Function at 0x18000c3e0
Capabilities:
Contain obfuscated stackstrings
Delete file
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x530]
sub rsp, 0x630
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x670], rbx
mov rax, qword [0x180042010]
xor rax, rsp
mov qword [rbp + 0x520], rax
mov qword [rsp + 0x58], r9
mov r13, r8
mov rbx, rdx
mov qword [rsp + 0x68], rdx
xor r12d, r12d
mov dword [rsp + 0x50], r12d
mov rcx, rdx
call fcn.180005c04
test al, al
jne 0x18000d921
mov rax, qword [r8]
mov rdx, qword [r8 + 8]
cmp rax, rdx
je 0x18000d921
mov ecx, r12d
sub rdx, rax
sar rdx, 7
test rdx, rdx
je 0x18000d921
add rax, 0x7c
nop dword [rax]
cmp byte [rax], r12b
jne 0x18000c486
inc rcx
sub rax, 0xffffffffffffff80
cmp rcx, rdx
jb 0x18000c470
jmp 0x18000d921
mov r8, rbx
lea rdx, [rbp + 0x400]
call fcn.18000ef70
nop
xor eax, eax
mov qword [rbp + 0x370], rax
mov qword [rbp + 0x378], rax
mov qword [rbp + 0x370], r12
mov word [rbp + 0x378], ax
lea rdx, [rbp + 0x400]
lea rcx, [rbp + 0x370]
call fcn.180013470
xor eax, eax
mov qword [rbp + 0x3d0], rax
mov qword [rbp + 0x3d8], rax
lea rax, [rbp + 0x370]
mov qword [rbp + 0x3d0], rax
mov byte [rbp + 0x3d8], 0
mov rcx, qword [rbp + 0x370]
test rcx, rcx
jne 0x18000c4fd
xor sil, sil
jmp 0x18000c51e
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
je 0x18000c514
xor sil, sil
jmp 0x18000c51e
mov byte [rbp + 0x378], 1
mov sil, 1
mov byte [rsp + 0x40], sil
mov byte [rbp + 0x3d8], sil
xor eax, eax
mov qword [rbp + 0x380], rax
mov qword [rbp + 0x388], rax
mov qword [rbp + 0x390], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x380], xmm0
mov qword [rbp + 0x390], r12
mov byte [rsp + 0x42], al
lea r9, [rsp + 0x42]
lea r8, [rbp + 0x380]
mov rdx, rbx
call fcn.18000dff0
test al, al
jne 0x18000c586
cmp byte [rsp + 0x42], al
je 0x18000c586
mov rcx, rbx
call fcn.1800059dc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor bl, bl
mov byte [rsp + 0x42], bl
xor r11d, r11d
mov r12d, r11d
mov rcx, qword [r13]
mov rax, qword [r13 + 8]
sub rax, rcx
sar rax, 7
test rax, rax
je 0x18000d826
mov r15d, r11d
nop dword [rax]
lea r14, [rcx + r15]
cmp byte [r14 + 0x7c], 0
je 0x18000c89e
mov rdi, r11
mov esi, r11d
mov rax, qword [rbp + 0x388]
mov rcx, qword [rbp + 0x380]
sub rax, rcx
sar rax, 7
test rax, rax
je 0x18000c63c
mov rbx, r11
nop dword [rax]
nop word [rax + rax]
shl rbx, 7
add rbx, rcx
mov rcx, r14
call fcn.1800059dc
mov rdx, rax
mov rcx, rbx
call fcn.1800059dc
mov rcx, rax
call fcn.18001d1b8
test eax, eax
je 0x18000c636
inc esi
mov ebx, esi
mov rax, qword [rbp + 0x388]
mov rcx, qword [rbp + 0x380]
sub rax, rcx
sar rax, 7
cmp rbx, rax
jb 0x18000c5f0
jmp 0x18000c639
mov rdi, rbx
xor r11d, r11d
test rdi, rdi
jne 0x18000c77f
lea rcx, [rbp + 0x420]
call fcn.180005a50
nop
lea rcx, [rbp + 0x440]
call fcn.180005a50
nop
lea rcx, [rbp + 0x460]
call fcn.180005a50
nop
mov qword [rbp + 0x480], r11
mov qword [rbp + 0x488], r11
mov qword [rbp + 0x490], r11
mov dword [rbp + 0x498], r11d
mov byte [rbp + 0x49c], dil
mov rdx, qword [rbp + 0x388]
cmp qword [rbp + 0x390], rdx
je 0x18000c72a
call fcn.180005abc
mov rbx, rax
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x420]
mov rcx, rax
call fcn.180006f60
nop
lea rcx, [rbx + 0x20]
