Function at 0x18001fb00
Capabilities:
Contain obfuscated stackstrings
Delete file
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x510]
sub rsp, 0x610
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x650], rbx
mov rax, qword [0x18008d0c0]
xor rax, rsp
mov qword [rbp + 0x500], rax
mov qword [rsp + 0x50], r9
mov r12, r8
mov rbx, rdx
mov qword [rsp + 0x48], rdx
xor r14d, r14d
mov dword [rsp + 0x44], r14d
cmp qword [rdx + 0x10], r14
je 0x1800213e5
mov rax, qword [r8]
mov rdx, qword [r8 + 8]
cmp rax, rdx
je 0x1800213e5
mov ecx, r14d
sub rdx, rax
sar rdx, 7
test rdx, rdx
je 0x1800213e5
add rax, 0x7c
cmp byte [rax], r14b
jne 0x18001fb9c
inc rcx
sub rax, 0xffffffffffffff80
cmp rcx, rdx
jb 0x18001fb86
jmp 0x1800213e5
mov r8, rbx
lea rdx, [rbp + 0x3c0]
call fcn.1800222d0
nop
xor eax, eax
mov qword [rbp + 0x368], rax
mov qword [rbp + 0x370], rax
mov qword [rbp + 0x368], r14
mov word [rbp + 0x370], ax
lea rdx, [rbp + 0x3c0]
lea rcx, [rbp + 0x368]
call fcn.180006ab0
xor eax, eax
mov qword [rbp + 0x3b0], rax
mov qword [rbp + 0x3b8], rax
lea rax, [rbp + 0x368]
mov qword [rbp + 0x3b0], rax
mov byte [rbp + 0x3b8], 0
mov rcx, qword [rbp + 0x368]
test rcx, rcx
jne 0x18001fc13
xor sil, sil
jmp 0x18001fc34
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
je 0x18001fc2a
xor sil, sil
jmp 0x18001fc34
mov byte [rbp + 0x370], 1
mov sil, 1
mov byte [rsp + 0x40], sil
mov byte [rbp + 0x3b8], sil
xor eax, eax
mov qword [rbp + 0x350], rax
mov qword [rbp + 0x358], rax
mov qword [rbp + 0x360], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x350], xmm0
mov qword [rbp + 0x360], r14
mov byte [rsp + 0x41], al
lea r9, [rsp + 0x41]
lea r8, [rbp + 0x350]
mov rdx, rbx
call fcn.180021640
test al, al
jne 0x18001fc9e
cmp byte [rsp + 0x41], al
je 0x18001fc9e
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x18001fc98
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r13b, r13b
xor ebx, ebx
mov r15d, ebx
mov rcx, qword [r12]
mov rax, qword [r12 + 8]
sub rax, rcx
sar rax, 7
test rax, rax
je 0x1800212bf
nop
mov rdi, r15
shl rdi, 7
add rdi, rcx
cmp byte [rdi + 0x7c], 0
je 0x18002023a
mov r14, rbx
mov esi, ebx
mov rax, qword [rbp + 0x358]
mov rcx, qword [rbp + 0x350]
sub rax, rcx
sar rax, 7
test rax, rax
je 0x18001fd4f
nop dword [rax]
nop word [rax + rax]
shl rbx, 7
add rbx, rcx
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x18001fd14
mov rdx, qword [rdi]
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x18001fd21
mov rcx, qword [rbx]
call fcn.180047348
test eax, eax
je 0x18001fd4a
inc esi
mov ebx, esi
mov rax, qword [rbp + 0x358]
mov rcx, qword [rbp + 0x350]
sub rax, rcx
sar rax, 7
cmp rbx, rax
jb 0x18001fd00
jmp 0x18001fd4d
mov r14, rbx
xor ebx, ebx
test r14, r14
jne 0x18001ff71
mov qword [rbp + 0x410], rbx
mov qword [rbp + 0x418], rbx
mov qword [rbp + 0x410], rbx
mov qword [rbp + 0x418], 7
mov word [rbp + 0x400], bx
mov qword [rbp + 0x430], rbx
mov qword [rbp + 0x438], rbx
mov qword [rbp + 0x430], rbx
mov qword [rbp + 0x438], 7
mov word [rbp + 0x420], bx
mov qword [rbp + 0x450], rbx
mov qword [rbp + 0x458], rbx
mov qword [rbp + 0x450], rbx
mov qword [rbp + 0x458], 7
mov word [rbp + 0x440], bx
mov qword [rbp + 0x460], rbx
mov qword [rbp + 0x468], rbx
mov qword [rbp + 0x470], rbx
mov dword [rbp + 0x478], ebx
mov byte [rbp + 0x47c], r14b
mov rax, qword [rbp + 0x358]
cmp qword [rbp + 0x360], rax
je 0x18001fe22
