Function at 0x18002ed10
Capabilities:
Check if file exists
Create thread
Query environment variable

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x348
mov rax, qword [0x1800623f8]
xor rax, rsp
mov qword [rsp + 0x330], rax
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x174], 9
mov dword [rsp + 0x168], 5
mov eax, dword [rsp + 0x168]
test eax, eax
jle 0x18002edbf
mov eax, dword [rsp + 0x168]
cmp eax, 1
jle 0x18002ed8c
mov eax, dword [rsp + 0x174]
and eax, 0x10a2
mov dword [rsp + 0x174], eax
mov eax, dword [rsp + 0x168]
sub eax, 2
mov dword [rsp + 0x168], eax
jmp 0x18002ed4f
mov eax, dword [rsp + 0x174]
cmp eax, 0x807
jle 0x18002edad
mov eax, dword [rsp + 0x174]
and eax, 0x80
mov dword [rsp + 0x174], eax
mov eax, dword [rsp + 0x168]
dec eax
mov dword [rsp + 0x168], eax
jmp 0x18002ed4f
mov dword [rsp + 0x178], 2
mov dword [rsp + 0x17c], 4
mov eax, dword [rsp + 0x17c]
test eax, eax
jle 0x18002ee43
mov eax, dword [rsp + 0x17c]
cmp eax, 1
jle 0x18002ee12
mov eax, dword [rsp + 0x178]
and eax, 0x1176
mov dword [rsp + 0x178], eax
mov eax, dword [rsp + 0x17c]
sub eax, 2
mov dword [rsp + 0x17c], eax
jmp 0x18002edd5
mov eax, dword [rsp + 0x178]
cmp eax, 0x806
jle 0x18002ee31
mov eax, dword [rsp + 0x178]
and eax, 0x7f
mov dword [rsp + 0x178], eax
mov eax, dword [rsp + 0x17c]
dec eax
mov dword [rsp + 0x17c], eax
jmp 0x18002edd5
mov dword [rsp + 0x170], 1
mov dword [rsp + 0x16c], 0x15
cmp dword [rsp + 0x16c], 0
jle 0x18002eeb9
mov eax, dword [rsp + 0x16c]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18002ee9c
mov dword [rsp + 0x170], 4
mov eax, dword [rsp + 0x16c]
sub eax, 2
mov dword [rsp + 0x16c], eax
jmp 0x18002ee59
mov dword [rsp + 0x170], 0
mov eax, dword [rsp + 0x16c]
dec eax
mov dword [rsp + 0x16c], eax
jmp 0x18002ee59
mov qword [rsp + 0x160], 0
mov dword [rsp + 0x188], 4
mov dword [rsp + 0x1a0], 3
mov eax, dword [rsp + 0x1a0]
test eax, eax
jle 0x18002ef49
mov eax, dword [rsp + 0x1a0]
cmp eax, 1
jle 0x18002ef18
mov eax, dword [rsp + 0x188]
and eax, 0x1494
mov dword [rsp + 0x188], eax
mov eax, dword [rsp + 0x1a0]
sub eax, 2
mov dword [rsp + 0x1a0], eax
jmp 0x18002eedb
mov eax, dword [rsp + 0x188]
cmp eax, 0x805
jle 0x18002ef37
mov eax, dword [rsp + 0x188]
and eax, 0x7e
mov dword [rsp + 0x188], eax
mov eax, dword [rsp + 0x1a0]
dec eax
mov dword [rsp + 0x1a0], eax
jmp 0x18002eedb
mov dword [rsp + 0x180], 3
mov dword [rsp + 0x1b4], 0xf
cmp dword [rsp + 0x1b4], 0
jle 0x18002efc0
mov eax, dword [rsp + 0x1b4]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18002efa2
mov dword [rsp + 0x180], 0
mov eax, dword [rsp + 0x1b4]
sub eax, 2
mov dword [rsp + 0x1b4], eax
jmp 0x18002ef5f
mov dword [rsp + 0x180], 4
mov eax, dword [rsp + 0x1b4]
sub eax, 2
mov dword [rsp + 0x1b4], eax
jmp 0x18002ef5f
mov dword [rsp + 0x198], 7
mov dword [rsp + 0x1ac], 0xb
mov eax, dword [rsp + 0x1ac]
test eax, eax
jle 0x18002f046
mov eax, dword [rsp + 0x1ac]
cmp eax, 1
jle 0x18002f013
mov eax, dword [rsp + 0x198]
and eax, 0x66b
mov dword [rsp + 0x198], eax
mov eax, dword [rsp + 0x1ac]
sub eax, 2
mov dword [rsp + 0x1ac], eax
jmp 0x18002efd6
mov eax, dword [rsp + 0x198]
cmp eax, 0x80d
jle 0x18002f034
mov eax, dword [rsp + 0x198]
and eax, 0x86
mov dword [rsp + 0x198], eax
mov eax, dword [rsp + 0x1ac]
dec eax
mov dword [rsp + 0x1ac], eax
jmp 0x18002efd6
mov dword [rsp + 0x1a8], 5
mov dword [rsp + 0x190], 5
mov eax, dword [rsp + 0x190]
test eax, eax
jle 0x18002f0cc
mov eax, dword [rsp + 0x190]
