Function at 0x180059ce0
Capabilities:
Check for software breakpoints
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x940]
sub rsp, 0xa40
mov rax, qword [0x180087e88]
xor rax, rsp
mov qword [rbp + 0x930], rax
mov r13, r8
mov r15, rdx
mov edi, ecx
mov dword [rsp + 0x68], ecx
movdqa xmm0, xmmword [0x180080b80]
movdqa xmmword [rbp + 0x240], xmm0
mov byte [rbp + 0x230], 0
movdqa xmm1, xmm0
movdqa xmmword [rbp + 0x260], xmm0
mov byte [rbp + 0x250], 0
movdqa xmmword [rbp + 0x280], xmm0
mov byte [rbp + 0x270], 0
xor ecx, ecx
mov ebx, ecx
movdqa xmmword [rbp + 0x190], xmm0
mov byte [rbp + 0x180], cl
movdqa xmmword [rbp + 0x1b0], xmm0
mov byte [rbp + 0x1a0], cl
movdqa xmmword [rbp + 0x1d0], xmm0
mov byte [rbp + 0x1c0], cl
movdqa xmmword [rbp + 0x200], xmm0
mov byte [rbp + 0x1f0], cl
movdqa xmmword [rbp + 0x220], xmm0
mov byte [rbp + 0x210], cl
mov qword [rbp + 0x20], rcx
mov word [rbp + 0x28], cx
movdqu xmmword [rbp + 0x3a], xmm0
mov byte [rbp + 0x2a], cl
mov qword [rbp - 0x10], rcx
mov word [rbp - 8], cx
movdqu xmmword [rbp + 0xa], xmm0
mov byte [rbp - 6], cl
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rcx
mov qword [rbp - 0x68], rcx
movdqa xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x40], rcx
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x58], rcx
mov qword [rbp + 0x60], rcx
lea ecx, [rbx + 0x30]
call fcn.1800791f8
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x58], rax
xor r10d, r10d
mov qword [rbp + 0x68], r10
xorps xmm2, xmm2
movsd qword [rbp + 0x70], xmm2
mov qword [rbp + 0x78], r10
mov edx, 1
mov dword [rbp + 0x80], edx
mov qword [rbp + 0x88], r10
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xa0], xmm1
movdqa xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], r10
mov qword [rbp + 0xc8], 0xffffffffffffffff
mov dword [rbp + 0xd0], r10d
xor eax, eax
movups xmmword [rbp + 0xd8], xmm0
movups xmmword [rbp + 0xe8], xmm0
movups xmmword [rbp + 0xf8], xmm0
movups xmmword [rbp + 0x108], xmm0
mov qword [rbp + 0x118], rax
movdqa xmm0, xmmword [0x180080b80]
movdqa xmmword [rbp + 0x130], xmm0
mov byte [rbp + 0x120], al
mov word [rbp + 0x140], r10w
mov dword [rbp + 0x144], r10d
mov qword [rbp + 0x148], r10
xorps xmm0, xmm0
movaps xmmword [rbp + 0x150], xmm0
movsd qword [rbp + 0x160], xmm2
mov byte [rbp + 0x168], al
mov qword [rbp + 0x16c], r10
mov r14d, edi
imul eax, edi, 0xb64
mov dword [rsp + 0x78], eax
cmp edi, eax
ja 0x18005a0cf
mov edx, 0x752e
movzx r12d, byte [rsp + 0x50]
nop word [rax + rax]
cmp r14d, 0x1506d
ja 0x18005a1b9
je 0x18005a181
cmp r14d, 0x7eb5
ja 0x18005a05c
je 0x18005a03f
mov eax, r14d
sub eax, 0x8b
je 0x180059fe7
sub eax, 0x3c
je 0x180059fdb
sub eax, 0x42
je 0x180059fbd
cmp eax, 0x5778
jne 0x18005a0b6
xor r12b, r12b
cmp rbx, qword [r13 + 0x20]
je 0x18005a0b6
mov edi, 0xce
nop