lea rdx, [rbp + 0x440]
call fcn.180006f60
nop
lea rcx, [rbx + 0x40]
lea rdx, [rbp + 0x460]
call fcn.180006f60
nop
mov rax, qword [rbp + 0x480]
mov qword [rbx + 0x60], rax
mov rax, qword [rbp + 0x488]
mov qword [rbx + 0x68], rax
mov rax, qword [rbp + 0x490]
mov qword [rbx + 0x70], rax
mov eax, dword [rbp + 0x498]
mov dword [rbx + 0x78], eax
movzx eax, byte [rbp + 0x49c]
mov byte [rbx + 0x7c], al
mov rcx, qword [rbp + 0x388]
sub rcx, 0xffffffffffffff80
mov qword [rbp + 0x388], rcx
jmp 0x18000c744
lea r8, [rbp + 0x420]
lea rcx, [rbp + 0x380]
call fcn.1800102c0
mov rcx, qword [rbp + 0x388]
mov rax, qword [rbp + 0x380]
sub rcx, rax
and rcx, 0xffffffffffffff80
lea rdi, [rax - 0x80]
add rdi, rcx
lea rcx, [rbp + 0x460]
call fcn.1800059ec
nop
lea rcx, [rbp + 0x440]
call fcn.1800059ec
nop
lea rcx, [rbp + 0x420]
call fcn.1800059ec
mov rdx, rdi
lea rcx, [rbp + 0x4a0]
call fcn.180006f60
nop
lea rbx, [rdi + 0x20]
mov rdx, rbx
lea rcx, [rbp + 0x4c0]
call fcn.180006f60
nop
lea rsi, [rdi + 0x40]
mov rdx, rsi
lea rcx, [rbp + 0x4e0]
call fcn.180006f60
nop
mov rax, qword [rdi + 0x60]
mov qword [rbp + 0x500], rax
mov rax, qword [rdi + 0x68]
mov qword [rbp + 0x508], rax
mov rax, qword [rdi + 0x70]
mov qword [rbp + 0x510], rax
mov eax, dword [rdi + 0x78]
mov dword [rbp + 0x518], eax
movzx eax, byte [rdi + 0x7c]
mov byte [rbp + 0x51c], al
mov rdx, r14
mov rcx, rdi
call fcn.18000d9c0
lea rdx, [rbp + 0x4a0]
mov rcx, rdi
call fcn.18000615c
test al, al
je 0x18000c861
lea rdx, [rbp + 0x4c0]
mov rcx, rbx
call fcn.18000615c
test al, al
je 0x18000c861
mov rax, qword [rbp + 0x500]
cmp qword [rdi + 0x60], rax
jne 0x18000c861
mov rax, qword [rbp + 0x508]
cmp qword [rdi + 0x68], rax
jne 0x18000c861
mov rax, qword [rbp + 0x510]
cmp qword [rdi + 0x70], rax
jne 0x18000c861
lea rdx, [rbp + 0x4e0]
mov rcx, rsi
call fcn.18000615c
test al, al
je 0x18000c861
mov eax, dword [rbp + 0x518]
cmp dword [rdi + 0x78], eax
je 0x18000c86c
mov bl, 1
mov byte [rsp + 0x42], bl
mov byte [rdi + 0x7c], bl
jmp 0x18000c871
movzx ebx, byte [rsp + 0x42]
lea rcx, [rbp + 0x4e0]
call fcn.1800059ec
nop
lea rcx, [rbp + 0x4c0]
call fcn.1800059ec
nop
lea rcx, [rbp + 0x4a0]
call fcn.1800059ec
mov rcx, qword [r13]
xor r11d, r11d
inc r12
sub r15, 0xffffffffffffff80
mov rax, qword [r13 + 8]
sub rax, rcx
sar rax, 7
cmp r12, rax
jb 0x18000c5b0
test bl, bl
je 0x18000d821
mov rax, qword [rbp + 0x388]
cmp qword [rbp + 0x380], rax
je 0x18000d821
xor eax, eax
mov qword [rbp + 0x398], rax
mov qword [rbp + 0x3a0], rax
mov qword [rbp + 0x3a8], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x398], xmm0
mov qword [rbp + 0x3a8], r11
mov r9, qword [rbp + 0x388]
mov r10, r9
mov r8, qword [rbp + 0x380]
sub r10, r8
sar r10, 7
mov rcx, qword [rbp + 0x3a8]
sub rcx, qword [rbp + 0x398]
movabs rdi, 0x20c49ba5e353f7cf
mov rax, rdi
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r10, rdx
jbe 0x18000c998
movabs rax, 0x4189374bc6a7ef
mov qword [rsp + 0x60], rax
call fcn.180005ac0
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.18000614c
cmp r10, qword [rax]
ja 0x18000d965
mov rdx, r10
lea rcx, [rbp + 0x398]
call fcn.18000f970
mov r9, qword [rbp + 0x388]
mov r8, qword [rbp + 0x380]
xor r11d, r11d
mov r13, r11
mov rax, r9
sub rax, r8
sar rax, 7