lea rdx, [rbp + 0x400]
mov rcx, rax
call fcn.18001f700
mov rcx, qword [rbp + 0x358]
sub rcx, 0xffffffffffffff80
mov qword [rbp + 0x358], rcx
jmp 0x18001fe3f
lea r8, [rbp + 0x400]
mov rdx, rax
lea rcx, [rbp + 0x350]
call fcn.180023410
mov rcx, qword [rbp + 0x358]
mov rax, qword [rbp + 0x350]
sub rcx, rax
and rcx, 0xffffffffffffff80
lea r14, [rax - 0x80]
add r14, rcx
mov rdx, qword [rbp + 0x458]
cmp rdx, 8
jb 0x18001fe9a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x440]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001fe95
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002142f
call fcn.180037bf4
mov qword [rbp + 0x450], rbx
mov qword [rbp + 0x458], 7
mov word [rbp + 0x440], bx
mov rdx, qword [rbp + 0x438]
cmp rdx, 8
jb 0x18001fef9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x420]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001fef4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180021435
call fcn.180037bf4
mov qword [rbp + 0x430], rbx
mov qword [rbp + 0x438], 7
mov word [rbp + 0x420], bx
mov rdx, qword [rbp + 0x418]
cmp rdx, 8
jb 0x18001ff58
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x400]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001ff53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002143b
call fcn.180037bf4
mov qword [rbp + 0x410], rbx
mov qword [rbp + 0x418], 7
mov word [rbp + 0x400], bx
mov rdx, r14
lea rcx, [rbp + 0x480]
call fcn.18001f700
nop
mov rdx, rdi
mov rcx, r14
call fcn.1800077e0
lea rdx, [rdi + 0x20]
lea rcx, [r14 + 0x20]
call fcn.1800077e0
lea rsi, [r14 + 0x40]
lea rdx, [rdi + 0x40]
mov rcx, rsi
call fcn.1800077e0
mov rax, qword [rdi + 0x60]
mov qword [r14 + 0x60], rax
mov rax, qword [rdi + 0x68]
mov qword [r14 + 0x68], rax
mov rax, qword [rdi + 0x70]
mov qword [r14 + 0x70], rax
mov eax, dword [rdi + 0x78]
mov dword [r14 + 0x78], eax
movzx eax, byte [rdi + 0x7c]
mov byte [r14 + 0x7c], al
lea rcx, [rbp + 0x480]
cmp qword [rbp + 0x498], 8
cmovae rcx, qword [rbp + 0x480]
mov r8, r14
cmp qword [r14 + 0x18], 8
jb 0x18001fff4
mov r8, qword [r14]
mov rdx, qword [r14 + 0x10]
cmp rdx, qword [rbp + 0x490]
jne 0x180020110
test rdx, rdx
je 0x180020028
sub r8, rcx
nop dword [rax]
movzx eax, word [rcx]
cmp word [rcx + r8], ax
jne 0x180020110
add rcx, 2
sub rdx, 1
jne 0x180020010
lea rcx, [rbp + 0x4a0]
cmp qword [rbp + 0x4b8], 8
cmovae rcx, qword [rbp + 0x4a0]
lea r8, [r14 + 0x20]
cmp qword [r14 + 0x38], 8
jb 0x18002004e
mov r8, qword [r14 + 0x20]
mov rdx, qword [r14 + 0x30]
cmp rdx, qword [rbp + 0x4b0]
jne 0x180020110
test rdx, rdx
je 0x180020088
sub r8, rcx
nop word [rax + rax]
movzx eax, word [rcx]
cmp word [rcx + r8], ax
jne 0x180020110
add rcx, 2
sub rdx, 1
jne 0x180020070
mov rax, qword [rbp + 0x4e0]
cmp qword [r14 + 0x60], rax
jne 0x180020110
mov rax, qword [rbp + 0x4e8]
cmp qword [r14 + 0x68], rax
jne 0x180020110
mov rax, qword [rbp + 0x4f0]
cmp qword [r14 + 0x70], rax
jne 0x180020110
lea rcx, [rbp + 0x4c0]
cmp qword [rbp + 0x4d8], 8
cmovae rcx, qword [rbp + 0x4c0]
mov r8, rsi
cmp qword [rsi + 0x18], 8
jb 0x1800200d3
mov r8, qword [rsi]
mov rdx, qword [rsi + 0x10]
cmp rdx, qword [rbp + 0x4d0]
jne 0x180020110
test rdx, rdx
je 0x180020104
sub r8, rcx
nop dword [rax + rax]
movzx eax, word [rcx]
cmp word [rcx + r8], ax
jne 0x180020110
add rcx, 2
sub rdx, 1
jne 0x1800200f0
mov eax, dword [rbp + 0x4f8]
cmp dword [r14 + 0x78], eax