mov eax, edi
sub eax, 0xcd
je 0x180059f74
cmp eax, 1
jne 0x180059fa2
movzx r12d, al
jmp 0x180059fa2
cmp r15, rbx
je 0x180059f92
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x180059f86
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, r15
call fcn.180063650
movzx eax, word [rbx + 0x20]
mov word [r15 + 0x20], ax
mov eax, dword [rbx + 0x24]
mov dword [r15 + 0x24], eax
dec edi
cmp edi, 0xcc
ja 0x180059f60
mov edi, dword [rsp + 0x68]
mov edx, 0x752e
xor r10d, r10d
jmp 0x18005a0b6
mov qword [rsp + 0x60], r13
cmp qword [r13 + 0x1a], 0
jne 0x18005a0b6
mov byte [rsp + 0x6c], 0
mov esi, dword [rsp + 0x6c]
jmp 0x18005ac36
mov byte [rbp + 0x2a0], 0x70
jmp 0x18005a0b6
mov edx, 0xffffffff
mov rcx, qword [r13 + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rsi, qword [r13 + 0x20]
mov rdi, qword [r13 + 0x18]
mov rbx, rdi
cmp rdi, rsi
je 0x18005a031
add rdi, 0x28
cmp rdi, rsi
je 0x18005a031
nop
mov r9, rbx
xor r8d, r8d
mov rdx, rdi
lea ecx, [r8 + 0x5d]
call fcn.180064690
test al, al
cmovne rbx, rdi
add rdi, 0x28
cmp rdi, rsi
jne 0x18005a010
mov edi, dword [rsp + 0x68]
mov edx, 0x752e
xor r10d, r10d
jmp 0x18005a0b6
movzx eax, word [0x18008060e]
mov word [rbp + 0x2a1], ax
movzx eax, byte [0x180080610]
mov byte [rbp + 0x2a3], al
jmp 0x18005a0b6
cmp r14d, 0xa8bb
je 0x18005a159
cmp r14d, 0xb077
je 0x18005a142
cmp r14d, 0xfca3
je 0x18005a136
cmp r14d, 0x1086d
jne 0x18005a0b6
mov ecx, PathYetAnotherMakeUniqueName
mov eax, ecx
sub eax, 0x47
je 0x18005a0a3
cmp eax, 1
je 0x180059fd2
jmp 0x18005a0a8
mov byte [rsp + 0x6c], r12b
inc ecx
cmp ecx, 0x49
jb 0x18005a091
mov word [rbp + 0x2af], dx
imul eax, edi, 0xa2
add r14d, eax
cmp r14d, dword [rsp + 0x78]
jbe 0x180059f00
mov edx, 1
mov dword [rsp + 0x50], edi
lea eax, [rdi - 0x13]
mov dword [rsp + 0x58], eax
lea r9, [0x180000000]
cmp edi, eax
jbe 0x18005a819
lea ebx, [rdi - 0xb5]
mov dword [rsp + 0x78], ebx
lea r8, [0x180087d98]
mov r15d, dword [rsp + 0x60]
mov esi, dword [rsp + 0x60]
movzx edi, byte [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov r13d, dword [rsp + 0x60]
mov r14d, dword [rsp + 0x60]
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x58]
nop
cmp ebx, 0x12
ja case.default.0x18005a134
mov ecx, dword [r9 + rbx*4 + 0x5aebc]
add rcx, r9
jmp rcx
mov byte [rbp + 0x2a4], 0
jmp 0x18005a0b6
mov rcx, qword [r13 + 0x40]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, 0x752e
xor r10d, r10d
jmp 0x18005a0b6
mov rcx, qword [rsp + 0x60]
add rcx, 0xa
mov r8d, 0x82
lea rdx, [rbp + 0x230]
call fcn.1800497c0
mov edx, 0x752e
xor r10d, r10d
jmp 0x18005a0b6
mov rax, qword [rsp + 0x60]
movzx eax, word [rax + 8]
mov word [rsp + 0x50], ax
lea r9, [rbp + 0x230]
lea r8, [rsp + 0x50]
mov edx, 0x95
mov rcx, r15
call fcn.180070390
mov byte [rsp + 0x6c], al
mov edx, 0x752e
xor r10d, r10d
