rbp - 0x70]
sub rdx, rax
nop dword [rax + rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x180051230
xor r13d, r13d
lea rcx, [rbp + 0x50]
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov r8d, 1
mov dword [rsp + 0x20], 2
mov word [rax], r13w
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x180177ed8], rax
cmp rax, 0xffffffffffffffff
je 0x180052557
xor r9d, r9d
mov qword [rsp + 0x20], r13
mov r8d, 3
lea rdx, [0x180160848]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
call fcn.180073ee0
movabs rax, 0xed5b87fd90eb2877
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x70]
mov rax, qword [rsp + 0x40]
movabs r12, 0xe268d6816a28a468
mov qword [rbp - 0x70], rax
movabs rbx, 0x6b0ae600e34c08cf
movabs rax, 0xc2225ec031a6b647
mov r8d, edx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
movabs rax, 0x6fc563734bd16bb
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
movabs rax, 0x43beaac907e9b217
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x58], rax
movabs rax, 0x6b6e8374862078a2
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x50], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x48], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp - 0x70]
xorps xmm2, xmmword [rsp + 0x50]
movdqa xmm0, xmmword [rbp - 0x60]
movdqa xmm1, xmmword [rbp - 0x50]
xorps xmm0, xmmword [rsp + 0x60]
mov qword [rsp + 0x78], rax
movq rax, xmm2
xorps xmm1, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x70], xmm2
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmmword [rbp - 0x50], xmm1
test al, al
je 0x1800513eb
nop
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x1800513e0
mov rcx, qword [0x180177ed8]
sub r8d, edx
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.180074590
test al, al
je 0x180052557
xor edx, edx
call fcn.180073ee0
movabs rax, 0xbe1c90e698e12276
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x70]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp - 0x70], rax
movabs rax, 0xc56b13c820a1bc4d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
movabs rax, 0x1def533a3ca00bbc
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
movabs rax, 0x41b2e98706efaf02
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x58], rax
movabs rax, 0x6b0a8265972964bf
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x50], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x48], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp - 0x70]
xorps xmm2, xmmword [rsp + 0x50]
movdqa xmm0, xmmword [rbp - 0x60]
movdqa xmm1, xmmword [rbp - 0x50]
xorps xmm0, xmmword [rsp + 0x60]
mov qword [rsp + 0x78], rax
movq rax, xmm2
xorps xmm1, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x70], xmm2
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmmword [rbp - 0x50], xmm1
test al, al
je 0x18005154b
nop dword [rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180051540
mov rcx, qword [0x180177ed8]
sub r8d, edx
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.1800741b0
test al, al
je 0x180052557
xor edx, edx
call fcn.180073ee0
movabs rax, 0xbe459ab49ff82676
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x70]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp - 0x70], rax
movabs rax, 0xdf6b5dcc65b8aa40
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
movabs rax, 0x15e15b2c34a51ebc
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
movabs rax, 0x40ade7c80ba0a819
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x58], rax
movabs rax, 0x6b0ae60087297caa
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x50], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x48], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp - 0x70]
xorps xmm2, xmmword [rsp + 0x50]
movdqa xmm0, xmmword [rbp - 0x60]
movdqa xmm1, xmmword [rbp - 0x50]
xorps xmm0, xmmword [rsp + 0x60]
mov qword [rsp + 0x78], rax
movq rax, xmm2
xorps xmm1, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x70], xmm2
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmmword [rbp - 0x50], xmm1
test al, al
je 0x1800516ab
nop dword [rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x1800516a0
mov rcx, qword [0x180177ed8]
sub r8d, edx
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.18005f730
test al, al
je 0x180052557
xor edx, edx
call fcn.180073ee0
movabs rax, 0xae5d8fe692f82972
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x70]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp - 0x70], rax
movabs rax, 0xc2765acb2cf5bc51
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
movabs rax, 0x13fc4e3727a013b4
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
movabs rax, 0x49b1faca07e3e618
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x58], rax
movabs rax, 0x6b0ae600e3286dbb
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x50], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x48], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp - 0x70]
xorps xmm2, xmmword [rsp + 0x50]
movdqa xmm0, xmmword [rbp - 0x60]
movdqa xmm1, xmmword [rbp - 0x50]
xorps xmm0, xmmword [rsp + 0x60]
mov qword [rsp + 0x78], rax
movq rax, xmm2
xorps xmm1, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x70], xmm2
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmmword [rbp - 0x50], xmm1
test al, al
je 0x18005180b
nop dword [rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180051800
mov rcx, qword [0x180177ed8]