je 0x180020117
mov r13b, 1
mov byte [r14 + 0x7c], r13b
mov rdx, qword [rbp + 0x4d8]
cmp rdx, 8
jb 0x18002015d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x4c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180020158
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180021441
call fcn.180037bf4
xor ebx, ebx
mov qword [rbp + 0x4d0], rbx
mov qword [rbp + 0x4d8], 7
mov word [rbp + 0x4c0], bx
mov rdx, qword [rbp + 0x4b8]
cmp rdx, 8
jb 0x1800201be
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x4a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800201b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180021447
call fcn.180037bf4
mov qword [rbp + 0x4b0], rbx
mov qword [rbp + 0x4b8], 7
mov word [rbp + 0x4a0], bx
mov rdx, qword [rbp + 0x498]
cmp rdx, 8
jb 0x18002021d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x480]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180020218
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002144d
call fcn.180037bf4
mov qword [rbp + 0x490], rbx
mov qword [rbp + 0x498], 7
mov word [rbp + 0x480], bx
mov rcx, qword [r12]
inc r15
mov rax, qword [r12 + 8]
sub rax, rcx
sar rax, 7
cmp r15, rax
jb 0x18001fcc0
test r13b, r13b
je 0x1800212ba
mov rax, qword [rbp + 0x358]
cmp qword [rbp + 0x350], rax
je 0x1800212ba
xor eax, eax
mov qword [rbp + 0x378], rax
mov qword [rbp + 0x380], rax
mov qword [rbp + 0x388], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x378], xmm0
mov qword [rbp + 0x388], rbx
mov r9, qword [rbp + 0x358]
mov r10, r9
mov r8, qword [rbp + 0x350]
sub r10, r8
sar r10, 7
mov rcx, qword [rbp + 0x388]
sub rcx, qword [rbp + 0x378]
movabs rdi, 0x20c49ba5e353f7cf
mov rax, rdi
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r10, rdx
jbe 0x180020311
movabs rax, 0x4189374bc6a7ef
cmp r10, rax
ja 0x180021429
mov rdx, r10
lea rcx, [rbp + 0x378]
call fcn.180022b70
mov r9, qword [rbp + 0x358]
mov r8, qword [rbp + 0x350]
mov r13, rbx
mov rax, r9
sub rax, r8
sar rax, 7
test rax, rax
je 0x180020681
mov r12, rbx
nop word [rax + rax]
lea rbx, [r8 + r12]
mov eax, dword [rbx + 0x78]
dec eax
cmp eax, 2
ja 0x180020665
xor eax, eax
mov dword [rsp + 0x60], eax
mov qword [rbp + 0x32c], rax
mov qword [rbp + 0x334], rax
mov qword [rbp + 0x33c], rax
mov dword [rbp + 0x344], eax
xor edx, edx
mov r8d, 0x280
lea rcx, [rsp + 0x64]
call fcn.180039b90
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x1e4]
call fcn.180039b90
xor eax, eax
mov qword [rbp + 0x2e4], rax
mov qword [rbp + 0x2ec], rax
mov qword [rbp + 0x2f4], rax
mov qword [rbp + 0x2fc], rax
mov qword [rbp + 0x304], rax
mov qword [rbp + 0x30c], rax
mov qword [rbp + 0x314], rax
mov qword [rbp + 0x31c], rax
mov qword [rbp + 0x324], rax
mov rdx, qword [rbp + 0x380]
cmp qword [rbp + 0x388], rdx
je 0x18002048f
lea rax, [rsp + 0x60]
mov ecx, 7
nop dword [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rdx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rcx, 1
jne 0x1800203f0
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x50], xmm1
mov rax, qword [rax + 0x60]
mov qword [rdx + 0x60], rax
mov rdx, qword [rbp + 0x380]
add rdx, 0x3e8
mov qword [rbp + 0x380], rdx
jmp 0x1800204a7
lea r8, [rsp + 0x60]
lea rcx, [rbp + 0x378]
call fcn.1800231d0
mov rdx, qword [rbp + 0x380]
mov rcx, qword [rbp + 0x378]
sub rdx, rcx
mov rax, rdi
imul rdx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0x3e8