cmp eax, 1
jle 0x18002f099
mov eax, dword [rsp + 0x1a8]
and eax, 0x152b
mov dword [rsp + 0x1a8], eax
mov eax, dword [rsp + 0x190]
sub eax, 2
mov dword [rsp + 0x190], eax
jmp 0x18002f05c
mov eax, dword [rsp + 0x1a8]
cmp eax, 0x807
jle 0x18002f0ba
mov eax, dword [rsp + 0x1a8]
and eax, 0x80
mov dword [rsp + 0x1a8], eax
mov eax, dword [rsp + 0x190]
dec eax
mov dword [rsp + 0x190], eax
jmp 0x18002f05c
mov dword [rsp + 0x1a4], 8
mov dword [rsp + 0x1b0], 0xc
cmp dword [rsp + 0x1b0], 0
jle 0x18002f142
mov eax, dword [rsp + 0x1b0]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18002f124
mov dword [rsp + 0x1a4], 4
mov eax, dword [rsp + 0x1b0]
dec eax
mov dword [rsp + 0x1b0], eax
jmp 0x18002f0e2
mov dword [rsp + 0x1a4], 0
mov eax, dword [rsp + 0x1b0]
sub eax, 2
mov dword [rsp + 0x1b0], eax
jmp 0x18002f0e2
mov dword [rsp + 0x18c], 7
mov dword [rsp + 0x184], 0x14
cmp dword [rsp + 0x184], 0
jle 0x18002f1b8
mov eax, dword [rsp + 0x184]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18002f19b
mov dword [rsp + 0x18c], 0
mov eax, dword [rsp + 0x184]
sub eax, 2
mov dword [rsp + 0x184], eax
jmp 0x18002f158
mov dword [rsp + 0x18c], 0
mov eax, dword [rsp + 0x184]
dec eax
mov dword [rsp + 0x184], eax
jmp 0x18002f158
mov dword [rsp + 0x194], 0
mov dword [rsp + 0x19c], 0x14
cmp dword [rsp + 0x19c], 0
jle 0x18002f22d
mov eax, dword [rsp + 0x19c]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18002f210
mov dword [rsp + 0x194], 4
mov eax, dword [rsp + 0x19c]
dec eax
mov dword [rsp + 0x19c], eax
jmp 0x18002f1ce
mov dword [rsp + 0x194], 0
mov eax, dword [rsp + 0x19c]
dec eax
mov dword [rsp + 0x19c], eax
jmp 0x18002f1ce
mov rax, qword [rsp + 0x360]
add rax, 0x1c
mov r8d, 0x104
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [rsp + 0x1c8], 2
mov dword [rsp + 0x1d0], 0x10
cmp dword [rsp + 0x1d0], 0
jle 0x18002f2c3
mov eax, dword [rsp + 0x1d0]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18002f2a5
mov dword [rsp + 0x1c8], 4
mov eax, dword [rsp + 0x1d0]
dec eax
mov dword [rsp + 0x1d0], eax
jmp 0x18002f263
mov dword [rsp + 0x1c8], 4
mov eax, dword [rsp + 0x1d0]
sub eax, 2
mov dword [rsp + 0x1d0], eax
jmp 0x18002f263
mov dword [rsp + 0x1bc], 8
mov dword [rsp + 0x1c4], 0x11
cmp dword [rsp + 0x1c4], 0
jle 0x18002f339
mov eax, dword [rsp + 0x1c4]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18002f31b
mov dword [rsp + 0x1bc], 4
mov eax, dword [rsp + 0x1c4]
dec eax
mov dword [rsp + 0x1c4], eax
jmp 0x18002f2d9
mov dword [rsp + 0x1bc], 4
mov eax, dword [rsp + 0x1c4]
sub eax, 2
mov dword [rsp + 0x1c4], eax
jmp 0x18002f2d9
mov dword [rsp + 0x1cc], 3
mov dword [rsp + 0x1d4], 9
mov eax, dword [rsp + 0x1d4]
test eax, eax
jle 0x18002f3bf
mov eax, dword [rsp + 0x1d4]
cmp eax, 1
jle 0x18002f38c
mov eax, dword [rsp + 0x1cc]
and eax, 0x15f8
mov dword [rsp + 0x1cc], eax
mov eax, dword [rsp + 0x1d4]
sub eax, 2
mov dword [rsp + 0x1d4], eax
jmp 0x18002f34f
mov eax, dword [rsp + 0x1cc]
cmp eax, 0x80b
jle 0x18002f3ad
mov eax, dword [rsp + 0x1cc]
and eax, 0x84
mov dword [rsp + 0x1cc], eax
mov eax, dword [rsp + 0x1d4]
dec eax
mov dword [rsp + 0x1d4], eax
jmp 0x18002f34f
mov dword [rsp + 0x1c0], 9
mov dword [rsp + 0x1b8], 5
mov eax, dword [rsp + 0x1b8]
test eax, eax
jle 0x18002f445
mov eax, dword [rsp + 0x1b8]
cmp eax, 1
jle 0x18002f412
mov eax, dword [rsp + 0x1c0]
and eax, 0x10a2
mov dword [rsp + 0x1c0], eax
mov eax, dword [rsp + 0x1b8]
sub eax, 2
mov dword [rsp + 0x1b8], eax