sub r8d, edx
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rax, 0xff12d8bac7b8692a
lea rbx, [rbp - 0x30]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x30], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x28], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x40], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp - 0x30]
mov rcx, qword [0x180179760]
mov qword [rbp - 0x38], rax
xorps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x30], xmm0
mov rax, qword [rcx]
mov rdx, qword [rax + 0x290]
call rdx
test rax, rax
je 0x1800518bb
lea rcx, [rbp - 0x30]
sub rax, rcx
nop word [rax + rax]
movzx ecx, byte [rax + rbx]
movzx edx, byte [rbx]
lea rbx, [rbx + 1]
test cl, cl
je 0x1800518b3
cmp cl, dl
je 0x1800518a0
cmp cl, dl
je 0x180051d1a
mov dl, 2
call fcn.180073ee0
movabs rax, 0xed5286fd84fe226d
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x20]
mov rax, qword [rsp + 0x40]
movabs rbx, 0x6b0ae600e34c08cf
mov qword [rbp - 0x20], rax
mov r8d, edx
movabs rax, 0xc36147c428a6a659
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x18], rax
movabs rax, 0x5cf95b3532a55ff4
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x10], rax
movabs rax, 0x5fafefd148b29535
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 8], rax
movabs rax, 0x6b0ae620d92267a6
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp + 8], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x20], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r15
mov qword [rbp + 0x28], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x30], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x40], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp - 0x20]
xorps xmm2, xmmword [rbp + 0x20]
movdqa xmm0, xmmword [rbp - 0x10]
movdqa xmm1, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x30]
mov qword [rbp + 0x48], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x40]
movdqa xmmword [rbp - 0x20], xmm2
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmmword [rbp], xmm1
test al, al
je 0x1800519ef
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x1800519e4
mov rcx, qword [0x180177ed8]
sub r8d, edx
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rax, 0xff12d8bac7b8692a
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x40]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp - 0x40], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x38], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x20], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp - 0x40]
mov qword [rbp + 0x28], rax
xorps xmm0, xmmword [rbp + 0x20]
movq rax, xmm0
movdqa xmmword [rbp - 0x40], xmm0
test al, al
je 0x180051a7b
nop
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180051a70
mov rcx, qword [0x180177ed8]
sub r8d, edx
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rax, 0xa3599be682ef6737
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x70]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp - 0x70], rax
movabs rax, 0xce7413971696ef40
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
movabs rax, 0x7cb5003832a00ca7
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x58], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x20], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
movdqa xmm1, xmmword [rbp - 0x70]
xorps xmm1, xmmword [rbp + 0x20]
movdqa xmm0, xmmword [rbp - 0x60]
mov qword [rbp + 0x38], rax
movq rax, xmm1
xorps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmmword [rbp - 0x60], xmm0
test al, al
je 0x180051b60
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180051b55
mov rcx, qword [0x180177ed8]
sub r8d, edx
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x180179760]
mov rax, qword [rcx]
mov rdx, qword [rax + 0x290]
call rdx
mov rcx, rax
mov r8d, eax
cmp byte [rax], r13b
je 0x180051bab
nop word [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180051ba0
mov rcx, qword [0x180177ed8]
sub r8d, eax
xor r9d, r9d
mov qword [rsp + 0x20], r13
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rax, 0xb54581e484ed6735
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rsp + 0x50], rax
movabs rax, 0xdf6a54cc28f5ae5d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
movabs rax, 0x12e05c7629a611f5
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
movabs rax, 0x5fbcaac907e9b215
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
movabs rax, 0x4566876d912366ef
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x20], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r15
mov qword [rbp + 0x28], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x30], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x40], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rsp + 0x50]
xorps xmm2, xmmword [rbp + 0x20]
movdqa xmm0, xmmword [rsp + 0x60]
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp + 0x30]
mov qword [rbp + 0x48], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x40]
movdqa xmmword [rsp + 0x50], xmm2
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0x70], xmm1
test al, al
je 0x180051cfb
nop dword [rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180051cf0
mov rcx, qword [0x180177ed8]
sub r8d, edx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x180051d24
movabs rbx, 0x6b0ae600e34c08cf
movabs rax, 0xcd4ee9f1f7e5476f
lea rcx, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x70], rax