jmp 0x18005a0b6
cmp r14d, 0x2f45b
ja 0x18005a25f
je 0x18005a238
mov eax, r14d
sub eax, 0x17a91
je 0x18005a211
sub eax, 0x7d8e
je 0x180059fd2
sub eax, 0x60
je 0x18005a203
cmp eax, 0x7dee
jne 0x18005a0b6
mov dword [rbp + 0x2a8], 0x6b2e6563
mov byte [rbp + 0x2ac], 0
jmp 0x18005a0b6
mov word [rbp + 0x2a7], 0x69
jmp 0x18005a0b6
movzx eax, word [0x180080650]
mov word [rbp + 0x2a4], ax
movzx eax, byte [0x180080652]
mov byte [rbp + 0x2a6], al
mov byte [rbp + 0x2a7], 0
jmp 0x18005a0b6
movzx eax, word [0x18008067b]
mov word [rbp + 0x2ac], ax
movzx eax, byte [0x18008067d]
mov byte [rbp + 0x2ae], al
mov byte [rbp + 0x2af], 0
jmp 0x18005a0b6
cmp r14d, 0x37249
je 0x18005a0af
cmp r14d, 0x3f037
je 0x18005a296
cmp r14d, 0x46e25
jne 0x18005a0b6
mov byte [rbp + 0x2b2], 0
mov word [rbp + 0x300], r10w
jmp 0x18005a0b6
mov byte [rbp + 0x2b1], 0x61
jmp 0x18005a0b6
mov r8, rdx
lea rdx, [0x1800806b4]
lea rcx, [rbp + 0x510]
jmp 0x18005a7d2
mov r8d, 4
lea rdx, [0x1800806b8]
lea rcx, [rbp + 0x510]
jmp 0x18005a7d2
mov r8d, 4
lea rdx, [0x1800806c8]
lea rcx, [rbp + 0x52e]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov dword [rbp + 0x534], 0x65
jmp 0x18005a7d8
mov r8, rdx
lea rdx, [0x1800806d0]
lea rcx, [rbp + 0x1a0]
call fcn.180063650
jmp 0x18005a7d8
mov dword [rbp + 0x332], 0x73
mov eax, dword [0x1800806d4]
mov dword [rbp + 0x510], eax
movzx eax, word [0x1800806d8]
mov word [rbp + 0x514], ax
jmp case.0x18005a134.1
lea rax, [rbp + 0x2a0]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18005a350
lea rdx, [rbp + 0x2a0]
lea rcx, [rbp + 0x180]
call fcn.180063650
jmp 0x18005a7d8
lea rcx, [rbp + 0x510]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18005a380
movsd xmm0, qword [str.ile_p]
movsd qword [rcx], xmm0
mov eax, dword [0x1800806e8]
mov dword [rcx + 8], eax
jmp case.0x18005a134.1
mov dword [rbp + 0x328], 0x68
jmp case.0x18005a134.1
mov dword [rbp + 0x544], 0x40
mov r8d, 0xa
lea rdx, [rbp + 0x546]
lea ecx, [r8 - 2]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultow]
jmp 0x18005a7d8
movsd xmm0, qword [str.ut_get]
movsd qword [rbp + 0x538], xmm0
mov eax, dword [0x1800806f8]
mov dword [rbp + 0x540], eax
movzx eax, word [0x1800806fc]
mov word [rbp + 0x544], ax
jmp case.0x18005a134.1
movsd xmm0, qword [str.util]
movsd qword [rbp + 0x30c], xmm0
mov eax, dword [0x18008070c]
mov dword [rbp + 0x314], eax
movzx eax, word [0x180080710]
mov word [rbp + 0x318], ax
jmp case.0x18005a134.1
mov dword [rbp + 0x330], 0x64
jmp case.0x18005a134.1
mov qword [rsp + 0x38], r10
mov dword [rsp + 0x30], ILRemoveLastID
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r10
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18004f9e0
test al, al
jne 0x18005a6d9
xor r10d, r10d
mov ebx, r10d
nop word [rax + rax]
cmp ebx, 0x15
ja case.default.0x18005a49c
mov eax, ebx