test rax, rax
je 0x18000ccd9
mov r12, r11
lea r14, [r12 + r8]
mov eax, dword [r14 + 0x78]
dec eax
cmp eax, 2
ja 0x18000ccbf
mov dword [rbp - 0x80], r11d
mov qword [rbp + 0x34c], r11
mov qword [rbp + 0x354], r11
mov qword [rbp + 0x35c], r11
mov dword [rbp + 0x364], r11d
xor edx, edx
mov r8d, 0x280
lea rcx, [rbp - 0x7c]
call fcn.180018f90
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x204]
call fcn.180018f90
xor eax, eax
mov qword [rbp + 0x304], rax
mov qword [rbp + 0x30c], rax
mov qword [rbp + 0x314], rax
mov qword [rbp + 0x31c], rax
mov qword [rbp + 0x324], rax
mov qword [rbp + 0x32c], rax
mov qword [rbp + 0x334], rax
mov qword [rbp + 0x33c], rax
mov qword [rbp + 0x344], rax
mov rdx, qword [rbp + 0x3a0]
cmp qword [rbp + 0x3a8], rdx
je 0x18000cb0f
call fcn.180005abc
mov rcx, rax
lea rax, [rbp - 0x80]
mov edx, 7
nop
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x18000ca70
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
mov rax, qword [rax + 0x60]
mov qword [rcx + 0x60], rax
mov rdx, qword [rbp + 0x3a0]
add rdx, 0x3e8
mov qword [rbp + 0x3a0], rdx
jmp 0x18000cb26
lea r8, [rbp - 0x80]
lea rcx, [rbp + 0x398]
call fcn.180010040
mov rdx, qword [rbp + 0x3a0]
mov rcx, qword [rbp + 0x398]
sub rdx, rcx
mov rax, rdi
imul rdx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0x3e8
lea r15, [rcx - 0x3e8]
add r15, rax
mov dword [r15], 0x23ab45db
lea rbx, [r15 + 4]
xor edx, edx
mov r8d, 0x280
mov rcx, rbx
call fcn.180018f90
lea rsi, [r15 + 0x284]
xor edx, edx
mov r8d, 0x100
mov rcx, rsi
call fcn.180018f90
lea rdi, [r15 + 0x384]
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x20], rax
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x30], rax
mov qword [rdi + 0x38], rax
mov qword [rdi + 0x40], rax
mov rcx, r14
call fcn.180005c10
cmp rax, 0x13f
ja 0x18000cbe2
call fcn.1800059dc
sub rbx, rax
nop dword [rax + rax]
movzx ecx, word [rax]
mov word [rbx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x18000cbd0
jmp 0x18000cbf8
call fcn.1800059dc
mov rdx, rax
mov r8d, 0x13e
mov rcx, rbx
call fcn.18001d330
lea rcx, [r14 + 0x20]
call fcn.180005c10
cmp rax, 0x7f
ja 0x18000cc22
call fcn.1800059dc
sub rsi, rax
nop
movzx ecx, word [rax]
mov word [rsi + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x18000cc10
jmp 0x18000cc38
call fcn.1800059dc
mov rdx, rax
mov r8d, 0x7e
mov rcx, rsi
call fcn.18001d330
lea rcx, [r14 + 0x40]
call fcn.180005c10
cmp rax, 0x23
ja 0x18000cc62
call fcn.1800059dc
sub rdi, rax
nop
movzx ecx, word [rax]
mov word [rdi + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x18000cc50
jmp 0x18000cc78
call fcn.1800059dc
mov rdx, rax
mov r8d, 0x23
mov rcx, rdi
call fcn.18001d330
mov rax, qword [r14 + 0x60]
mov qword [r15 + 0x3cc], rax
mov rax, qword [r14 + 0x68]
mov qword [r15 + 0x3d4], rax
mov rax, qword [r14 + 0x70]
mov qword [r15 + 0x3dc], rax
mov eax, dword [r14 + 0x78]
mov dword [r15 + 0x3e4], eax
mov r9, qword [rbp + 0x388]
mov r8, qword [rbp + 0x380]
xor r11d, r11d
movabs rdi, 0x20c49ba5e353f7cf
inc r13
sub r12, 0xffffffffffffff80
mov rax, r9
sub rax, r8
sar rax, 7
cmp r13, rax
jb 0x18000c9b1
mov rcx, qword [rbp + 0x3a0]
cmp qword [rbp + 0x398], rcx
jne 0x18000ce46
mov r8, qword [rbp + 0x398]
test r8, r8
je 0x18000cd62