movabs rax, 0xab6e33c145fbcf04
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
movabs rax, 0x7c953a565dc97fb9
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x58], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x20], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp - 0x70]
movdqa xmm1, xmmword [rbp - 0x60]
xorps xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x38], rax
xorps xmm1, xmmword [rbp + 0x30]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmmword [rbp - 0x70], xmm0
call fcn.180075560
mov r8, rax
test rax, rax
je 0x180052557
movabs rax, 0xa25086d799e30424
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x40], rax
movabs rax, 0xea5b73e522a68246
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x40], rax
movabs rax, 0x10fa79001f8c3e8d
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x58], rcx
mov rcx, r8
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
movabs rax, 0x689fcff728c0b419
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
movabs rax, 0x6b0ae600e34c5295
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x20], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x18], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 8], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp - 0x20]
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm1, xmmword [rbp - 0x10]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm0, xmmword [rsp + 0x70]
mov qword [rbp + 8], rax
xorps xmm0, xmmword [rbp]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmmword [rsp + 0x60], xmm1
call fcn.180075830
mov qword [0x180179ca0], rax
test rax, rax
je 0x180052557
xor edx, edx
call fcn.180073ee0
movabs rax, 0xb95587fdd7e72368
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x70]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp - 0x70], rax
movabs rax, 0xc27652df2cb9ae5d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
movabs rax, 0x10e557393ee911ba
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
movabs rax, 0x2cdd8aa70ce5b213
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x58], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x20], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
movdqa xmm1, xmmword [rbp - 0x70]
xorps xmm1, xmmword [rbp + 0x20]
movdqa xmm0, xmmword [rbp - 0x60]
mov qword [rbp + 0x38], rax
movq rax, xmm1
xorps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmmword [rbp - 0x60], xmm0
test al, al
je 0x180051feb
nop
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180051fe0
mov rcx, qword [0x180177ed8]
sub r8d, edx
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x180179880]
test rcx, rcx
jne 0x18005204b
nop dword [rax]
nop word [rax + rax]
lea rdx, [0x180179880]
lea rcx, [0x180073e60]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x180179880]
test rcx, rcx
je 0x180052020
lea r8, [0x18005d230]
mov edx, 0xfffffffc
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov qword [0x180179998], rax
test rax, rax
je 0x180052557
xor edx, edx
call fcn.180073ee0
movabs rax, 0xb44fc9e082fc2972
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rsp + 0x50], rax
movabs rax, 0xc26c5a8528b0bb47
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
movabs rax, 0x8f4403f31a816a1
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
movabs rax, 0x5cb0e5c448eea91f
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
movabs rax, 0x6b0ae66486386da3
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x20], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x18], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 8], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rsp + 0x50]
xorps xmm2, xmmword [rbp - 0x20]
movdqa xmm0, xmmword [rsp + 0x60]
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp - 0x10]
mov qword [rbp + 8], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp]
movdqa xmmword [rsp + 0x50], xmm2
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0x70], xmm1
test al, al
je 0x1800521ab
nop word [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x1800521a0
mov rcx, qword [0x180177ed8]
sub r8d, edx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8, qword [0x180179770]
mov rdx, qword [0x180179768]
mov rcx, qword [0x180179880]
call fcn.180072740
xor ecx, ecx
call fcn.180063f10
cmp byte [0x180179778], r13b
jne 0x180052206
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x180179778], r13b
je 0x1800521f2
xor edx, edx
call fcn.180073ee0
movabs rax, 0xbf599bf193e22269
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rsp + 0x50], rax
movabs rax, 0xcf6c56ce26b4ad14
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
movabs rax, 0x10f4532234a716f5
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
movabs rax, 0xcb3e5ce1ce1bc1f
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
movabs rax, 0xe7e836c932167ac
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
movabs rax, 0xe268d6816a28a40c
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x20], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x18], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 8], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rsp + 0x50]
xorps xmm2, xmmword [rbp - 0x20]
movdqa xmm0, xmmword [rsp + 0x60]
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp - 0x10]
mov qword [rbp + 8], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp]
