Function at 0x18002e570
Capabilities:
Acquire debug privileges

Disassembly:
push rdi
push r12
sub rsp, 0x448
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov edi, ecx
mov r8d, ecx
xor r12d, r12d
lea edx, [r12 + 1]
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x18002e5d3
lea rcx, [rsp + 0x20]
mov rdx, rax
call fcn.18002e4b0
test eax, eax
je 0x18002e5d3
cmp dword [rsp + 0x24], r12d
ja 0x18002e5cc
cmp dword [rsp + 0x20], 0xd59f80
jb 0x18002e5d3
xor eax, eax
jmp 0x18002e807
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x200
mov qword [rsp + 0x468], rbx
call fcn.180055310
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, str.SeDebugPrivilege
mov rcx, rax
call fcn.18002e9d0
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18002e9c9
lea rdx, [rsp + 0x30]
mov r8d, 0x200
mov rcx, rax
call fcn.18002ea60
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x18002e9c9
cmp byte [rsp + 0x30], r12b
je 0x18002e9c9
lea rdx, str.http:__www.sogou.com_sogou_query
lea rcx, [rsp + 0x30]
call fcn.180051948
test rax, rax
jne 0x18002e9c9
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x30]
lea rdx, [0x1800803c0]
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
mov rdx, rax
test rax, rax
je 0x18002e6d1
lea rax, [rsp + 0x30]
sub edx, eax
add edx, 4
cmp edx, edi
movsxd rax, edx
jge 0x18002e6c7
movsxd rdx, edi
nop dword [rax]
movzx ecx, byte [rsp + rax + 0x30]
cmp cl, 0x20
je 0x18002e6bf
cmp cl, 0x22
jne 0x18002e6d1
inc rax
cmp rax, rdx
jl 0x18002e6b0
mov eax, 1
jmp 0x18002e7ff
lea rdx, [0x1800a2da0]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
jne 0x18002e9c9
mov qword [rsp + 0x470], rbp
mov qword [rsp + 0x478], rsi
mov edi, r12d
mov qword [rsp + 0x440], r13
lea rbx, str.123.sogou.com
nop
mov rdx, qword [rbx]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
jne 0x18002e7c4
inc edi
add rbx, 8
cmp edi, 0x34
jb 0x18002e710
mov r8, qword [0x1800a7050]
mov rdi, qword [0x1800a7048]
movabs r13, 0x6666666666666667
mov rcx, r8
mov rax, r13
mov ebp, r12d
sub rcx, rdi
mov rsi, r12
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
test edx, edx
jle 0x18002e874
mov rbx, r12
cmp rsi, rdx
jb 0x18002e78d
call fcn.1800523b8
mov r8, qword [0x1800a7050]
mov rdi, qword [0x1800a7048]
sub r8, rdi
mov rax, r13
imul r8
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rsi, rdx
jb 0x18002e7b5
call fcn.1800523b8
mov rdi, qword [0x1800a7048]
cmp qword [rbx + rdi + 0x20], 0x10
jb 0x18002e822
mov rdx, qword [rbx + rdi + 8]
jmp 0x18002e827
lea rdx, str.:2251
lea rcx, [rsp + 0x30]
call fcn.180051948
test rax, rax
jne 0x18002e732
mov r12d, 1
mov eax, r12d
mov rsi, qword [rsp + 0x478]
mov rbp, qword [rsp + 0x470]
mov r13, qword [rsp + 0x440]
mov rbx, qword [rsp + 0x468]
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.180050540
add rsp, 0x448
pop r12
pop rdi
ret
lea rdx, [rbx + rdi + 8]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
jne 0x18002e8cb
mov r8, qword [0x1800a7050]
mov rdi, qword [0x1800a7048]
mov rax, r13
mov rcx, r8
inc ebp
inc rsi
sub rcx, rdi
add rbx, 0x28
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp ebp, edx
jl 0x18002e775
lea rdx, [0x1800802d8]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
je 0x18002e7e4
lea rcx, [rsp + 0x231]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x230], r12b
call fcn.180055310
lea rdx, str.__ico
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
mov rbx, rax
test rax, rax
jne 0x18002e905
jmp 0x18002e7e7
mov rcx, qword [0x1800a7050]
mov rax, r13
sub rcx, qword [0x1800a7048]
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movsxd rax, ebp
cmp rax, rdx
jb 0x18002e8fa
call fcn.1800523b8
mov r12d, 1
jmp 0x18002e7e4
lea rax, [rsp + 0x30]
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x230]
sub r8, rax
call fcn.180051c00
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x230]
repne scasb al, byte [rdi]
xor r8d, r8d
nop word [rax + rax]
movzx eax, byte [rbx + r8 + 6]
inc r8
mov byte [rdi + r8 - 2], al
test al, al
jne 0x18002e940
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x230]
repne scasb al, byte [rdi]
lea rdx, [0x1800803c0]
not rcx
lea rdi, [rcx - 1]
lea rcx, [rsp + 0x230]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
mov rdx, rax
test rax, rax
je 0x18002e7e4
lea rax, [rsp + 0x230]
sub edx, eax
add edx, 4
cmp edx, edi
movsxd rax, edx
jge 0x18002e9bf
movsxd rdx, edi
movzx ecx, byte [rsp + rax + 0x230]
cmp cl, 0x20
je 0x18002e9b7
cmp cl, 0x22
jne 0x18002e7e4
inc rax
cmp rax, rdx
jl 0x18002e9a1
mov eax, 1
jmp 0x18002e7e7
xor eax, eax
jmp 0x18002e7ff