lea rdi, [rcx - 0x3e8]
add rdi, rax
mov dword [rdi], 0x23ab45db
xor edx, edx
mov r8d, 0x280
lea rcx, [rdi + 4]
call fcn.180039b90
xor edx, edx
mov r8d, 0x100
lea rcx, [rdi + 0x284]
call fcn.180039b90
lea r15, [rdi + 0x384]
xor eax, eax
mov qword [r15], rax
mov qword [r15 + 8], rax
mov qword [r15 + 0x10], rax
mov qword [r15 + 0x18], rax
mov qword [r15 + 0x20], rax
mov qword [r15 + 0x28], rax
mov qword [r15 + 0x30], rax
mov qword [r15 + 0x38], rax
mov qword [r15 + 0x40], rax
cmp qword [rbx + 0x10], 0x13f
ja 0x180020563
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x180020544
mov rcx, qword [rbx]
mov rdx, rdi
sub rdx, rcx
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx + 4], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x180020550
jmp 0x18002057f
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x180020570
mov rdx, qword [rbx]
mov r8d, 0x13e
lea rcx, [rdi + 4]
call fcn.1800474c0
cmp qword [rbx + 0x30], 0x7f
ja 0x1800205b6
lea rcx, [rbx + 0x20]
cmp qword [rcx + 0x18], 8
jb 0x180020594
mov rcx, qword [rcx]
mov rdx, rdi
sub rdx, rcx
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx + 0x284], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1800205a0
jmp 0x1800205d6
lea rdx, [rbx + 0x20]
cmp qword [rdx + 0x18], 8
jb 0x1800205c4
mov rdx, qword [rdx]
mov r8d, 0x7e
lea rcx, [rdi + 0x284]
call fcn.1800474c0
cmp qword [rbx + 0x50], 0x23
ja 0x180020607
lea rcx, [rbx + 0x40]
cmp qword [rcx + 0x18], 8
jb 0x1800205eb
mov rcx, qword [rcx]
mov rdx, rdi
sub rdx, rcx
movzx eax, word [rcx]
mov word [rdx + rcx + 0x384], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1800205f1
jmp 0x180020623
lea rdx, [rbx + 0x40]
cmp qword [rdx + 0x18], 8
jb 0x180020615
mov rdx, qword [rdx]
mov r8d, 0x23
mov rcx, r15
call fcn.1800474c0
mov rax, qword [rbx + 0x60]
mov qword [rdi + 0x3cc], rax
mov rax, qword [rbx + 0x68]
mov qword [rdi + 0x3d4], rax
mov rax, qword [rbx + 0x70]
mov qword [rdi + 0x3dc], rax
mov eax, dword [rbx + 0x78]
mov dword [rdi + 0x3e4], eax
mov r9, qword [rbp + 0x358]
mov r8, qword [rbp + 0x350]
movabs rdi, 0x20c49ba5e353f7cf
inc r13
sub r12, 0xffffffffffffff80
mov rax, r9
sub rax, r8
sar rax, 7
cmp r13, rax
jb 0x180020330
xor ebx, ebx
mov rcx, qword [rbp + 0x380]
cmp qword [rbp + 0x378], rcx
jne 0x180020824
mov r8, qword [rbp + 0x378]
test r8, r8
je 0x180020705
mov rcx, qword [rbp + 0x388]
sub rcx, r8
mov rax, rdi
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x3e8
mov rax, r8
cmp rdx, 0x1000
jb 0x1800206eb
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180021453
mov rcx, r8
call fcn.180037bf4
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x378], xmm0
mov qword [rbp + 0x388], rbx
mov rbx, qword [rbp + 0x350]
test rbx, rbx
je 0x18002078a
mov rdi, qword [rbp + 0x358]
cmp rbx, rdi
je 0x180020738
nop dword [rax]
mov rcx, rbx
call fcn.180013c30
sub rbx, 0xffffffffffffff80
cmp rbx, rdi
jne 0x180020720
mov rbx, qword [rbp + 0x350]
mov rdx, qword [rbp + 0x360]
sub rdx, rbx
and rdx, 0xffffffffffffff80
mov rax, rbx
cmp rdx, 0x1000
jb 0x18002076b
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180021459
mov rcx, rbx
call fcn.180037bf4
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x350], xmm0
xor r14d, r14d
mov qword [rbp + 0x360], r14
jmp 0x18002078d
xor r14d, r14d
cmp byte [rsp + 0x40], 0
je 0x1800207ad
mov rcx, qword [rbp + 0x368]
test rcx, rcx
je 0x1800207a6
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbp + 0x370], 0
mov qword [rbp + 0x3b0], r14
mov rcx, qword [rbp + 0x368]
test rcx, rcx
je 0x1800207cd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x368], r14
mov word [rbp + 0x370], 0
mov rdx, qword [rbp + 0x3d8]
cmp rdx, 8
jb 0x1800213cd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x3c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800213c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180021417
jmp 0x1800213c8
xor eax, eax
mov qword [rbp + 0x390], rax
mov qword [rbp + 0x398], rax
mov qword [rbp + 0x3a0], rax
mov r8, rbx
mov qword [rbp + 0x390], rbx
mov qword [rbp + 0x398], rbx
mov r9, rbx
mov qword [rbp + 0x3a0], rbx
mov dword [rbp + 0x3e0], 0x2d2d4352
mov dword [rbp + 0x3e4], 0x35343332
mov dword [rbp + 0x3e8], 0x61534350
mov dword [rbp + 0x3ec], 0x2d302e32
mov dword [rbp + 0x3f0], 0x2d736843
mov dword [rbp + 0x3f4], 0x61435243
mov dword [rbp + 0x3f8], 0x38313031
mov dword [rbp + 0x3fc], 0x35313032
movdqa xmm2, xmmword [0x180079920]
mov eax, ebx
mov r14d, 1
movd xmm3, r14d
lea rcx, [rbp + 0x3e0]
movd xmm1, eax
pshufd xmm1, xmm1, 0
paddd xmm1, xmm2
movdqu xmm0, xmmword [rcx]
pslld xmm0, xmm3
paddd xmm1, xmm0
movdqu xmmword [rcx], xmm1
add eax, 4
lea rcx, [rcx + 0x10]
cmp eax, 8
jl 0x1800208c2
mov rcx, qword [rbp + 0x380]
mov r10, qword [rbp + 0x378]
sub rcx, r10
mov rax, rdi
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
test r10, r10
je 0x1800210e4
imul r8d, edx, 0x3e8
lea r9, [rbp + 0x390]
mov rdx, r10
lea rcx, [rbp + 0x3e0]
call fcn.1800258e0
test al, al
je 0x1800210d6
mov rbx, qword [rbp + 0x390]
mov rsi, qword [rbp + 0x398]
cmp rbx, rsi
jne 0x180020b2f
test rbx, rbx
je 0x1800209a8
mov rdx, qword [rbp + 0x3a0]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x180020989
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002145f
mov rcx, rbx
call fcn.180037bf4
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x390], xmm0
xor r14d, r14d
mov qword [rbp + 0x3a0], r14
jmp 0x1800209ab
xor r14d, r14d
mov r8, qword [rbp + 0x378]
test r8, r8
je 0x180020a1b
mov rcx, qword [rbp + 0x388]
sub rcx, r8
mov rax, rdi
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x3e8
mov rax, r8
cmp rdx, 0x1000
jb 0x180020a01
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180021465
mov rcx, r8
call fcn.180037bf4
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x378], xmm0
mov qword [rbp + 0x388], r14
mov rbx, qword [rbp + 0x350]
test rbx, rbx
je 0x180020a98
mov rdi, qword [rbp + 0x358]
cmp rbx, rdi
je 0x180020a4b
mov rcx, rbx
call fcn.180013c30
sub rbx, 0xffffffffffffff80
cmp rbx, rdi
jne 0x180020a33
mov rbx, qword [rbp + 0x350]
mov rdx, qword [rbp + 0x360]
sub rdx, rbx
and rdx, 0xffffffffffffff80
mov rax, rbx
cmp rdx, 0x1000
jb 0x180020a7e
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002146b
mov rcx, rbx
call fcn.180037bf4
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x350], xmm0
mov qword [rbp + 0x360], r14
cmp byte [rsp + 0x40], 0
je 0x180020ab8
mov rcx, qword [rbp + 0x368]
test rcx, rcx
je 0x180020ab1
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbp + 0x370], 0
mov qword [rbp + 0x3b0], r14
mov rcx, qword [rbp + 0x368]
test rcx, rcx
je 0x180020ad8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x368], r14
mov word [rbp + 0x370], 0
mov rdx, qword [rbp + 0x3d8]
cmp rdx, 8
jb 0x1800213cd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x3c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800213c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002141d
jmp 0x1800213c8
mov r15, qword [rsp + 0x48]
mov rcx, r15
cmp qword [r15 + 0x18], 8
jb 0x180020b41
mov rcx, qword [r15]
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r8d, r8d
mov edx, 0x40000000
call fcn.180012af0
mov rdi, rax
lea rcx, [rax + 1]
test rcx, 0xfffffffffffffffe
jne 0x180020c6d
lea rdx, [0x180078738]
mov rcx, r15
call fcn.180007670
cmp rax, 0xffffffffffffffff
je 0x180020c6d
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3f0], xmm0
movdqa xmm1, xmmword [0x180079900]
movdqu xmmword [rbp + 0x3f0], xmm1
xor r12d, r12d
mov word [rbp + 0x3e0], r12w
mov r9, rax
xor r8d, r8d
mov rdx, r15
lea rcx, [rbp + 0x3e0]
call fcn.180007a00
mov dword [rsp + 0x44], r14d
lea rcx, [rbp + 0x3e0]
call fcn.180011b00
cmp qword [r15 + 0x18], 8
jb 0x180020be1
mov r15, qword [r15]
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r8d, r8d
mov edx, 0x40000000
mov rcx, r15
call fcn.180012af0
mov rdi, rax
and r14d, 0xfffffffe
mov dword [rsp + 0x44], r14d
mov rdx, qword [rbp + 0x3f8]
cmp rdx, 8
jb 0x180020c53
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x3e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180020c4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180021471
call fcn.180037bf4
movdqa xmm0, xmmword [0x180079900]
movdqu xmmword [rbp + 0x3f0], xmm0
mov word [rbp + 0x3e0], r12w
jmp 0x180020c70
xor r12d, r12d
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x180020fd8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbp + 0x3a8], r12d
mov r8d, esi
sub r8d, ebx
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x3a8]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
sub rsi, rbx
mov eax, dword [rbp + 0x3a8]
cmp rax, rsi
jne 0x180020ea6
lea rax, [rbp + 0x350]
mov r9, qword [rsp + 0x50]
cmp r9, rax
je 0x180020d29
mov rcx, qword [r9]
mov rax, qword [rbp + 0x350]
mov qword [r9], rax
mov qword [rbp + 0x350], rcx
mov rcx, qword [r9 + 8]
mov rax, qword [rbp + 0x358]
mov qword [r9 + 8], rax
mov qword [rbp + 0x358], rcx
mov rcx, qword [r9 + 0x10]
mov rax, qword [rbp + 0x360]
mov qword [r9 + 0x10], rax
mov qword [rbp + 0x360], rcx
mov r8, r12
mov rcx, qword [r9]
mov rax, qword [r9 + 8]
sub rax, rcx
sar rax, 7
test rax, rax
je 0x180020d72
mov rdx, r12
nop dword [rax]
nop word [rax + rax]
mov byte [rcx + rdx + 0x7c], 0
inc r8
lea rdx, [rdx + 0x80]
mov rcx, qword [r9]
mov rax, qword [r9 + 8]
sub rax, rcx
sar rax, 7
cmp r8, rax
jb 0x180020d50
test rbx, rbx
je 0x180020dc0
mov rdx, qword [rbp + 0x3a0]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x180020da6
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180021477
mov rcx, rbx
call fcn.180037bf4
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x390], xmm0
mov qword [rbp + 0x3a0], r12
mov r9, qword [rbp + 0x378]
test r9, r9
je 0x180020e0c
mov rcx, qword [rbp + 0x388]
sub rcx, r9
movabs rax, 0x20c49ba5e353f7cf
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
lea r8, [rax + rdx]
mov rdx, r9
call fcn.180022e30
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x378], xmm0
mov qword [rbp + 0x388], r12
mov rbx, qword [rbp + 0x350]
test rbx, rbx
je 0x180020e64
mov rdi, qword [rbp + 0x358]
cmp rbx, rdi
je 0x180020e3c
mov rcx, rbx
call fcn.180013c30
sub rbx, 0xffffffffffffff80
cmp rbx, rdi
jne 0x180020e24
mov rbx, qword [rbp + 0x350]
mov r8, qword [rbp + 0x360]
sub r8, rbx
sar r8, 7
mov rdx, rbx
call fcn.180022f40
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x350], xmm0
mov qword [rbp + 0x360], r12
lea rcx, [rbp + 0x3b0]
call fcn.180008c70
nop
mov rcx, qword [rbp + 0x368]
test rcx, rcx
je 0x180020e8a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x368], r12
mov word [rbp + 0x370], 0
lea rcx, [rbp + 0x3c0]
call fcn.180002148
mov al, 1
jmp 0x1800213e7
test rbx, rbx
je 0x180020ef4
mov rdx, qword [rbp + 0x3a0]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x180020eda
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002147d
mov rcx, rbx
call fcn.180037bf4
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x390], xmm0
mov qword [rbp + 0x3a0], r12
mov r9, qword [rbp + 0x378]
test r9, r9
je 0x180020f40
mov rcx, qword [rbp + 0x388]
sub rcx, r9
movabs rax, 0x20c49ba5e353f7cf
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
lea r8, [rax + rdx]
mov rdx, r9
call fcn.180022e30
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x378], xmm0
mov qword [rbp + 0x388], r12
mov rbx, qword [rbp + 0x350]
test rbx, rbx
je 0x180020f98
mov rdi, qword [rbp + 0x358]
cmp rbx, rdi
je 0x180020f70
mov rcx, rbx
call fcn.180013c30
sub rbx, 0xffffffffffffff80
cmp rbx, rdi
jne 0x180020f58
mov rbx, qword [rbp + 0x350]
mov r8, qword [rbp + 0x360]
sub r8, rbx
sar r8, 7
mov rdx, rbx
call fcn.180022f40
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x350], xmm0
mov qword [rbp + 0x360], r12
lea rcx, [rbp + 0x3b0]
call fcn.180008c70
nop
mov rcx, qword [rbp + 0x368]
test rcx, rcx
je 0x180020fbe
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x368], r12
mov word [rbp + 0x370], 0
lea rcx, [rbp + 0x3c0]
call fcn.180002148
jmp 0x1800213e5
test rbx, rbx
je 0x180021026
mov rdx, qword [rbp + 0x3a0]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x18002100c
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180021483
mov rcx, rbx
call fcn.180037bf4
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x390], xmm0
mov qword [rbp + 0x3a0], r12
mov r8, qword [rbp + 0x378]
test r8, r8
je 0x18002109d
mov rcx, qword [rbp + 0x388]
sub rcx, r8
movabs rax, 0x20c49ba5e353f7cf
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x3e8
mov rax, r8
cmp rdx, 0x1000
jb 0x180021083
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180021489
mov rcx, r8
call fcn.180037bf4
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x378], xmm0
mov qword [rbp + 0x388], r12
mov rbx, qword [rbp + 0x350]
test rbx, rbx
je 0x180020f98
mov rdi, qword [rbp + 0x358]
cmp rbx, rdi
je 0x180020f70
nop dword [rax]
mov rcx, rbx
call fcn.180013c30
sub rbx, 0xffffffffffffff80
cmp rbx, rdi
jne 0x1800210c0
jmp 0x180020f69
mov r9, qword [rbp + 0x3a0]
mov r8, qword [rbp + 0x390]
test r8, r8
je 0x18002112e
sub r9, r8
mov rax, r8
cmp r9, 0x1000
jb 0x180021111
add r9, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002148f
mov rdx, r9
mov rcx, r8
call fcn.180037bf4
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x390], xmm0
mov qword [rbp + 0x3a0], rbx
mov r8, qword [rbp + 0x378]
test r8, r8
je 0x18002119e
mov rcx, qword [rbp + 0x388]
sub rcx, r8
mov rax, rdi
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x3e8
mov rax, r8
cmp rdx, 0x1000
jb 0x180021184
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180021495