mov rcx, qword [rbp + 0x3a8]
sub rcx, r8
mov rax, rdi
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x3e8
mov rax, r8
cmp rdx, 0x1000
jb 0x18000cd43
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d96b
mov rcx, r8
call fcn.180016944
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x398], xmm0
xor r12d, r12d
mov qword [rbp + 0x3a8], r12
jmp 0x18000cd65
xor r12d, r12d
mov rbx, qword [rbp + 0x380]
test rbx, rbx
je 0x18000ce04
mov rdi, qword [rbp + 0x388]
mov qword [rsp + 0x48], rbx
cmp rbx, rdi
je 0x18000cdb7
lea rcx, [rbx + 0x40]
call fcn.1800059ec
nop
lea rcx, [rbx + 0x20]
call fcn.1800059ec
nop
mov rcx, rbx
call fcn.1800059ec
sub rbx, 0xffffffffffffff80
mov qword [rsp + 0x48], rbx
cmp rbx, rdi
jne 0x18000cd86
mov rbx, qword [rbp + 0x380]
mov rdx, qword [rbp + 0x390]
sub rdx, rbx
and rdx, 0xffffffffffffff80
mov rax, rbx
cmp rdx, 0x1000
jb 0x18000cdea
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d971
mov rcx, rbx
call fcn.180016944
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x380], xmm0
mov qword [rbp + 0x390], r12
cmp byte [rsp + 0x40], 0
je 0x18000ce24
mov rcx, qword [rbp + 0x370]
test rcx, rcx
je 0x18000ce1d
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbp + 0x378], 0
mov qword [rbp + 0x3d0], r12
mov rcx, qword [rbp + 0x370]
test rcx, rcx
je 0x18000d90c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000d905
xor eax, eax
mov qword [rbp + 0x3b0], rax
mov qword [rbp + 0x3b8], rax
mov qword [rbp + 0x3c0], rax
mov r8, r11
mov qword [rbp + 0x3b0], r11
mov qword [rbp + 0x3b8], r11
mov r9, r11
mov qword [rbp + 0x3c0], r11
mov dword [rbp + 0x3e0], 0x2d2d4352
mov dword [rbp + 0x3e4], 0x35343332
mov dword [rbp + 0x3e8], 0x61534350
mov dword [rbp + 0x3ec], 0x2d302e32
mov dword [rbp + 0x3f0], 0x2d736843
mov dword [rbp + 0x3f4], 0x61435243
mov dword [rbp + 0x3f8], 0x38313031
mov dword [rbp + 0x3fc], 0x35313032
movdqa xmm2, xmmword [0x1800381c0]
mov eax, r11d
mov r14d, 1
movd xmm3, r14d
lea rcx, [rbp + 0x3e0]
nop word [rax + rax]
movd xmm1, eax
pshufd xmm1, xmm1, 0
paddd xmm1, xmm2
movdqu xmm0, xmmword [rcx]
pslld xmm0, xmm3
paddd xmm1, xmm0
movdqu xmmword [rcx], xmm1
add eax, 4
lea rcx, [rcx + 0x10]
cmp eax, 8
jl 0x18000cef0
mov rcx, qword [rbp + 0x3a0]
mov r10, qword [rbp + 0x398]
sub rcx, r10
mov rax, rdi
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
test r10, r10
je 0x18000d6b5
imul r8d, edx, 0x3e8
lea r9, [rbp + 0x3b0]
mov rdx, r10
lea rcx, [rbp + 0x3e0]
call fcn.1800143d0
test al, al
je 0x18000d6a4
mov rbx, qword [rbp + 0x3b0]
mov rsi, qword [rbp + 0x3b8]
cmp rbx, rsi
jne 0x18000d0dd
test rbx, rbx
je 0x18000cfd6
mov rdx, qword [rbp + 0x3c0]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x18000cfb7
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d977
mov rcx, rbx
call fcn.180016944
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3b0], xmm0
xor r12d, r12d
mov qword [rbp + 0x3c0], r12
jmp 0x18000cfd9
xor r12d, r12d
mov r8, qword [rbp + 0x398]
test r8, r8
je 0x18000d049
mov rcx, qword [rbp + 0x3a8]
sub rcx, r8
mov rax, rdi
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x3e8
mov rax, r8
cmp rdx, 0x1000
jb 0x18000d02f
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d97d
mov rcx, r8