movdqa xmmword [rsp + 0x50], xmm2
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0x70], xmm1
test al, al
je 0x18005234b
nop dword [rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180052340
mov rcx, qword [0x180177ed8]
sub r8d, edx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.18006b7d0
test al, al
jne 0x18005258e
mov dl, 3
call fcn.180073ee0
movabs rbx, 0xb91c8df19be5267d
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x40], rbx
lea rcx, [rbp - 0x70]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp - 0x70], rax
movabs rax, 0xca6b47cc2bbcef5b
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
movabs rax, 0x1dfd597638b316b9
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
movabs rax, 0x2cdd8aa76880b51b
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x58], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x20], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
movdqa xmm1, xmmword [rbp - 0x70]
xorps xmm1, xmmword [rbp + 0x20]
movdqa xmm0, xmmword [rbp - 0x60]
mov qword [rbp + 0x38], rax
movq rax, xmm1
xorps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmmword [rbp - 0x60], xmm0
test al, al
je 0x18005244f
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180052444
mov rcx, qword [0x180177ed8]
sub r8d, edx
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dl, 3
call fcn.180073ee0
mov qword [rsp + 0x40], rbx
lea rdx, [rbp - 0x70]
mov rax, qword [rsp + 0x40]
lea rcx, [rbp - 0x70]
mov qword [rbp - 0x70], rax
mov r8d, edx
movabs rax, 0x8b7246d120a6ef5b
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
movabs rax, 0x7ce6563728ba16a3
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x58], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x20], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
movdqa xmm1, xmmword [rbp - 0x70]
xorps xmm1, xmmword [rbp + 0x20]
movdqa xmm0, xmmword [rbp - 0x60]
mov qword [rbp + 0x38], rax
movq rax, xmm1
xorps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmmword [rbp - 0x60], xmm0
test al, al
je 0x18005253b
nop word [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180052530
mov rcx, qword [0x180177ed8]
sub r8d, edx
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor al, al
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.1800d9270
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor edx, edx
call fcn.180073ee0
movabs rax, 0xbe599be183ed227d
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rsp + 0x50], rax
movabs rax, 0xc7635ad12cbba614
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
movabs rax, 0x5cfb553f29a805bc
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
movabs rax, 0x49a9efcb18eda915
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
movabs rax, 0x6b0ae600e34c08ab
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x20], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x18], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 8], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rsp + 0x50]
xorps xmm2, xmmword [rbp - 0x20]
movdqa xmm0, xmmword [rsp + 0x60]
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp - 0x10]
mov qword [rbp + 8], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp]
movdqa xmmword [rsp + 0x50], xmm2
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0x70], xmm1
test al, al
je 0x1800526cb
nop dword [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x1800526c0
mov rcx, qword [0x180177ed8]
sub r8d, edx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rax, 0xa9129dfa92e52b78
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x40], rax
movabs rax, 0xab0233a545d5a358
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x38], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x20], rax
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp - 0x40]
mov qword [rbp + 0x28], rax
movabs rax, 0xcd59e9fcf7ef4768
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp - 0x40], xmm0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
movabs rax, 0xab6133fa45b4cf59
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
movabs rax, 0x7cfb3a335da07fb9
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
movabs rax, 0x2ca58ad368aec602
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
movabs rax, 0x6b0ae600e34c08bb
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x20], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x18], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 8], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp - 0x20]
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm1, xmmword [rbp - 0x10]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm0, xmmword [rsp + 0x70]
mov qword [rbp + 8], rax
xorps xmm0, xmmword [rbp]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmmword [rsp + 0x60], xmm1
call fcn.1800692a0
test al, al
je 0x180052557
xor edx, edx
call fcn.180073ee0
movabs rax, 0xbe1c88f992e42468
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rsp + 0x50], rax
movabs rax, 0xc56b13c820a1bc4d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
movabs rax, 0x1def533a3ca00bbc
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
movabs rax, 0x41b2e98706efaf02
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
movabs rax, 0x6b0a8265972964bf