jmp 0x18002f3d5
mov eax, dword [rsp + 0x1c0]
cmp eax, 0x807
jle 0x18002f433
mov eax, dword [rsp + 0x1c0]
and eax, 0x80
mov dword [rsp + 0x1c0], eax
mov eax, dword [rsp + 0x1b8]
dec eax
mov dword [rsp + 0x1b8], eax
jmp 0x18002f3d5
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x18002f7aa
mov dword [rsp + 0x1f8], 4
mov dword [rsp + 0x1e4], 0x15
cmp dword [rsp + 0x1e4], 0
jle 0x18002f4cf
mov eax, dword [rsp + 0x1e4]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18002f4b1
mov dword [rsp + 0x1f8], 0
mov eax, dword [rsp + 0x1e4]
sub eax, 2
mov dword [rsp + 0x1e4], eax
jmp 0x18002f46e
mov dword [rsp + 0x1f8], 0
mov eax, dword [rsp + 0x1e4]
sub eax, 2
mov dword [rsp + 0x1e4], eax
jmp 0x18002f46e
mov dword [rsp + 0x1ec], 8
mov dword [rsp + 0x1fc], 0x11
cmp dword [rsp + 0x1fc], 0
jle 0x18002f545
mov eax, dword [rsp + 0x1fc]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18002f527
mov dword [rsp + 0x1ec], 4
mov eax, dword [rsp + 0x1fc]
dec eax
mov dword [rsp + 0x1fc], eax
jmp 0x18002f4e5
mov dword [rsp + 0x1ec], 4
mov eax, dword [rsp + 0x1fc]
sub eax, 2
mov dword [rsp + 0x1fc], eax
jmp 0x18002f4e5
mov dword [rsp + 0x1f4], 0
mov dword [rsp + 0x1e0], 0xd
cmp dword [rsp + 0x1e0], 0
jle 0x18002f5bb
mov eax, dword [rsp + 0x1e0]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18002f59d
mov dword [rsp + 0x1f4], 4
mov eax, dword [rsp + 0x1e0]
dec eax
mov dword [rsp + 0x1e0], eax
jmp 0x18002f55b
mov dword [rsp + 0x1f4], 0
mov eax, dword [rsp + 0x1e0]
sub eax, 2
mov dword [rsp + 0x1e0], eax
jmp 0x18002f55b
mov dword [rsp + 0x20c], 2
mov dword [rsp + 0x1f0], 0x13
cmp dword [rsp + 0x1f0], 0
jle 0x18002f632
mov eax, dword [rsp + 0x1f0]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18002f614
mov dword [rsp + 0x20c], 4
mov eax, dword [rsp + 0x1f0]
sub eax, 2
mov dword [rsp + 0x1f0], eax
jmp 0x18002f5d1
mov dword [rsp + 0x20c], 4
mov eax, dword [rsp + 0x1f0]
sub eax, 2
mov dword [rsp + 0x1f0], eax
jmp 0x18002f5d1
mov dword [rsp + 0x1dc], 2
mov dword [rsp + 0x1e8], 0xa
mov eax, dword [rsp + 0x1e8]
test eax, eax
jle 0x18002f6b8
mov eax, dword [rsp + 0x1e8]
cmp eax, 1
jle 0x18002f685
mov eax, dword [rsp + 0x1dc]
and eax, 0x2106
mov dword [rsp + 0x1dc], eax
mov eax, dword [rsp + 0x1e8]
sub eax, 2
mov dword [rsp + 0x1e8], eax
jmp 0x18002f648
mov eax, dword [rsp + 0x1dc]
cmp eax, 0x80c
jle 0x18002f6a6
mov eax, dword [rsp + 0x1dc]
and eax, 0x85
mov dword [rsp + 0x1dc], eax
mov eax, dword [rsp + 0x1e8]
dec eax
mov dword [rsp + 0x1e8], eax
jmp 0x18002f648
mov dword [rsp + 0x1d8], 4
mov dword [rsp + 0x204], 0x11
cmp dword [rsp + 0x204], 0
jle 0x18002f72d
mov eax, dword [rsp + 0x204]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18002f710
mov dword [rsp + 0x1d8], 0
mov eax, dword [rsp + 0x204]
dec eax
mov dword [rsp + 0x204], eax
jmp 0x18002f6ce
mov dword [rsp + 0x1d8], 4
mov eax, dword [rsp + 0x204]
dec eax
mov dword [rsp + 0x204], eax
jmp 0x18002f6ce
mov dword [rsp + 0x200], 2
mov dword [rsp + 0x208], 0x10
cmp dword [rsp + 0x208], 0
jle 0x18002f7a3
mov eax, dword [rsp + 0x208]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18002f785
mov dword [rsp + 0x200], 4
mov eax, dword [rsp + 0x208]
dec eax
mov dword [rsp + 0x208], eax
jmp 0x18002f743
mov dword [rsp + 0x200], 4
mov eax, dword [rsp + 0x208]
sub eax, 2
mov dword [rsp + 0x208], eax
jmp 0x18002f743
xor eax, eax
jmp 0x180030982
mov rcx, qword [rsp + 0x360]
call fcn.1800103c0
test eax, eax
jne 0x18002f937