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0x5af08]
add rcx, rdx
jmp rcx
mov r15d, 1
jmp case.default.0x18005a49c
mov eax, dword [0x180080714]
mov dword [rbp + 0x2c4], eax
movzx eax, word [0x180080718]
mov word [rbp + 0x2c8], ax
jmp case.default.0x18005a49c
mov dword [rbp + 0x2b8], 0x69
mov dword [rbp + 0x2ba], 0x6e
jmp case.default.0x18005a49c
mov dword [rbp + 0x2be], 0x65
mov eax, dword [0x18008071c]
mov dword [rbp + 0x2c0], eax
movzx eax, word [0x180080720]
mov word [rbp + 0x2c4], ax
jmp case.default.0x18005a49c
mov ecx, r10d
movzx eax, dil
test esi, esi
cmovne ecx, eax
movzx edi, cl
jmp case.default.0x18005a49c
mov r12, r10
jmp case.default.0x18005a49c
mov dword [rbp + 0x2e0], 0x6c
movsd xmm0, qword [str.eReq]
movsd qword [rbp + 0x2e2], xmm0
movzx eax, word [0x180080730]
mov word [rbp + 0x2ea], ax
jmp case.default.0x18005a49c
mov dword [rbp + 0x2d8], 0x4d
mov dword [rbp + 0x2da], 0x6f
jmp case.default.0x18005a49c
mov dil, 1
jmp case.default.0x18005a49c
mov r13d, 1
jmp case.default.0x18005a49c
mov r14d, 0x104
mov dword [rsp + 0x70], r10d
jmp case.default.0x18005a49c
test dil, dil
je case.default.0x18005a49c
mov ecx, esi
call qword [sym.imp.SHELL32.dll_SHChangeNotifyDeregister]
jmp 0x18005a6be
mov dword [rsp + 0x60], 0x2381f
jmp case.default.0x18005a49c
xor eax, eax
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x28], eax
jmp case.default.0x18005a49c
mov qword [rsp + 0x20], r10
xor r9d, r9d
lea r8, [rbp + 0x2b8]
mov edx, r14d
lea rcx, [rbp + 0x720]
call qword [sym.imp.SHELL32.dll_PathMakeUniqueName]
jmp 0x18005a6be
mov dword [rbp + 0x2dc], 0x64
mov r8d, 2
lea rdx, [0x180080734]
lea rcx, [rbp + 0x2de]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp 0x18005a6be
lea rax, [rbp + 0x2b8]
sub rax, 2
nop dword [rax + rax]
lea rax, [rax + 2]
cmp word [rax], 0
jne 0x18005a620
movsd xmm0, qword [0x180080738]
movsd qword [rax], xmm0
mov dword [rbp + 0x2f0], 0x74
jmp case.default.0x18005a49c
mov dword [rbp + 0x2d0], 0x64
movabs rax, 0x2f00720065
mov qword [rbp + 0x2d2], rax
jmp case.default.0x18005a49c
mov r8d, 2
lea rdx, [0x180080740]
lea rcx, [rbp + 0x2c8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
movabs rax, 0x61006f006c
mov qword [rbp + 0x2ca], rax
jmp 0x18005a6be
mov dword [rbp + 0x2bc], 0x74
jmp case.default.0x18005a49c
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
mov r9d, dword [rsp + 0x70]
mov r8d, dword [rsp + 0x60]
mov edx, r15d
mov rcx, r12
call qword [sym.imp.SHELL32.dll_SHChangeNotifyRegister]
mov esi, eax
xor r10d, r10d
inc ebx
lea ecx, [rbx + 0x10d]
cmp ecx, 0x123
jb 0x18005a480
mov ebx, dword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
jmp 0x18005a7d8
lea rcx, [rbp + 0x300]
sub rcx, 2
nop word [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18005a700
mov eax, dword [0x180080744]