mov rcx, r8
call fcn.180037bf4
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x378], xmm0
mov qword [rbp + 0x388], rbx
mov rbx, qword [rbp + 0x350]
test rbx, rbx
je 0x180021220
mov rdi, qword [rbp + 0x358]
cmp rbx, rdi
je 0x1800211ce
mov rcx, rbx
call fcn.180013c30
sub rbx, 0xffffffffffffff80
cmp rbx, rdi
jne 0x1800211b6
mov rbx, qword [rbp + 0x350]
mov rdx, qword [rbp + 0x360]
sub rdx, rbx
and rdx, 0xffffffffffffff80
mov rax, rbx
cmp rdx, 0x1000
jb 0x180021201
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002149b
mov rcx, rbx
call fcn.180037bf4
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x350], xmm0
xor r14d, r14d
mov qword [rbp + 0x360], r14
jmp 0x180021223
xor r14d, r14d
cmp byte [rsp + 0x40], 0
je 0x180021243
mov rcx, qword [rbp + 0x368]
test rcx, rcx
je 0x18002123c
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbp + 0x370], 0
mov qword [rbp + 0x3b0], r14
mov rcx, qword [rbp + 0x368]
test rcx, rcx
je 0x180021263
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x368], r14
mov word [rbp + 0x370], 0
mov rdx, qword [rbp + 0x3d8]
cmp rdx, 8
jb 0x1800213cd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x3c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800213c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180021423
jmp 0x1800213c8
movzx esi, byte [rsp + 0x40]
mov rbx, qword [rbp + 0x350]
test rbx, rbx
je 0x180021341
mov rdi, qword [rbp + 0x358]
cmp rbx, rdi
je 0x1800212ef
mov rcx, rbx
call fcn.180013c30
sub rbx, 0xffffffffffffff80
cmp rbx, rdi
jne 0x1800212d7
mov rbx, qword [rbp + 0x350]
mov rdx, qword [rbp + 0x360]
sub rdx, rbx
and rdx, 0xffffffffffffff80
mov rax, rbx
cmp rdx, 0x1000
jb 0x180021322
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800214a1
mov rcx, rbx
call fcn.180037bf4
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x350], xmm0
xor r14d, r14d
mov qword [rbp + 0x360], r14
jmp 0x180021344
xor r14d, r14d
test sil, sil
je 0x180021362
mov rcx, qword [rbp + 0x368]
test rcx, rcx
je 0x18002135b
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbp + 0x370], 0
mov qword [rbp + 0x3b0], r14
mov rcx, qword [rbp + 0x368]
test rcx, rcx
je 0x180021382
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x368], r14
mov word [rbp + 0x370], 0
mov rdx, qword [rbp + 0x3d8]
cmp rdx, 8
jb 0x1800213cd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x3c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800213c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180021411
call fcn.180037bf4
movdqa xmm0, xmmword [0x180079900]
mov word [rbp + 0x3c0], r14w
movdqu xmmword [rbp + 0x3d0], xmm0
xor al, al
mov rcx, qword [rbp + 0x500]
xor rcx, rsp
call fcn.180037bd0
mov rbx, qword [rsp + 0x650]
add rsp, 0x610
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180042f24
int3
call fcn.180042f24
int3
call fcn.180042f24
int3
call fcn.180042f24
nop
call fcn.18000e430
nop
call fcn.180042f24
nop
call fcn.180042f24
nop
call fcn.180042f24
nop
call fcn.180042f24
nop
call fcn.180042f24
nop
call fcn.180042f24
int3
call fcn.180042f24
nop
call fcn.180042f24
nop
call fcn.180042f24
nop
call fcn.180042f24
nop
call fcn.180042f24
nop
call fcn.180042f24
nop
call fcn.180042f24
int3
call fcn.180042f24
int3
call fcn.180042f24
nop
call fcn.180042f24
nop
call fcn.180042f24
nop
call fcn.180042f24
nop
call fcn.180042f24
int3
call fcn.180042f24
int3