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x20], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x18], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 8], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rsp + 0x50]
xorps xmm2, xmmword [rbp - 0x20]
movdqa xmm0, xmmword [rsp + 0x60]
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp - 0x10]
mov qword [rbp + 8], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp]
movdqa xmmword [rsp + 0x50], xmm2
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0x70], xmm1
test al, al
je 0x1800529a0
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180052995
mov rcx, qword [0x180177ed8]
sub r8d, edx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rax, 0xcd4ae9faf7e34778
lea rcx, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x70], rax
movabs rax, 0xab2c33d645a7cf55
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
movabs rax, 0x7c953a225db17fa1
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x58], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x20], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp - 0x70]
movdqa xmm1, xmmword [rbp - 0x60]
xorps xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x38], rax
xorps xmm1, xmmword [rbp + 0x30]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmmword [rbp - 0x70], xmm0
call fcn.180059320
test al, al
je 0x180052557
xor edx, edx
call fcn.180073ee0
movabs rax, 0xed4f9bf581e22878
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rsp + 0x50], rax
movabs rax, 0xc82257c035b8ba50
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
movabs rax, 0x18f04e3331b912ba
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
movabs rax, 0x58a8fad31defe65a
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
movabs rax, 0xa7c886f806e28f5
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
movabs rax, 0xe24aa2f91e06d71a
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x20], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x18], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 8], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rsp + 0x50]
xorps xmm2, xmmword [rbp - 0x20]
movdqa xmm0, xmmword [rsp + 0x60]
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp - 0x10]
mov qword [rbp + 8], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp]
movdqa xmmword [rsp + 0x50], xmm2
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0x70], xmm1
test al, al
je 0x180052bbb
nop
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180052bb0
mov rcx, qword [0x180177ed8]
sub r8d, edx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rdx, 0x68045f57217a8e71
call fcn.180058290
movabs rdx, 0x8b4a6c039af717a8
mov qword [0x180179888], rax
mov r12, rax
call fcn.180058290
movabs rdx, 0xe2d2563b91bdc56c
mov qword [0x1801798a0], rax
mov r15, rax
call fcn.180058290
movabs rdx, 0xd5db34823d6f1c40
mov qword [0x180179898], rax
mov r14, rax
call fcn.180058290
movabs rdx, 0xb231a1bea995f83b
mov qword [0x1801798a8], rax
mov rsi, rax
call fcn.180058290
movabs rdx, 0x5f0720d54e5f164
mov qword [0x180179890], rax
mov rdi, rax
call fcn.180058290
movabs rdx, 0x483047d5ed936395
mov qword [0x1801798b0], rax
mov rbx, rax
call fcn.180058290
test rax, rax
mov qword [0x1801798b8], rax
mov edx, r13d
mov r8d, r13d
setne cl
test rbx, rbx
setne al
and cl, al
test rdi, rdi
movzx eax, cl
mov ecx, r13d
cmovne edx, eax
test rsi, rsi
setne al
and dl, al
test r14, r14
movzx eax, dl
cmovne r8d, eax
test r15, r15
setne al
and r8b, al
test r12, r12
movzx eax, r8b
cmovne ecx, eax
test cl, cl
je 0x180052557
xor edx, edx
call fcn.180073ee0
movabs rax, 0xed4f9bf581e22878
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x40]
movabs r12, 0xe268d6816a28a468
mov qword [rsp + 0x50], rax
movabs r14, 0xcd3ce994f78c471b
movabs rax, 0xc2225ec031a6b647
movabs rdi, 0xab0233a545d5cf34
mov qword [rsp + 0x40], rax
movabs r15, 0x7c953a565dc97fd5
mov rax, qword [rsp + 0x40]
movabs rsi, 0x2cdd8aa76880c676
mov qword [rsp + 0x58], rax
movabs rbx, 0x6b0ae600e34c08cf
movabs rax, 0x6fc563734bd16bb
mov r8d, edx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
movabs rax, 0x43beaac907e9b217
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
movabs rax, 0x6b6e8374862078a2
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x20], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x18], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 8], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rsp + 0x50]
xorps xmm2, xmmword [rbp - 0x20]
movdqa xmm0, xmmword [rsp + 0x60]
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp - 0x10]
mov qword [rbp + 8], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp]
movdqa xmmword [rsp + 0x50], xmm2
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0x70], xmm1
test al, al
je 0x180052e4b
nop word [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180052e40
mov rcx, qword [0x180177ed8]
sub r8d, edx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.18005b180
test al, al
je 0x180052557
xor edx, edx
call fcn.180073ee0
movabs rax, 0xa355c9e79ce32873
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x70]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp - 0x70], rax
movabs rax, 0xca785ac924bcbb5d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
movabs rax, 0x11fa597633a616a1
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
movabs rax, 0x2cddeec21ce5aa06