mov dword [rsp + 0x220], 0
mov dword [rsp + 0x224], 0x14
cmp dword [rsp + 0x224], 0
jle 0x18002f834
mov eax, dword [rsp + 0x224]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18002f817
mov dword [rsp + 0x220], 4
mov eax, dword [rsp + 0x224]
dec eax
mov dword [rsp + 0x224], eax
jmp 0x18002f7d5
mov dword [rsp + 0x220], 0
mov eax, dword [rsp + 0x224]
dec eax
mov dword [rsp + 0x224], eax
jmp 0x18002f7d5
mov dword [rsp + 0x21c], 9
mov dword [rsp + 0x210], 5
mov eax, dword [rsp + 0x210]
test eax, eax
jle 0x18002f8ba
mov eax, dword [rsp + 0x210]
cmp eax, 1
jle 0x18002f887
mov eax, dword [rsp + 0x21c]
and eax, 0x10a2
mov dword [rsp + 0x21c], eax
mov eax, dword [rsp + 0x210]
sub eax, 2
mov dword [rsp + 0x210], eax
jmp 0x18002f84a
mov eax, dword [rsp + 0x21c]
cmp eax, 0x807
jle 0x18002f8a8
mov eax, dword [rsp + 0x21c]
and eax, 0x80
mov dword [rsp + 0x21c], eax
mov eax, dword [rsp + 0x210]
dec eax
mov dword [rsp + 0x210], eax
jmp 0x18002f84a
mov dword [rsp + 0x214], 8
mov dword [rsp + 0x218], 0x11
cmp dword [rsp + 0x218], 0
jle 0x18002f930
mov eax, dword [rsp + 0x218]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18002f912
mov dword [rsp + 0x214], 4
mov eax, dword [rsp + 0x218]
dec eax
mov dword [rsp + 0x218], eax
jmp 0x18002f8d0
mov dword [rsp + 0x214], 4
mov eax, dword [rsp + 0x218]
sub eax, 2
mov dword [rsp + 0x218], eax
jmp 0x18002f8d0
xor eax, eax
jmp 0x180030982
xor edx, edx
mov rcx, qword [rsp + 0x360]
call fcn.180033bf0
test eax, eax
jne 0x18002fb76
mov r8d, 0x8000
xor edx, edx
mov rax, qword [rsp + 0x360]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, qword [rsp + 0x360]
mov qword [rax + 0x10], 0
mov rax, qword [rsp + 0x360]
mov dword [rax + 0x18], 0
mov dword [rsp + 0x230], 7
mov dword [rsp + 0x228], 0x10
cmp dword [rsp + 0x228], 0
jle 0x18002f9fd
mov eax, dword [rsp + 0x228]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18002f9e0
mov dword [rsp + 0x230], 0
mov eax, dword [rsp + 0x228]
sub eax, 2
mov dword [rsp + 0x228], eax
jmp 0x18002f99d
mov dword [rsp + 0x230], 0
mov eax, dword [rsp + 0x228]
dec eax
mov dword [rsp + 0x228], eax
jmp 0x18002f99d
mov dword [rsp + 0x23c], 2
mov dword [rsp + 0x240], 0x10
cmp dword [rsp + 0x240], 0
jle 0x18002fa73
mov eax, dword [rsp + 0x240]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18002fa55
mov dword [rsp + 0x23c], 4
mov eax, dword [rsp + 0x240]
dec eax
mov dword [rsp + 0x240], eax
jmp 0x18002fa13
mov dword [rsp + 0x23c], 4
mov eax, dword [rsp + 0x240]
sub eax, 2
mov dword [rsp + 0x240], eax
jmp 0x18002fa13
mov dword [rsp + 0x234], 6
mov dword [rsp + 0x244], 0xa
mov eax, dword [rsp + 0x244]
test eax, eax
jle 0x18002faf9
mov eax, dword [rsp + 0x244]
cmp eax, 1
jle 0x18002fac6
mov eax, dword [rsp + 0x234]
and eax, 0x1f29
mov dword [rsp + 0x234], eax
mov eax, dword [rsp + 0x244]
sub eax, 2
mov dword [rsp + 0x244], eax
jmp 0x18002fa89
mov eax, dword [rsp + 0x234]
cmp eax, 0x80c
jle 0x18002fae7
mov eax, dword [rsp + 0x234]
and eax, 0x85
mov dword [rsp + 0x234], eax
mov eax, dword [rsp + 0x244]
dec eax
mov dword [rsp + 0x244], eax
jmp 0x18002fa89
mov dword [rsp + 0x238], 0
mov dword [rsp + 0x22c], 0x15
cmp dword [rsp + 0x22c], 0
jle 0x18002fb6f
mov eax, dword [rsp + 0x22c]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18002fb51
mov dword [rsp + 0x238], 4
mov eax, dword [rsp + 0x22c]
dec eax
mov dword [rsp + 0x22c], eax
jmp 0x18002fb0f
mov dword [rsp + 0x238], 0
mov eax, dword [rsp + 0x22c]
sub eax, 2