call fcn.180016944
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x398], xmm0
mov qword [rbp + 0x3a8], r12
mov rbx, qword [rbp + 0x380]
test rbx, rbx
je 0x18000ce04
mov rdi, qword [rbp + 0x388]
mov qword [rsp + 0x48], rbx
cmp rbx, rdi
je 0x18000d0a1
nop word [rax + rax]
lea rcx, [rbx + 0x40]
call fcn.1800059ec
nop
lea rcx, [rbx + 0x20]
call fcn.1800059ec
nop
mov rcx, rbx
call fcn.1800059ec
sub rbx, 0xffffffffffffff80
mov qword [rsp + 0x48], rbx
cmp rbx, rdi
jne 0x18000d070
mov rbx, qword [rbp + 0x380]
mov rdx, qword [rbp + 0x390]
sub rdx, rbx
and rdx, 0xffffffffffffff80
mov rax, rbx
cmp rdx, 0x1000
jb 0x18000cdea
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d953
jmp 0x18000cdea
mov r15, qword [rsp + 0x68]
mov rcx, r15
call fcn.1800059dc
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r8d, r8d
mov edx, 0x40000000
call fcn.180009ee0
mov rdi, rax
lea rcx, [rax + 1]
test rcx, 0xfffffffffffffffe
jne 0x18000d1d9
lea rdx, [0x180037b30]
mov rcx, r15
call fcn.180009900
mov r9, rax
cmp rax, 0xffffffffffffffff
je 0x18000d1d9
lea rcx, [rbp + 0x3e0]
call fcn.180005a74
lea rcx, [rbp + 0x3e0]
call fcn.180005a68
xor r12d, r12d
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rsp + 0x42], r12w
lea rdx, [rsp + 0x42]
mov rcx, rax
call fcn.180005a6c
xor r8d, r8d
mov rdx, r15
lea rcx, [rbp + 0x3e0]
call fcn.180008a40
mov dword [rsp + 0x50], r14d
lea rcx, [rbp + 0x3e0]
call fcn.1800096d0
mov rcx, r15
call fcn.1800059dc
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r8d, r8d
mov edx, 0x40000000
call fcn.180009ee0
mov rdi, rax
and r14d, 0xfffffffe
mov dword [rsp + 0x50], r14d
lea rcx, [rbp + 0x3e0]
call fcn.1800059ec
jmp 0x18000d1dc
xor r12d, r12d
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x18000d580
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbp + 0x3c8], r12d
mov r8d, esi
sub r8d, ebx
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x3c8]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
sub rsi, rbx
mov eax, dword [rbp + 0x3c8]
cmp rax, rsi
jne 0x18000d45c
lea rax, [rbp + 0x380]
mov r9, qword [rsp + 0x58]
cmp r9, rax
je 0x18000d295
mov rcx, qword [r9]
mov rax, qword [rbp + 0x380]
mov qword [r9], rax
mov qword [rbp + 0x380], rcx
mov rcx, qword [r9 + 8]
mov rax, qword [rbp + 0x388]
mov qword [r9 + 8], rax
mov qword [rbp + 0x388], rcx
mov rcx, qword [r9 + 0x10]
mov rax, qword [rbp + 0x390]
mov qword [r9 + 0x10], rax
mov qword [rbp + 0x390], rcx
mov r8, r12
mov rcx, qword [r9]
mov rax, qword [r9 + 8]
sub rax, rcx
sar rax, 7
test rax, rax
je 0x18000d2d2
mov rdx, r12
nop
mov byte [rdx + rcx + 0x7c], 0
inc r8
lea rdx, [rdx + 0x80]
mov rcx, qword [r9]
mov rax, qword [r9 + 8]
sub rax, rcx
sar rax, 7
cmp r8, rax
jb 0x18000d2b0
test rbx, rbx
je 0x18000d320
mov rdx, qword [rbp + 0x3c0]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x18000d306
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d983
mov rcx, rbx
call fcn.180016944
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3b0], xmm0
mov qword [rbp + 0x3c0], r12
mov r8, qword [rbp + 0x398]
test r8, r8
je 0x18000d397
mov rcx, qword [rbp + 0x3a8]
sub rcx, r8
movabs rax, 0x20c49ba5e353f7cf
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x3e8
mov rax, r8