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x58], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0x20], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
movdqa xmm1, xmmword [rbp - 0x70]
xorps xmm1, xmmword [rbp + 0x20]
movdqa xmm0, xmmword [rbp - 0x60]
mov qword [rbp + 0x38], rax
movq rax, xmm1
xorps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmmword [rbp - 0x60], xmm0
test al, al
je 0x180052f4f
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180052f44
mov rcx, qword [0x180177ed8]
sub r8d, edx
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rax, 0xcd5de9f2f7e9477f
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x40], rax
movabs rax, 0xab0233d145b9cf41
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x38], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x20], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp - 0x40]
mov qword [rbp + 0x28], rax
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp - 0x40], xmm0
call fcn.180054a30
test al, al
jne 0x180053198
mov dl, 2
call fcn.180073ee0
movabs rbx, 0xb91c8df19be5267d
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x40], rbx
movabs rcx, 0xbeb9994300d8c50a
mov rax, qword [rsp + 0x40]
movabs rbx, 0x6b0ae600e34c08cf
mov qword [rsp + 0x50], rax
mov r8d, edx
movabs rax, 0x8b7246d120a6ef5b
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
movabs rax, 0x10b5483972ad11b4
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
movabs rax, 0x4dbbefc348e4a719
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
movabs rax, 0xd648963c33864ba
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
movabs rax, 0x8d01a2e0185dc301
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
movabs rax, 0x5def7462065fa727
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], rcx
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x20], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x18], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 8], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp + 8], rax
movabs rax, 0x5def7462065fa749
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x10], rax
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp - 0x10]
movdqa xmm2, xmmword [rsp + 0x50]
xorps xmm2, xmmword [rbp - 0x20]
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm1, xmmword [rbp]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm0, xmmword [rbp - 0x80]
mov qword [rbp + 0x18], rax
movq rax, xmm2
xorps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmmword [rsp + 0x50], xmm2
movdqa xmmword [rsp + 0x70], xmm1
test al, al
je 0x18005318b
nop dword [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180053180
sub r8d, edx
lea rdx, [rsp + 0x50]
jmp 0x1800532e3
xor edx, edx
call fcn.180073ee0
movabs rax, 0xbf498efd91e22878
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rsp + 0x50], rax
movabs rax, 0xd27113cb2abcbb55
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
movabs rax, 0x15fb537630ac0ba6
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
movabs rax, 0x58bcf0ce04e1af02
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
movabs rax, 0x1b678963c32267a6
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
movabs rax, 0xe268d6e50f5cc104
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x20], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x18], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 8], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rsp + 0x50]
xorps xmm2, xmmword [rbp - 0x20]
movdqa xmm0, xmmword [rsp + 0x60]
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp - 0x10]
mov qword [rbp + 8], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp]
movdqa xmmword [rsp + 0x50], xmm2
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0x70], xmm1
test al, al
je 0x1800532db
nop
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x1800532d0
sub r8d, edx
lea rdx, [rsp + 0x50]
mov rcx, qword [0x180177ed8]
xor r9d, r9d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
call fcn.180073ee0
movabs rax, 0xac5591ed9ffc347a
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rsp + 0x50], rax
movabs rax, 0xc7635ad12cbba614
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
movabs rax, 0x5cfb553f29a805bc
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
movabs rax, 0x49a9efcb18eda915
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
movabs rax, 0x2799465956c24ab
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
movabs rax, 0xe268d6814a12ca07
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x20], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x18], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 8], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rsp + 0x50]
xorps xmm2, xmmword [rbp - 0x20]
movdqa xmm0, xmmword [rsp + 0x60]
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp - 0x10]
mov qword [rbp + 8], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp]
movdqa xmmword [rsp + 0x50], xmm2
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0x70], xmm1
test al, al
je 0x18005343b
nop
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180053430
mov rcx, qword [0x180177ed8]
sub r8d, edx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rdx, str.1000
mov r8, rdx
inc r8
cmp byte [r8], r13b
jne 0x180053462
mov rcx, qword [0x180177ed8]
sub r8d, edx
xor r9d, r9d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov al, 1
jmp 0x180052559