mov dword [rsp + 0x22c], eax
jmp 0x18002fb0f
xor eax, eax
jmp 0x180030982
mov rax, qword [rsp + 0x360]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x258], 8
mov dword [rsp + 0x25c], 3
mov eax, dword [rsp + 0x25c]
test eax, eax
jle 0x18002fc0b
mov eax, dword [rsp + 0x25c]
cmp eax, 1
jle 0x18002fbda
mov eax, dword [rsp + 0x258]
and eax, 0x1fed
mov dword [rsp + 0x258], eax
mov eax, dword [rsp + 0x25c]
sub eax, 2
mov dword [rsp + 0x25c], eax
jmp 0x18002fb9d
mov eax, dword [rsp + 0x258]
cmp eax, 0x805
jle 0x18002fbf9
mov eax, dword [rsp + 0x258]
and eax, 0x7e
mov dword [rsp + 0x258], eax
mov eax, dword [rsp + 0x25c]
dec eax
mov dword [rsp + 0x25c], eax
jmp 0x18002fb9d
mov dword [rsp + 0x254], 7
mov dword [rsp + 0x24c], 4
mov eax, dword [rsp + 0x24c]
test eax, eax
jle 0x18002fc8f
mov eax, dword [rsp + 0x24c]
cmp eax, 1
jle 0x18002fc5e
mov eax, dword [rsp + 0x254]
and eax, 0x21f3
mov dword [rsp + 0x254], eax
mov eax, dword [rsp + 0x24c]
sub eax, 2
mov dword [rsp + 0x24c], eax
jmp 0x18002fc21
mov eax, dword [rsp + 0x254]
cmp eax, 0x806
jle 0x18002fc7d
mov eax, dword [rsp + 0x254]
and eax, 0x7f
mov dword [rsp + 0x254], eax
mov eax, dword [rsp + 0x24c]
dec eax
mov dword [rsp + 0x24c], eax
jmp 0x18002fc21
mov dword [rsp + 0x250], 6
mov dword [rsp + 0x248], 7
mov eax, dword [rsp + 0x248]
test eax, eax
jle 0x18002fd15
mov eax, dword [rsp + 0x248]
cmp eax, 1
jle 0x18002fce2
mov eax, dword [rsp + 0x250]
and eax, 0x169a
mov dword [rsp + 0x250], eax
mov eax, dword [rsp + 0x248]
sub eax, 2
mov dword [rsp + 0x248], eax
jmp 0x18002fca5
mov eax, dword [rsp + 0x250]
cmp eax, 0x809
jle 0x18002fd03
mov eax, dword [rsp + 0x250]
and eax, 0x82
mov dword [rsp + 0x250], eax
mov eax, dword [rsp + 0x248]
dec eax
mov dword [rsp + 0x248], eax
jmp 0x18002fca5
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x40]
mov edx, 0x200000
xor ecx, ecx
call fcn.18004a0e4
mov qword [rsp + 0x160], rax
cmp qword [rsp + 0x160], 0
jne 0x1800303b9
mov dword [rsp + 0x274], 7
mov dword [rsp + 0x268], 0x14
cmp dword [rsp + 0x268], 0
jle 0x18002fdc7
mov eax, dword [rsp + 0x268]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18002fdaa
mov dword [rsp + 0x274], 0
mov eax, dword [rsp + 0x268]
sub eax, 2
mov dword [rsp + 0x268], eax
jmp 0x18002fd67
mov dword [rsp + 0x274], 0
mov eax, dword [rsp + 0x268]
dec eax
mov dword [rsp + 0x268], eax
jmp 0x18002fd67
mov dword [rsp + 0x280], 2
mov dword [rsp + 0x288], 0x10
cmp dword [rsp + 0x288], 0
jle 0x18002fe3d
mov eax, dword [rsp + 0x288]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18002fe1f
mov dword [rsp + 0x280], 4
mov eax, dword [rsp + 0x288]
dec eax
mov dword [rsp + 0x288], eax
jmp 0x18002fddd
mov dword [rsp + 0x280], 4
mov eax, dword [rsp + 0x288]
sub eax, 2
mov dword [rsp + 0x288], eax
jmp 0x18002fddd
mov dword [rsp + 0x28c], 5
mov dword [rsp + 0x27c], 0xf
cmp dword [rsp + 0x27c], 0
jle 0x18002feb2
mov eax, dword [rsp + 0x27c]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18002fe95
mov dword [rsp + 0x28c], 0
mov eax, dword [rsp + 0x27c]
dec eax
mov dword [rsp + 0x27c], eax
jmp 0x18002fe53
mov dword [rsp + 0x28c], 4
mov eax, dword [rsp + 0x27c]
dec eax
mov dword [rsp + 0x27c], eax
jmp 0x18002fe53
mov dword [rsp + 0x264], 3
mov dword [rsp + 0x278], 8
mov eax, dword [rsp + 0x278]
test eax, eax
jle 0x18002ff38
mov eax, dword [rsp + 0x278]
cmp eax, 1
jle 0x18002ff05
mov eax, dword [rsp + 0x264]
and eax, 0x11d0
mov dword [rsp + 0x264], eax