mov dword [rcx], eax
movzx eax, word [0x180080748]
mov word [rcx + 4], ax
jmp case.0x18005a134.1
mov r8, rdx
lea rdx, [0x18008074c]
lea rcx, [rbp + 0x300]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov eax, dword [0x180080750]
mov dword [rbp + 0x32c], eax
movzx eax, word [0x180080754]
mov word [rbp + 0x330], ax
jmp 0x18005a7d8
lea rax, [rbp + 0x510]
sub rax, 2
lea rax, [rax + 2]
cmp word [rax], 0
jne 0x18005a763
movsd xmm0, qword [0x180080758]
movsd qword [rax], xmm0
mov r8, rdx
lea rdx, [0x18007c198]
lea rcx, [rbp + 0x510]
jmp 0x18005a7d2
mov eax, dword [0x180080760]
mov dword [rbp + 0x304], eax
mov eax, dword [0x180080768]
mov dword [rbp + 0x308], eax
movzx eax, word [0x18008076c]
mov word [rbp + 0x30c], ax
jmp case.0x18005a134.1
mov dword [rbp + 0x318], 0x69
mov r8d, 7
lea rdx, str.t_per_t
lea rcx, [rbp + 0x300]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
lea r9, [0x180000000]
lea r8, [0x180087d98]
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x58]
dec eax
mov dword [rsp + 0x50], eax
dec ebx
mov dword [rsp + 0x78], ebx
cmp eax, ecx
jbe 0x18005a815
mov edx, 1
xor r10d, r10d
jmp 0x18005a120
mov esi, 1
jmp 0x18005ac36
mov edi, dword [rsp + 0x68]
lea r14d, [rdi + 0xa32]
mov ebx, dword [rsp + 0x6c]
cmp edi, r14d
jae case.0x18005ab2e.7
mov eax, 0x1bb
lea rcx, [0x18004bda0]
mov rsi, qword [rsp + 0x60]
mov r15, qword [rsp + 0x60]
mov r12d, dword [rsp + 0x60]
mov r13, qword [rsp + 0x60]
nop dword [rax]
cmp edi, 0x5e0
ja 0x18005aa7d
je 0x18005aa55
cmp edi, 0x30b
ja 0x18005a954
je 0x18005a926
cmp edi, 0xc7
je 0x18005a91a
cmp edi, 0x158
je 0x18005a8e8
cmp edi, 0x1e9
jne 0x18005ac19
mov qword [rsp + 0x28], 0
lea rax, [rbp + 0x1f0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x37]
lea rcx, [rbp + 0x180]
call fcn.180059310
mov eax, 0x1bb
mov word [rsp + 0x50], ax
lea r9, [0x180087df8]
lea r8, [rbp + 0x20]
lea rdx, [rsp + 0x50]
mov ecx, 0x103
call fcn.180077bd0
jmp 0x18005ac0d
xor ecx, ecx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 0x107
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call fcn.18004f9e0
jmp 0x18005ac0d
mov word [rbp + 0x1e0], ax
jmp 0x18005ac19
mov word [rsp + 0x50], ax
mov qword [rsp + 0x20], 0
lea r9, [rbp - 0x10]
mov r8d, 0xa8
lea rdx, [0x180087e18]
lea rcx, [rsp + 0x50]
call fcn.18006e1b0
jmp 0x18005ac0d
cmp edi, 0x39c
je 0x18005aa03
cmp edi, 0x42d
je 0x18005a9c8
cmp edi, 0x4be
je 0x18005a9a4
cmp edi, 0x54f
jne 0x18005ac19
lea rax, [rbp - 0x80]
mov qword [rbp - 0x30], rax
mov eax, dword [0x180087e40]
mov dword [rbp - 0x28], eax
mov eax, dword [0x180087e44]
mov dword [rbp - 0x24], eax
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x20], xmm0
jmp 0x18005ac14
mov eax, dword [0x180087e40]
mov dword [rsp + 0x60], eax
lea r9, [rbp - 0x80]
lea r8, [rsp + 0x60]
xor edx, edx