cmp rdx, 0x1000
jb 0x18000d37d
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d989
mov rcx, r8
call fcn.180016944
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x398], xmm0
mov qword [rbp + 0x3a8], r12
mov rcx, qword [rbp + 0x380]
test rcx, rcx
je 0x18000d400
mov rdx, qword [rbp + 0x388]
call fcn.180010670
mov rdx, qword [rbp + 0x390]
mov rcx, qword [rbp + 0x380]
sub rdx, rcx
and rdx, 0xffffffffffffff80
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d3e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d98f
call fcn.180016944
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x380], xmm0
mov qword [rbp + 0x390], r12
cmp byte [rsp + 0x40], 0
je 0x18000d420
mov rcx, qword [rbp + 0x370]
test rcx, rcx
je 0x18000d419
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbp + 0x378], 0
mov qword [rbp + 0x3d0], r12
mov rcx, qword [rbp + 0x370]
test rcx, rcx
je 0x18000d440
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x370], r12
mov word [rbp + 0x378], 0
lea rcx, [rbp + 0x400]
call fcn.1800059ec
mov al, 1
jmp 0x18000d923
test rbx, rbx
je 0x18000d4aa
mov rdx, qword [rbp + 0x3c0]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x18000d490
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d995
mov rcx, rbx
call fcn.180016944
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3b0], xmm0
mov qword [rbp + 0x3c0], r12
mov r8, qword [rbp + 0x398]
test r8, r8
je 0x18000d521
mov rcx, qword [rbp + 0x3a8]
sub rcx, r8
movabs rax, 0x20c49ba5e353f7cf
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x3e8
mov rax, r8
cmp rdx, 0x1000
jb 0x18000d507
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d99b
mov rcx, r8
call fcn.180016944
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x398], xmm0
mov qword [rbp + 0x3a8], r12
mov rdx, qword [rbp + 0x380]
test rdx, rdx
je 0x18000ce04
mov r8, qword [rbp + 0x388]
call fcn.18000fad0
mov rdx, qword [rbp + 0x390]
mov rcx, qword [rbp + 0x380]
sub rdx, rcx
and rdx, 0xffffffffffffff80
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000cded
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d959
jmp 0x18000cded
test rbx, rbx
je 0x18000d5ce
mov rdx, qword [rbp + 0x3c0]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x18000d5b4
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d9a1
mov rcx, rbx
call fcn.180016944
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3b0], xmm0
mov qword [rbp + 0x3c0], r12
mov r8, qword [rbp + 0x398]
test r8, r8
je 0x18000d645
mov rcx, qword [rbp + 0x3a8]
sub rcx, r8
movabs rax, 0x20c49ba5e353f7cf
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x3e8
mov rax, r8
cmp rdx, 0x1000
jb 0x18000d62b
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d9a7
mov rcx, r8
call fcn.180016944
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x398], xmm0
mov qword [rbp + 0x3a8], r12
mov rcx, qword [rbp + 0x380]
test rcx, rcx
je 0x18000ce04
mov rdx, qword [rbp + 0x388]
call fcn.180010670
mov rdx, qword [rbp + 0x390]
mov rcx, qword [rbp + 0x380]
sub rdx, rcx
and rdx, 0xffffffffffffff80
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000cded
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d95f
jmp 0x18000cded
mov r9, qword [rbp + 0x3c0]
mov r8, qword [rbp + 0x3b0]