mov eax, dword [rsp + 0x278]
sub eax, 2
mov dword [rsp + 0x278], eax
jmp 0x18002fec8
mov eax, dword [rsp + 0x264]
cmp eax, 0x80a
jle 0x18002ff26
mov eax, dword [rsp + 0x264]
and eax, 0x83
mov dword [rsp + 0x264], eax
mov eax, dword [rsp + 0x278]
dec eax
mov dword [rsp + 0x278], eax
jmp 0x18002fec8
mov dword [rsp + 0x270], 4
mov dword [rsp + 0x260], 0x15
cmp dword [rsp + 0x260], 0
jle 0x18002ffaf
mov eax, dword [rsp + 0x260]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18002ff91
mov dword [rsp + 0x270], 0
mov eax, dword [rsp + 0x260]
sub eax, 2
mov dword [rsp + 0x260], eax
jmp 0x18002ff4e
mov dword [rsp + 0x270], 0
mov eax, dword [rsp + 0x260]
sub eax, 2
mov dword [rsp + 0x260], eax
jmp 0x18002ff4e
mov dword [rsp + 0x26c], 7
mov dword [rsp + 0x284], 8
mov eax, dword [rsp + 0x284]
test eax, eax
jle 0x180030035
mov eax, dword [rsp + 0x284]
cmp eax, 1
jle 0x180030002
mov eax, dword [rsp + 0x26c]
and eax, 0x2542
mov dword [rsp + 0x26c], eax
mov eax, dword [rsp + 0x284]
sub eax, 2
mov dword [rsp + 0x284], eax
jmp 0x18002ffc5
mov eax, dword [rsp + 0x26c]
cmp eax, 0x80a
jle 0x180030023
mov eax, dword [rsp + 0x26c]
and eax, 0x83
mov dword [rsp + 0x26c], eax
mov eax, dword [rsp + 0x284]
dec eax
mov dword [rsp + 0x284], eax
jmp 0x18002ffc5
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [rsp + 0x2a4], 6
mov dword [rsp + 0x2c4], 0xa
mov eax, dword [rsp + 0x2c4]
test eax, eax
jle 0x1800300ce
mov eax, dword [rsp + 0x2c4]
cmp eax, 1
jle 0x18003009b
mov eax, dword [rsp + 0x2a4]
and eax, 0x1f29
mov dword [rsp + 0x2a4], eax
mov eax, dword [rsp + 0x2c4]
sub eax, 2
mov dword [rsp + 0x2c4], eax
jmp 0x18003005e
mov eax, dword [rsp + 0x2a4]
cmp eax, 0x80c
jle 0x1800300bc
mov eax, dword [rsp + 0x2a4]
and eax, 0x85
mov dword [rsp + 0x2a4], eax
mov eax, dword [rsp + 0x2c4]
dec eax
mov dword [rsp + 0x2c4], eax
jmp 0x18003005e
mov dword [rsp + 0x2b4], 3
mov dword [rsp + 0x2c0], 9
mov eax, dword [rsp + 0x2c0]
test eax, eax
jle 0x180030154
mov eax, dword [rsp + 0x2c0]
cmp eax, 1
jle 0x180030121
mov eax, dword [rsp + 0x2b4]
and eax, 0x15f8
mov dword [rsp + 0x2b4], eax
mov eax, dword [rsp + 0x2c0]
sub eax, 2
mov dword [rsp + 0x2c0], eax
jmp 0x1800300e4
mov eax, dword [rsp + 0x2b4]
cmp eax, 0x80b
jle 0x180030142
mov eax, dword [rsp + 0x2b4]
and eax, 0x84
mov dword [rsp + 0x2b4], eax
mov eax, dword [rsp + 0x2c0]
dec eax
mov dword [rsp + 0x2c0], eax
jmp 0x1800300e4
mov dword [rsp + 0x2ac], 7
mov dword [rsp + 0x2bc], 0xb
mov eax, dword [rsp + 0x2bc]
test eax, eax
jle 0x1800301da
mov eax, dword [rsp + 0x2bc]
cmp eax, 1
jle 0x1800301a7
mov eax, dword [rsp + 0x2ac]
and eax, 0x66b
mov dword [rsp + 0x2ac], eax
mov eax, dword [rsp + 0x2bc]
sub eax, 2
mov dword [rsp + 0x2bc], eax
jmp 0x18003016a
mov eax, dword [rsp + 0x2ac]
cmp eax, 0x80d
jle 0x1800301c8
mov eax, dword [rsp + 0x2ac]
and eax, 0x86
mov dword [rsp + 0x2ac], eax
mov eax, dword [rsp + 0x2bc]
dec eax
mov dword [rsp + 0x2bc], eax
jmp 0x18003016a
mov dword [rsp + 0x290], 4
mov dword [rsp + 0x2b0], 0x11
cmp dword [rsp + 0x2b0], 0
jle 0x18003024f
mov eax, dword [rsp + 0x2b0]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180030232
mov dword [rsp + 0x290], 0
mov eax, dword [rsp + 0x2b0]
dec eax
mov dword [rsp + 0x2b0], eax
jmp 0x1800301f0
mov dword [rsp + 0x290], 4
mov eax, dword [rsp + 0x2b0]
dec eax
mov dword [rsp + 0x2b0], eax
jmp 0x1800301f0
mov dword [rsp + 0x2a0], 7
mov dword [rsp + 0x29c], 0x14
cmp dword [rsp + 0x29c], 0
jle 0x1800302c5
mov eax, dword [rsp + 0x29c]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x1800302a8
mov dword [rsp + 0x2a0], 0
mov eax, dword [rsp + 0x29c]
sub eax, 2
mov dword [rsp + 0x29c], eax
jmp 0x180030265
mov dword [rsp + 0x2a0], 0
mov eax, dword [rsp + 0x29c]
dec eax
mov dword [rsp + 0x29c], eax
jmp 0x180030265
mov dword [rsp + 0x2a8], 3
mov dword [rsp + 0x2b8], 0x12
cmp dword [rsp + 0x2b8], 0
jle 0x18003033c
mov eax, dword [rsp + 0x2b8]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18003031e
mov dword [rsp + 0x2a8], 4
mov eax, dword [rsp + 0x2b8]
sub eax, 2
mov dword [rsp + 0x2b8], eax
jmp 0x1800302db
mov dword [rsp + 0x2a8], 0
mov eax, dword [rsp + 0x2b8]
sub eax, 2
mov dword [rsp + 0x2b8], eax
jmp 0x1800302db
mov dword [rsp + 0x298], 1
mov dword [rsp + 0x294], 0x15
cmp dword [rsp + 0x294], 0
jle 0x1800303b2
mov eax, dword [rsp + 0x294]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180030395
mov dword [rsp + 0x298], 4
mov eax, dword [rsp + 0x294]
sub eax, 2
mov dword [rsp + 0x294], eax
jmp 0x180030352
mov dword [rsp + 0x298], 0
mov eax, dword [rsp + 0x294]
dec eax
mov dword [rsp + 0x294], eax
jmp 0x180030352
xor eax, eax
jmp 0x180030982
mov rax, qword [rsp + 0x360]
mov dword [rax], 1
mov dword [rsp + 0x2cc], 8
mov dword [rsp + 0x2d4], 0x11
cmp dword [rsp + 0x2d4], 0
jle 0x18003043d
mov eax, dword [rsp + 0x2d4]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18003041f
mov dword [rsp + 0x2cc], 4
mov eax, dword [rsp + 0x2d4]
dec eax
mov dword [rsp + 0x2d4], eax
jmp 0x1800303dd
mov dword [rsp + 0x2cc], 4
mov eax, dword [rsp + 0x2d4]
sub eax, 2
mov dword [rsp + 0x2d4], eax
jmp 0x1800303dd
mov dword [rsp + 0x2d0], 7
mov dword [rsp + 0x2e4], 0xb
mov eax, dword [rsp + 0x2e4]
test eax, eax
jle 0x1800304c3
mov eax, dword [rsp + 0x2e4]
cmp eax, 1
jle 0x180030490
mov eax, dword [rsp + 0x2d0]
and eax, 0x66b
mov dword [rsp + 0x2d0], eax
mov eax, dword [rsp + 0x2e4]
sub eax, 2
mov dword [rsp + 0x2e4], eax
jmp 0x180030453
mov eax, dword [rsp + 0x2d0]
cmp eax, 0x80d
jle 0x1800304b1
mov eax, dword [rsp + 0x2d0]
and eax, 0x86
mov dword [rsp + 0x2d0], eax
mov eax, dword [rsp + 0x2e4]
dec eax
mov dword [rsp + 0x2e4], eax
jmp 0x180030453
mov dword [rsp + 0x2e0], 7
mov dword [rsp + 0x2c8], 0x11
cmp dword [rsp + 0x2c8], 0
jle 0x180030539
mov eax, dword [rsp + 0x2c8]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18003051b
mov dword [rsp + 0x2e0], 0
mov eax, dword [rsp + 0x2c8]
dec eax
mov dword [rsp + 0x2c8], eax
jmp 0x1800304d9
mov dword [rsp + 0x2e0], 4
mov eax, dword [rsp + 0x2c8]
sub eax, 2
mov dword [rsp + 0x2c8], eax
jmp 0x1800304d9
mov dword [rsp + 0x2d8], 2
mov dword [rsp + 0x2dc], 4
mov eax, dword [rsp + 0x2dc]
test eax, eax
jle 0x1800305bd
mov eax, dword [rsp + 0x2dc]
cmp eax, 1
jle 0x18003058c
mov eax, dword [rsp + 0x2d8]
and eax, 0x1176
mov dword [rsp + 0x2d8], eax
mov eax, dword [rsp + 0x2dc]
sub eax, 2
mov dword [rsp + 0x2dc], eax
jmp 0x18003054f
mov eax, dword [rsp + 0x2d8]
cmp eax, 0x806
jle 0x1800305ab
mov eax, dword [rsp + 0x2d8]
and eax, 0x7f
mov dword [rsp + 0x2d8], eax
mov eax, dword [rsp + 0x2dc]
dec eax
mov dword [rsp + 0x2dc], eax
jmp 0x18003054f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x320]
lea rcx, [rsp + 0x30]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x320]
mov rcx, qword [rsp + 0x360]
call fcn.180014750
mov dword [rsp + 0x304], 0
mov dword [rsp + 0x2ec], 0x15
cmp dword [rsp + 0x2ec], 0
jle 0x180030676