mov ecx, 0xc0
call fcn.1800619e0
jmp 0x18005ac0d
lea rax, [rbp - 0x10]
mov qword [rsp + 0x60], rax
mov rax, qword [rbp - 0x78]
cmp rax, qword [rbp - 0x70]
je 0x18005a9ec
lea rcx, [rbp - 0x10]
mov qword [rax], rcx
add qword [rbp - 0x78], 8
jmp 0x18005ac0d
lea r8, [rsp + 0x60]
mov rdx, qword [rbp - 0x78]
lea rcx, [rbp - 0x80]
call fcn.180043fa0
jmp 0x18005ac0d
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8d, [r9 + 0x4d]
lea rdx, [rbp - 0x80]
xor ecx, ecx
call fcn.180054d70
lea rax, [rbp + 0x20]
mov qword [rsp + 0x60], rax
mov rdx, qword [rbp - 0x78]
cmp rdx, qword [rbp - 0x70]
je 0x18005aa42
lea rax, [rbp + 0x20]
mov qword [rdx], rax
add qword [rbp - 0x78], 8
jmp 0x18005ac0d
lea r8, [rsp + 0x60]
lea rcx, [rbp - 0x80]
call fcn.180043fa0
jmp 0x18005ac0d
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
lea r9, [rbp - 0x20]
lea r8, [0x180057730]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
jmp 0x18005ac0d
cmp edi, 0x8b5
ja 0x18005abde
je 0x18005abad
cmp edi, 0x671
je 0x18005aafc
cmp edi, 0x702
je 0x18005aaee
cmp edi, 0x793
je 0x18005aad1
cmp edi, 0x824
jne 0x18005ac19
lea r9, [0x180087d90]
lea r8, [rbp + 0x50]
mov edx, 0x50
lea rcx, [rbp - 0x80]
call fcn.1800579a0
jmp 0x18005ac0d
mov qword [rsp + 0x60], rcx
xor r9d, r9d
lea r8, [rsp + 0x60]
lea edx, [r9 + 0xb]
xor ecx, ecx
call fcn.1800482b0
jmp 0x18005ac0d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18005ac0d
test rsi, rsi
jne 0x18005ac19
xor r10d, r10d
mov edi, r10d
nop dword [rax + rax]
cmp edi, 0xf0
ja case.0x18005ab2e.1
mov eax, edi
movzx eax, byte [r9 + rax + 0x5af84]
mov ecx, dword [r9 + rax*4 + 0x5af60]
add rcx, r9
jmp rcx
mov r15, r10
jmp case.0x18005ab2e.1
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r10
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8d, dword [rsp + 0x70]
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_CDefFolderMenu_Create2]
test eax, eax
jne 0x18005ab75
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + ILRemoveLastID]
xor r10d, r10d
add edi, 0x18
lea eax, [rdi + 0xde]
cmp eax, 0x1e6
lea r9, [0x180000000]
jb 0x18005ab10
mov edi, dword [rsp + 0x68]
jmp 0x18005ac0d
mov dword [rsp + 0x70], r10d
jmp case.0x18005ab2e.1
mov r13, r10
jmp case.0x18005ab2e.1
mov ebx, 1
jmp case.0x18005ab2e.1
mov r12d, r10d
jmp case.0x18005ab2e.1
lea rax, [rbp + 0x50]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
lea r8d, [rax + 0xa]
call fcn.180077f30
jmp 0x18005ac0d
cmp edi, 0x946
je 0x18005ac19
cmp edi, 0x9d7
je 0x18005abfa
cmp edi, 0xa68
jne 0x18005ac19
xor esi, esi
jmp 0x18005ac36
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x4000000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
lea rcx, [0x18004bda0]
mov eax, 0x1bb
add edi, 0x91
mov dword [rsp + 0x68], edi
cmp edi, r14d
jae case.0x18005ab2e.7