xor r11d, r11d
test r8, r8
je 0x18000d702
sub r9, r8
mov rax, r8
cmp r9, 0x1000
jb 0x18000d6e2
add r9, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d9ad
mov rdx, r9
mov rcx, r8
call fcn.180016944
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3b0], xmm0
xor r11d, r11d
mov qword [rbp + 0x3c0], r11
mov r8, qword [rbp + 0x398]
test r8, r8
je 0x18000d775
mov rcx, qword [rbp + 0x3a8]
sub rcx, r8
mov rax, rdi
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x3e8
mov rax, r8
cmp rdx, 0x1000
jb 0x18000d758
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d9b3
mov rcx, r8
call fcn.180016944
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x398], xmm0
xor r11d, r11d
mov qword [rbp + 0x3a8], r11
mov rbx, qword [rbp + 0x380]
test rbx, rbx
je 0x18000d817
mov rdi, qword [rbp + 0x388]
mov qword [rsp + 0x58], rbx
cmp rbx, rdi
je 0x18000d7c7
lea rcx, [rbx + 0x40]
call fcn.1800059ec
nop
lea rcx, [rbx + 0x20]
call fcn.1800059ec
nop
mov rcx, rbx
call fcn.1800059ec
sub rbx, 0xffffffffffffff80
mov qword [rsp + 0x58], rbx
cmp rbx, rdi
jne 0x18000d796
mov rbx, qword [rbp + 0x380]
mov rdx, qword [rbp + 0x390]
sub rdx, rbx
and rdx, 0xffffffffffffff80
mov rax, rbx
cmp rdx, 0x1000
jb 0x18000d7fa
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d9b9
mov rcx, rbx
call fcn.180016944
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x380], xmm0
xor r11d, r11d
mov qword [rbp + 0x390], r11
cmp byte [rsp + 0x40], 0
jmp 0x18000d8cb
movzx esi, byte [rsp + 0x40]
mov rbx, qword [rbp + 0x380]
test rbx, rbx
je 0x18000d8c8
mov rdi, qword [rbp + 0x388]
mov qword [rsp + 0x58], rbx
cmp rbx, rdi
je 0x18000d878
lea rcx, [rbx + 0x40]
call fcn.1800059ec
nop
lea rcx, [rbx + 0x20]
call fcn.1800059ec
nop
mov rcx, rbx
call fcn.1800059ec
sub rbx, 0xffffffffffffff80
mov qword [rsp + 0x58], rbx
cmp rbx, rdi
jne 0x18000d847
mov rbx, qword [rbp + 0x380]
mov rdx, qword [rbp + 0x390]
sub rdx, rbx
and rdx, 0xffffffffffffff80
mov rax, rbx
cmp rdx, 0x1000
jb 0x18000d8ab
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d94d
mov rcx, rbx
call fcn.180016944
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x380], xmm0
xor r11d, r11d
mov qword [rbp + 0x390], r11
test sil, sil
je 0x18000d8e9
mov rcx, qword [rbp + 0x370]
test rcx, rcx
je 0x18000d8e2
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r11d, r11d
mov byte [rbp + 0x378], 0
mov qword [rbp + 0x3d0], r11
mov rcx, qword [rbp + 0x370]
test rcx, rcx
je 0x18000d90c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r12d, r12d
mov qword [rbp + 0x370], r12
mov word [rbp + 0x378], 0
lea rcx, [rbp + 0x400]
call fcn.1800059ec
xor al, al
mov rcx, qword [rbp + 0x520]
xor rcx, rsp
call fcn.180016920
mov rbx, qword [rsp + 0x670]
add rsp, 0x630
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18001b79c
nop
call fcn.18001b79c
int3
call fcn.18001b79c
int3
call fcn.18001b79c
nop
call fcn.180006d30
nop
call fcn.18001b79c
nop
call fcn.18001b79c
nop
call fcn.18001b79c
nop
call fcn.18001b79c
nop
call fcn.18001b79c
nop
call fcn.18001b79c
nop
call fcn.18001b79c
nop
call fcn.18001b79c
nop
call fcn.18001b79c
nop
call fcn.18001b79c
nop
call fcn.18001b79c
nop
call fcn.18001b79c
nop
call fcn.18001b79c
nop
call fcn.18001b79c
int3