mov eax, dword [rsp + 0x2ec]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180030658
mov dword [rsp + 0x304], 4
mov eax, dword [rsp + 0x2ec]
dec eax
mov dword [rsp + 0x2ec], eax
jmp 0x180030616
mov dword [rsp + 0x304], 0
mov eax, dword [rsp + 0x2ec]
sub eax, 2
mov dword [rsp + 0x2ec], eax
jmp 0x180030616
mov dword [rsp + 0x30c], 3
mov dword [rsp + 0x310], 0xc
cmp dword [rsp + 0x310], 0
jle 0x1800306ed
mov eax, dword [rsp + 0x310]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x1800306cf
mov dword [rsp + 0x30c], 0
mov eax, dword [rsp + 0x310]
sub eax, 2
mov dword [rsp + 0x310], eax
jmp 0x18003068c
mov dword [rsp + 0x30c], 4
mov eax, dword [rsp + 0x310]
sub eax, 2
mov dword [rsp + 0x310], eax
jmp 0x18003068c
mov dword [rsp + 0x2f8], 5
mov dword [rsp + 0x31c], 5
mov eax, dword [rsp + 0x31c]
test eax, eax
jle 0x180030773
mov eax, dword [rsp + 0x31c]
cmp eax, 1
jle 0x180030740
mov eax, dword [rsp + 0x2f8]
and eax, 0x9c1
mov dword [rsp + 0x2f8], eax
mov eax, dword [rsp + 0x31c]
sub eax, 2
mov dword [rsp + 0x31c], eax
jmp 0x180030703
mov eax, dword [rsp + 0x2f8]
cmp eax, 0x807
jle 0x180030761
mov eax, dword [rsp + 0x2f8]
and eax, 0x80
mov dword [rsp + 0x2f8], eax
mov eax, dword [rsp + 0x31c]
dec eax
mov dword [rsp + 0x31c], eax
jmp 0x180030703
mov dword [rsp + 0x2e8], 3
mov dword [rsp + 0x300], 8
mov eax, dword [rsp + 0x300]
test eax, eax
jle 0x1800307f9
mov eax, dword [rsp + 0x300]
cmp eax, 1
jle 0x1800307c6
mov eax, dword [rsp + 0x2e8]
and eax, 0x11d0
mov dword [rsp + 0x2e8], eax
mov eax, dword [rsp + 0x300]
sub eax, 2
mov dword [rsp + 0x300], eax
jmp 0x180030789
mov eax, dword [rsp + 0x2e8]
cmp eax, 0x80a
jle 0x1800307e7
mov eax, dword [rsp + 0x2e8]
and eax, 0x83
mov dword [rsp + 0x2e8], eax
mov eax, dword [rsp + 0x300]
dec eax
mov dword [rsp + 0x300], eax
jmp 0x180030789
mov dword [rsp + 0x2fc], 6
mov dword [rsp + 0x318], 0xa
mov eax, dword [rsp + 0x318]
test eax, eax
jle 0x18003087f
mov eax, dword [rsp + 0x318]
cmp eax, 1
jle 0x18003084c
mov eax, dword [rsp + 0x2fc]
and eax, 0x1f29
mov dword [rsp + 0x2fc], eax
mov eax, dword [rsp + 0x318]
sub eax, 2
mov dword [rsp + 0x318], eax
jmp 0x18003080f
mov eax, dword [rsp + 0x2fc]
cmp eax, 0x80c
jle 0x18003086d
mov eax, dword [rsp + 0x2fc]
and eax, 0x85
mov dword [rsp + 0x2fc], eax
mov eax, dword [rsp + 0x318]
dec eax
mov dword [rsp + 0x318], eax
jmp 0x18003080f
mov dword [rsp + 0x2f0], 4
mov dword [rsp + 0x308], 3
mov eax, dword [rsp + 0x308]
test eax, eax
jle 0x180030903
mov eax, dword [rsp + 0x308]
cmp eax, 1
jle 0x1800308d2
mov eax, dword [rsp + 0x2f0]
and eax, 0x1494
mov dword [rsp + 0x2f0], eax
mov eax, dword [rsp + 0x308]
sub eax, 2
mov dword [rsp + 0x308], eax
jmp 0x180030895
mov eax, dword [rsp + 0x2f0]
cmp eax, 0x805
jle 0x1800308f1
mov eax, dword [rsp + 0x2f0]
and eax, 0x7e
mov dword [rsp + 0x2f0], eax
mov eax, dword [rsp + 0x308]
dec eax
mov dword [rsp + 0x308], eax
jmp 0x180030895
mov dword [rsp + 0x314], 2
mov dword [rsp + 0x2f4], 0x13
cmp dword [rsp + 0x2f4], 0
jle 0x18003097a
mov eax, dword [rsp + 0x2f4]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18003095c
mov dword [rsp + 0x314], 4
mov eax, dword [rsp + 0x2f4]
sub eax, 2
mov dword [rsp + 0x2f4], eax
jmp 0x180030919
mov dword [rsp + 0x314], 4
mov eax, dword [rsp + 0x2f4]
sub eax, 2
mov dword [rsp + 0x2f4], eax
jmp 0x180030919
mov rax, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.180049ea0
add rsp, 0x348
pop rdi
pop rsi
ret