lea r9, [0x180000000]
jmp 0x18005a850
mov esi, ebx
lea rcx, [rbp + 0xc8]
call fcn.180045f10
mov rbx, qword [rbp + 0xb0]
test rbx, rbx
je 0x18005accd
mov rdi, qword [rbp + 0xb8]
cmp rbx, rdi
je 0x18005ac78
nop word [rax + rax]
mov rcx, rbx
call fcn.180060ea0
add rbx, 0x20
cmp rbx, rdi
jne 0x18005ac60
mov rbx, qword [rbp + 0xb0]
mov rdx, qword [rbp + 0xc0]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x18005acae
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18005acae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.180079234
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xb0], xmm0
xor r14d, r14d
mov qword [rbp + 0xc0], r14
jmp 0x18005acd0
xor r14d, r14d
mov rdx, qword [rbp + 0x98]
test rdx, rdx
je 0x18005ad08
mov r8, qword [rbp + 0xa8]
sub r8, rdx
sar r8, 4
lea rcx, [rbp + 0x98]
call fcn.1800649f0
mov qword [rbp + 0x98], r14
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xa0], xmm0
lea rcx, [rbp + 0x58]
call fcn.180045e40
nop
mov rbx, qword [rbp - 0x68]
test rbx, rbx
je 0x18005ada3
mov rdi, qword [rbp - 0x60]
cmp rbx, rdi
je 0x18005ad3d
mov rcx, rbx
call fcn.180045750
add rbx, 0x28
cmp rbx, rdi
jne 0x18005ad28
mov rbx, qword [rbp - 0x68]
mov rcx, qword [rbp - 0x58]
sub rcx, rbx
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rax, rbx
cmp rdx, 0x1000
jb 0x18005ad8f
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18005ad8f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.180079234
mov qword [rbp - 0x68], r14
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x60], xmm0
mov rdx, qword [rbp - 0x80]
test rdx, rdx
je 0x18005adcc
mov r8, qword [rbp - 0x70]
sub r8, rdx
sar r8, 3
lea rcx, [rbp - 0x80]
call fcn.1800649a0
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r14
mov rdx, qword [rbp + 0x12]
cmp rdx, 0x10
jb 0x18005ae0a
inc rdx
mov rcx, qword [rbp - 6]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005ae05
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18005ae05
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180079234
movdqa xmm0, xmmword [0x180080b80]
movdqu xmmword [rbp + 0xa], xmm0
mov byte [rbp - 6], 0
mov rdx, qword [rbp + 0x42]
cmp rdx, 0x10
jb 0x18005ae59
inc rdx
mov rcx, qword [rbp + 0x2a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005ae54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18005ae54
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180079234
movdqa xmm0, xmmword [0x180080b80]
movdqu xmmword [rbp + 0x3a], xmm0
mov byte [rbp + 0x2a], 0
lea rcx, [rbp + 0x1f0]
call fcn.180045ab0
nop
lea rcx, [rbp + 0x180]
call fcn.180045b60
nop
lea rcx, [rbp + 0x230]
call fcn.180045b60
mov eax, esi
mov rcx, qword [rbp + 0x930]
xor rcx, rsp
call fcn.180079740
mov rbx, qword [rsp + 0xa80]
add rsp, 0xa40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret