Function at 0x180014cf0
Capabilities:
Access peb ldr_data
Create thread
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x6c8]
sub rsp, 0x788
movaps xmmword [rax - 0x58], xmm6
movaps xmmword [rax - 0x68], xmm7
movaps xmmword [rax - 0x78], xmm8
movaps xmmword [rax - 0x88], xmm9
movaps xmmword [rax - 0x98], xmm10
movaps xmmword [rax - 0xa8], xmm11
movaps xmmword [rax - 0xb8], xmm12
movaps xmmword [rax - 0xc8], xmm13
movaps xmmword [rax - 0xd8], xmm14
movaps xmmword [rax - 0xe8], xmm15
xor r12d, r12d
mov rax, qword [0x180148c00]
add rax, 0x1f90
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm12, xmm12
mov qword [rsp + 0x50], r12
xor ecx, ecx
mov dword [rsp + 0x58], ecx
mov dword [rbp + 0x19], r12d
mov word [rbp + 0x1d], r12w
mov byte [rbp + 0x1f], cl
mov dword [rbp - 8], 0xd2e3a2a9
mov qword [rbp], rax
lea rax, [rsp + 0x40]
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], 0x1c
mov eax, dword [0x180148a98]
mov dword [rbp - 4], eax
mov byte [rbp + 0x18], cl
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, 0x28
lea r8, [rbp - 8]
mov edx, 0x936793c4
mov rcx, qword [0x180148a90]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
movss xmm0, dword [rsp + 0x40]
movss dword [0x180148cd0], xmm0
movss xmm1, dword [rsp + 0x44]
movss dword [0x180148cd4], xmm1
movss xmm0, dword [rsp + 0x48]
movss dword [0x180148cd8], xmm0
movss xmm1, dword [rsp + 0x4c]
movss dword [0x180148c40], xmm1
movss xmm0, dword [rsp + 0x50]
movss dword [0x180148c44], xmm0
movss xmm1, dword [rsp + 0x54]
movss dword [0x180148c48], xmm1
movss xmm0, dword [rsp + 0x58]
movss dword [0x180148bcc], xmm0
movzx eax, byte [0x18011747a]
neg al
sbb edx, edx
and edx, 0x11
mov rcx, qword [0x180148cb8]
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
mov esi, 0x539
mov dword [rbp + 0x6e8], esi
movss xmm0, dword [0x1800e278c]
movss dword [rbp + 0x40], xmm0
movss dword [rsp + 0x78], xmm0
mov dword [rbp + 0x6e0], r12d
mov rcx, qword [0x180148cf8]
mov r8, qword [0x180148cf0]
sub rcx, r8
movabs rax, 0xe38e38e38e38e39
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
movss xmm14, dword [0x1800e2574]
movss xmm6, dword [0x1800e264c]
add rdx, rax
je 0x180016e3a
mov r13d, dword [0x180148a30]
mov qword [rbp - 0x80], r13
mov r9d, r12d
mov qword [rbp + 0x1a0], r12
movss xmm6, dword [0x1800e2774]
movss xmm10, dword [0x1800e2538]
movss xmm9, dword [0x1800e2688]
lea rax, [r9 + r9*8]
movups xmm15, xmmword [r8 + rax*8]
movups xmm11, xmmword [r8 + rax*8 + 0x10]
movups xmm7, xmmword [r8 + rax*8 + 0x20]
movups xmmword [rsp + 0x40], xmm7
movups xmm14, xmmword [r8 + rax*8 + 0x30]
movsd xmm8, qword [r8 + rax*8 + 0x40]
movsd qword [rbp + 0x198], xmm8
mov dword [rbp - 0x20], 0
mov dword [rbp + 0x311], r12d
mov word [rbp + 0x315], r12w
mov byte [rbp + 0x317], 0
mov dword [rbp + 0x2f0], 0xd2e3a2a9
movq rax, xmm14
add rax, 0x1b0
mov qword [rbp + 0x2f8], rax
lea rax, [rbp - 0x20]
mov qword [rbp + 0x300], rax
mov qword [rbp + 0x308], 4
mov eax, dword [0x180148a98]
mov dword [rbp + 0x2f4], eax
mov byte [rbp + 0x310], 0
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, 0x28
lea r8, [rbp + 0x2f0]
mov edx, 0x936793c4
mov rcx, qword [0x180148a90]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
movss xmm13, dword [rbp - 0x20]
movq r15, xmm11
mov qword [rbp - 0x10], r15
cmp qword [0x180148b40], r15
je 0x180016d87
mov dword [rbp - 0x1c], r12d
mov dword [rbp + 0x339], r12d
mov word [rbp + 0x33d], r12w
mov byte [rbp + 0x33f], 0
mov dword [rbp + 0x318], 0xd2e3a2a9
lea rax, [r15 + 0x38]
mov qword [rbp + 0x320], rax
lea rax, [rbp - 0x1c]
mov qword [rbp + 0x328], rax
mov qword [rbp + 0x330], 4
mov eax, dword [0x180148a98]
mov dword [rbp + 0x31c], eax
mov byte [rbp + 0x338], 0
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, 0x28
lea r8, [rbp + 0x318]
mov edx, 0x936793c4
mov rcx, qword [0x180148a90]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp dword [rbp - 0x1c], 0x11e0101
jne 0x180016d87
mov qword [rbp + 0x6d0], r12
mov dword [rbp - 0x4f], r12d
mov word [rbp - 0x4b], r12w
mov byte [rbp - 0x49], 0
mov dword [rbp - 0x70], 0xd2e3a2a9
lea rax, [r15 + 0x3d8]
mov qword [rbp - 0x68], rax
lea rax, [rbp + 0x6d0]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 8
mov eax, dword [0x180148a98]
mov dword [rbp - 0x6c], eax
mov byte [rbp - 0x50], 0
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, 0x28
lea r8, [rbp - 0x70]
mov edx, 0x936793c4
mov rcx, qword [0x180148a90]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov qword [rbp + 0x6d8], r12
mov dword [rbp + 0x101], r12d
mov word [rbp + 0x105], r12w
mov byte [rbp + 0x107], 0
mov dword [rbp + 0xe0], 0xd2e3a2a9
mov rax, qword [rbp + 0x6d0]
add rax, 0x610
mov qword [rbp + 0xe8], rax
lea rax, [rbp + 0x6d8]
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], 8
mov eax, dword [0x180148a98]
mov dword [rbp + 0xe4], eax
mov byte [rbp + 0x100], 0
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, 0x28
lea r8, [rbp + 0xe0]
mov edx, 0x936793c4
mov rcx, qword [0x180148a90]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rbx, qword [rbp + 0x6d8]
mov dword [rbp + 0x6d0], r12d
mov dword [rbp - 0x4f], r12d
mov word [rbp - 0x4b], r12w
mov byte [rbp - 0x49], 0
mov dword [rbp - 0x70], 0xd2e3a2a9
movdqa xmm0, xmm11
psrldq xmm0, 8
movq rsi, xmm0
lea rax, [rsi + 0x5e0]
mov qword [rbp - 0x68], rax
lea rax, [rbp + 0x6d0]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 4
mov eax, dword [0x180148a98]
mov dword [rbp - 0x6c], eax
mov byte [rbp - 0x50], 0
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, 0x28
lea r8, [rbp - 0x70]
mov edx, 0x936793c4
mov rcx, qword [0x180148a90]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, dword [rbp + 0x6d0]
mov dword [rbp - 0x18], r12d
mov dword [rbp + 0x101], r12d
mov word [rbp + 0x105], r12w
mov byte [rbp + 0x107], 0
mov dword [rbp + 0xe0], 0xd2e3a2a9
lea rax, [rbx + 0xf8]
mov qword [rbp + 0xe8], rax
lea rax, [rbp - 0x18]
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], 4
mov eax, dword [0x180148a98]
mov dword [rbp + 0xe4], eax
mov byte [rbp + 0x100], 0
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, 0x28
lea r8, [rbp + 0xe0]
mov edx, 0x936793c4
mov rcx, qword [0x180148a90]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [0x180148c4c]
cmp dword [rbp - 0x18], eax
jne 0x1800152ae
cmp edi, 0x67
jne 0x180016d98
comiss xmm12, xmm13
jae 0x180016d98
comiss xmm13, xmm6
ja 0x180016d98
lea rcx, [rsi + 0x384]
call fcn.1800182b0
movaps xmm6, xmm0
lea rcx, [rsi + 0x380]
call fcn.1800182b0
addss xmm6, xmm10
comiss xmm6, xmm0
setae r12b
mov byte [rbp + 0x6d8], r12b
movq rcx, xmm15
add rcx, 0x101
add rcx, r15
call fcn.180018340
movzx esi, al
movaps xmmword [rbp - 0x70], xmm15
movaps xmmword [rbp - 0x60], xmm11
movaps xmmword [rbp - 0x50], xmm7
movaps xmmword [rbp - 0x40], xmm14
movsd qword [rbp - 0x30], xmm8
lea r8, [rbp - 0x70]
xor edx, edx
lea rcx, [rbp + 0x108]
call fcn.1800079c0
movaps xmmword [rbp + 0x90], xmm15
movaps xmmword [rbp + 0xa0], xmm11
movaps xmmword [rbp + 0xb0], xmm7
movaps xmmword [rbp + 0xc0], xmm14
movsd qword [rbp + 0xd0], xmm8
lea r8, [rbp + 0x90]
mov edx, 8
lea rcx, [rsp + 0x68]
call fcn.1800079c0
movsd xmm0, qword [rsp + 0x68]
movsd qword [rbp + 0x340], xmm0
mov ebx, dword [rsp + 0x70]
mov dword [rbp + 0x348], ebx
lea rdx, [rbp + 0x340]
lea rcx, [rbp + 0x70]
call fcn.1800074e0
movss xmm7, dword [rsp + 0x70]
addss xmm7, xmm9
movss xmm10, dword [rbp + 0x110]
movaps xmm6, xmm10
subss xmm6, dword [0x1800e2638]
movss xmm9, dword [rbp + 0x108]
movss xmm8, dword [rbp + 0x10c]
movaps xmm0, xmm9
unpcklps xmm0, xmm8
movsd qword [rbp + 0x2e0], xmm0
movss dword [rbp + 0x2e8], xmm10
lea rdx, [rbp + 0x2e0]
lea rcx, [rbp + 0x450]
call fcn.1800074e0
movaps xmm1, xmm10
subss xmm1, dword [0x1800e2688]
movaps xmm0, xmm9
unpcklps xmm0, xmm8
movsd qword [rbp + 0x3e0], xmm0
movss dword [rbp + 0x3e8], xmm1
lea rdx, [rbp + 0x3e0]
lea rcx, [rbp + 0x470]
call fcn.1800074e0
movaps xmm1, xmm10
subss xmm1, dword [0x1800e26e4]
movaps xmm0, xmm9
unpcklps xmm0, xmm8
movsd qword [rbp + 0x3d0], xmm0
movss dword [rbp + 0x3d8], xmm1
lea rdx, [rbp + 0x3d0]
lea rcx, [rbp + 0x260]
call fcn.1800074e0
movss xmm12, dword [rsp + 0x68]
movaps xmm0, xmm12
movss xmm1, dword [rsp + 0x6c]
unpcklps xmm0, xmm1
movsd qword [rbp + 0x3c0], xmm0
movss xmm1, dword [rsp + 0x70]
movss dword [rbp + 0x3c8], xmm1
lea rdx, [rbp + 0x3c0]
lea rcx, [rbp + 0x128]
call fcn.1800074e0
movss xmm1, dword [rsp + 0x70]
addss xmm1, dword [0x1800e26c4]
movaps xmm0, xmm12
movss xmm2, dword [rsp + 0x6c]
unpcklps xmm0, xmm2
movsd qword [rbp + 0x3b0], xmm0
movss dword [rbp + 0x3b8], xmm1
lea rdx, [rbp + 0x3b0]
lea rcx, [rbp + 0x440]
call fcn.1800074e0
movss xmm1, dword [rsp + 0x70]
addss xmm1, dword [0x1800e26e0]
movaps xmm0, xmm12
movss xmm2, dword [rsp + 0x6c]
unpcklps xmm0, xmm2
movsd qword [rbp + 0x3a0], xmm0
movss dword [rbp + 0x3a8], xmm1
lea rdx, [rbp + 0x3a0]
lea rcx, [rbp + 0x2b0]
call fcn.1800074e0
movaps xmm0, xmm12
movss xmm1, dword [rsp + 0x6c]
unpcklps xmm0, xmm1
movsd qword [rbp + 0x390], xmm0
movss dword [rbp + 0x398], xmm7
lea rdx, [rbp + 0x390]
lea rcx, [rbp + 0x3f0]
call fcn.1800074e0
movaps xmm0, xmm9
unpcklps xmm0, xmm8
movsd qword [rbp + 0x108], xmm0
movsd qword [rbp + 0x380], xmm0
movd r14d, xmm10
mov dword [rbp + 0x388], r14d
lea rdx, [rbp + 0x380]
lea rcx, [rbp + 0x368]
call fcn.1800074e0
movss dword [rbp + 0x1d0], xmm9
movss dword [rbp + 0x1d4], xmm8
movss dword [rbp + 0x1d8], xmm6
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x358]
call fcn.1800074e0
movss dword [rbp + 0x1e0], xmm12
movss xmm0, dword [rsp + 0x6c]
movss dword [rbp + 0x1e4], xmm0
movss dword [rbp + 0x1e8], xmm7
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x460]
call fcn.1800074e0
movss xmm12, dword [rbp + 0x444]
subss xmm12, dword [rbp + 0x454]
andps xmm12, xmmword [0x1800e2c40]
cvtps2pd xmm1, xmm12
mulsd xmm1, qword [0x1800e25d0]
cvtpd2ps xmm6, xmm1
lea rcx, [r15 + 0x238]
call fcn.180018020
lea rdx, [rax + 0x164]
lea rcx, [rbp + 0x480]
call fcn.180018230
subss xmm8, dword [0x180148cd4]
movss xmm1, dword [0x1800e25ec]
movaps xmm0, xmm8
call sub.api_ms_win_crt_math_l1_1_0.dll_powf
movaps xmm7, xmm0
subss xmm9, dword [0x180148cd0]
movss xmm8, dword [0x1800e25ec]
movaps xmm1, xmm8
movaps xmm0, xmm9
call sub.api_ms_win_crt_math_l1_1_0.dll_powf
addss xmm7, xmm0
subss xmm10, dword [0x180148cd8]
movaps xmm1, xmm8
movaps xmm0, xmm10
call sub.api_ms_win_crt_math_l1_1_0.dll_powf
addss xmm7, xmm0
xorps xmm1, xmm1
ucomiss xmm1, xmm7
ja 0x180015699
xorps xmm10, xmm10
sqrtss xmm10, xmm7
jmp 0x1800156a5
movaps xmm0, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movaps xmm10, xmm0
divss xmm10, dword [0x1800e26f4]
movss dword [rbp + 0x44], xmm10
mov ebx, 4
mov rax, qword gs:[0x58]
mov rdi, qword [rax + r13*8]
mov eax, dword [rbx + rdi]
cmp dword [0x180149510], eax
jle 0x180015700
lea rcx, [0x180149510]
call fcn.1800bc494
cmp dword [0x180149510], 0xffffffff
jne 0x180015700
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x1801495b8], eax
lea rcx, [0x180149510]
call fcn.1800bc428
mov eax, dword [rbx + rdi]
cmp dword [0x1801493c8], eax
jle 0x18001573d
lea rcx, [0x1801493c8]
call fcn.1800bc494
cmp dword [0x1801493c8], 0xffffffff
jne 0x18001573d
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x1801493c4], eax
lea rcx, [0x1801493c8]
call fcn.1800bc428
xorps xmm0, xmm0
cvtss2sd xmm0, xmm10
movsd qword [rbp + 0x350], xmm0
movaps xmm2, xmm0
movq r8, xmm0
lea rdx, str._.fm
lea rcx, [rbp + 0x4a0]
call fcn.180018590
mov rax, qword [0x180148c20]
xor edi, edi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
lea rcx, [rbp + 0x4a0]
mov qword [rsp + 0x28], rcx
movss xmm0, dword [0x1800e27a0]
movss dword [rsp + 0x20], xmm0
movss xmm3, dword [rbp + 0x40]
movss xmm2, dword [rax + 0x3c20]
lea rdx, [rbp + 0x178]
mov rcx, qword [rax + 0x3c18]
call fcn.18003e840
movss xmm0, dword [rbp + 0x178]
addss xmm0, dword [0x1800e25a0]
cvttss2si eax, xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rbp + 0x178], xmm0
mov edx, dword [0x1801495b8]
shr edx, 1
lea ecx, [rdx + 0x226]
xorps xmm0, xmm0
cvtsi2ss xmm0, rcx
movss dword [0x180148ce0], xmm0
mov eax, dword [0x1801493c4]
shr eax, 1
sub edx, eax
lea eax, [rdx - 0x12c]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss dword [0x180148ce4], xmm0
test sil, sil
je 0x180016d79
lea rcx, [r15 + 0x101]
call fcn.180018340
test al, al
je 0x180016d79
movups xmm8, xmmword [rsp + 0x40]
movsd xmm9, qword [rbp + 0x198]
cmp byte [0x180148a9d], dil
je 0x180015880
movaps xmmword [rbp + 0x90], xmm15
movaps xmmword [rbp + 0xa0], xmm11
movaps xmmword [rbp + 0xb0], xmm8
movaps xmmword [rbp + 0xc0], xmm14
movsd qword [rbp + 0xd0], xmm9
lea rcx, [rbp + 0x90]
call fcn.1800136c0
movss xmm7, dword [rbp + 0x3f4]
cmp byte [0x180148a66], dil
je 0x180015acf
cmp byte [0x180148b4e], dil
je 0x1800158c3
test r12b, r12b
je 0x1800158b3
movups xmm0, xmmword [0x180120bf8]
movups xmmword [0x180148350], xmm0
jmp 0x1800158ca
movups xmm0, xmmword [0x180120be8]
movups xmmword [0x180148350], xmm0
jmp 0x1800158ca
movups xmm0, xmmword [0x180148350]
mov eax, dword [0x180148b90]
test eax, eax
jne 0x180015930
lea rcx, [0x180148350]
call fcn.18001b050
mov dword [rbp + 0x6d0], eax
movaps xmm1, xmm6
mulss xmm1, dword [0x1800e2574]
movss xmm0, dword [rbp + 0x368]
subss xmm0, xmm1
movss xmm1, dword [0x1800e25e8]
movss dword [rsp + 0x28], xmm1
lea rax, [rbp + 0x6d0]
mov qword [rsp + 0x20], rax
movaps xmm3, xmm12
movaps xmm2, xmm6
movss xmm1, dword [rbp + 0x464]
call fcn.180010470
jmp 0x1800159f5
cmp eax, 1
jne 0x180015978
movdqa xmmword [rsp + 0x40], xmm0
cvttss2si r9d, xmm12
cvttss2si r8d, xmm6
cvttss2si edx, xmm7
movaps xmm1, xmm6
mulss xmm1, dword [0x1800e2574]
movss xmm0, dword [rbp + 0x368]
subss xmm0, xmm1
cvttss2si ecx, xmm0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
call fcn.1800110e0
jmp 0x1800159f5
cmp eax, 2
jne 0x1800159f5
movss xmm1, dword [rsp + 0x70]
addss xmm1, dword [0x1800e269c]
movdqa xmmword [rsp + 0x40], xmm0
movss xmm0, dword [rsp + 0x68]
movss xmm2, dword [rsp + 0x6c]
unpcklps xmm0, xmm2
movsd qword [rbp + 0x2d0], xmm0
movss dword [rbp + 0x2d8], xmm1
movsd xmm0, qword [rbp + 0x108]
movsd qword [rbp + 0x2c0], xmm0
mov dword [rbp + 0x2c8], r14d
movss xmm0, dword [0x1800e25b8]
movss dword [rsp + 0x20], xmm0
lea r9, [rsp + 0x40]
movss xmm2, dword [0x1800e26c8]
lea rdx, [rbp + 0x2d0]
lea rcx, [rbp + 0x2c0]
call fcn.1800109e0
cmp byte [0x180148b4f], dil
je 0x180015acf
movups xmm0, xmmword [0x180148330]
movdqa xmmword [rsp + 0x40], xmm0
cvttss2si edi, xmm7
movaps xmm1, xmm6
mulss xmm1, dword [0x1800e2574]
movss xmm0, dword [rbp + 0x3f0]
subss xmm0, xmm1
cvttss2si ebx, xmm0
mov rax, qword [0x180148c20]
mov rax, qword [rax + 0x48d0]
lea r8, str.Background
xor edx, edx
mov rcx, qword [rax]
call fcn.18001f170
mov r10, rax
lea rcx, [rsp + 0x40]
call fcn.18001b050
cvttss2si ecx, xmm6
add ecx, ebx
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
movss dword [rbp + 0x180], xmm0
cvttss2si ecx, xmm12
add ecx, edi
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
movss dword [rbp + 0x184], xmm0
movd xmm1, ebx
cvtdq2ps xmm1, xmm1
movss dword [rbp + 0x188], xmm1
movd xmm0, edi
cvtdq2ps xmm0, xmm0
movss dword [rbp + 0x18c], xmm0
xor r13d, r13d
mov dword [rsp + 0x28], r13d
xorps xmm0, xmm0
movss dword [rsp + 0x20], xmm0
mov r9d, eax
lea r8, [rbp + 0x180]
lea rdx, [rbp + 0x188]
mov rcx, r10
call fcn.1800388b0
jmp 0x180015ad2
xor r13d, r13d
cmp byte [0x180148a9c], 0
je 0x180015bb3
cvttss2si edx, xmm13
cvttss2si r14d, xmm12
cvttss2si r8d, xmm6
cvttss2si esi, xmm7
movss xmm0, dword [rbp + 0x470]
subss xmm0, dword [0x1800e2670]
cvttss2si ebx, xmm0
mov dword [rbp + 0x210], 0xff
mov dword [rbp + 0x214], 0xff
mov dword [rbp + 0x218], 0xff
mov dword [rbp + 0x21c], 0x5a
lea ecx, [rdx + rdx]
mov eax, 0xff
sub eax, ecx
mov dword [rbp + 0x200], eax
mov dword [rbp + 0x204], ecx
mov dword [rbp + 0x208], r13d
mov dword [rbp + 0x20c], 0xff
mov ecx, 0x64
sub ecx, edx
imul ecx, r14d
mov eax, 0x51eb851f
imul ecx
mov edi, edx
sar edi, 5
mov ecx, edi
shr ecx, 0x1f
add edi, ecx
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
sub ebx, eax
lea rax, [rbp + 0x210]
mov qword [rsp + 0x20], rax
mov r9d, r14d
mov edx, esi
lea ecx, [rbx - 3]
call fcn.1800115b0
sub r14d, edi
lea edx, [rsi + rdi]
lea rax, [rbp + 0x200]
mov qword [rsp + 0x20], rax
mov r9d, r14d
lea ecx, [rbx - 3]
call fcn.1800115b0
cmp byte [0x180148a67], 0
je 0x180015c3d
cmp byte [0x180148b4e], 0
je 0x180015bee
test r12b, r12b
je 0x180015bde
movups xmm0, xmmword [0x180120bb8]
movups xmmword [0x180148340], xmm0
jmp 0x180015bf5
movups xmm0, xmmword [0x180120b98]
movups xmmword [0x180148340], xmm0
jmp 0x180015bf5
movups xmm0, xmmword [0x180148340]
movdqa xmmword [rsp + 0x40], xmm0
movaps xmmword [rbp + 0x90], xmm15
movaps xmmword [rbp + 0xa0], xmm11
movaps xmmword [rbp + 0xb0], xmm8
movaps xmmword [rbp + 0xc0], xmm14
movsd qword [rbp + 0xd0], xmm9
movss xmm2, dword [0x1800e25a8]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x90]
call fcn.180007bd0
cmp byte [0x180148b4c], 0
je 0x180015d1a
mov rax, qword [0x180148c20]
mov rax, qword [rax + 0x48d0]
lea r8, str.Background
xor edx, edx
mov rcx, qword [rax]
call fcn.18001f170
mov rbx, rax
lea rcx, [0x180148320]
call fcn.18001b050
mov edi, eax
movss xmm0, dword [rbp + 0x128]
movss dword [rbp + 0x190], xmm0
movss xmm1, dword [rbp + 0x12c]
movss dword [rbp + 0x194], xmm1
mulss xmm6, dword [0x1800e2548]
movss xmm14, dword [0x1800e2574]
test eax, 0xff000000
je 0x180015d23
comiss xmm14, xmm6
ja 0x180015d23
subss xmm6, xmm14
mov dword [rsp + 0x28], 0x3f
movss xmm0, dword [0x1800e264c]
movss dword [rsp + 0x20], xmm0
xorps xmm3, xmm3
movaps xmm2, xmm6
lea rdx, [rbp + 0x190]
mov rcx, rbx
call fcn.180037de0
movss xmm0, dword [0x1800e25c8]
movss dword [rsp + 0x28], xmm0
mov dword [rsp + 0x20], 1
mov r9d, edi
mov r8d, dword [rbx + 0x78]
mov rdx, qword [rbx + 0x80]
mov rcx, rbx
call fcn.180036370
mov dword [rbx + 0x78], r13d
jmp 0x180015d23
movss xmm14, dword [0x1800e2574]
cmp byte [0x180148a64], 0
je 0x180015d77
movsd xmm0, qword [rbp + 0x358]
movsd qword [rbp + 0x240], xmm0
mov eax, dword [rbp + 0x360]
mov dword [rbp + 0x248], eax
movsd xmm0, qword [rbp + 0x128]
movsd qword [rbp + 0x250], xmm0
mov eax, dword [rbp + 0x130]
mov dword [rbp + 0x258], eax
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x250]
call fcn.1800125c0
mov r12d, dword [rbp + 0x268]
movsd xmm13, qword [rbp + 0x260]
cmp byte [0x180148a65], 0
je 0x180015e8b
cmp byte [0x180148a9f], 0
jne 0x180015e8b
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
lea rax, [rbp + 0x4a0]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180015dc1
lea rdx, [rbp + 0x4a0]
lea rcx, [rsp + 0x40]
call fcn.180018720
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdx, qword [rsp + 0x40]
xorps xmm0, xmm0
movups xmmword [rbp + 0x400], xmm0
mov qword [rbp + 0x410], r13
mov qword [rbp + 0x418], r13
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x180015e10
lea rcx, [rbp + 0x400]
call fcn.180018720
movsd qword [rbp + 0x270], xmm13
mov dword [rbp + 0x278], r12d
lea r8, [rbp + 0x400]
movaps xmm1, xmm10
lea rcx, [rbp + 0x270]
call fcn.180011d70
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x180015e8b
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015e86
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800170f2
call fcn.1800bc3e4
cmp byte [0x180148b4d], 0
je 0x1800160bc
psrldq xmm8, 8
movq rax, xmm8
add rax, 0x170
mov qword [rbp + 0x118], 0
mov dword [rbp + 0x120], 0
mov dword [rbp - 0x4f], r13d
mov word [rbp - 0x4b], r13w
mov byte [rbp - 0x49], 0
mov dword [rbp - 0x70], 0xd2e3a2a9
mov qword [rbp - 0x68], rax
lea rax, [rbp + 0x118]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 0xc
mov eax, dword [0x180148a98]
mov dword [rbp - 0x6c], eax
mov byte [rbp - 0x50], 0
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
mov r9d, 0x28
lea r8, [rbp - 0x70]
mov edx, 0x936793c4
mov rcx, qword [0x180148a90]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
movss xmm0, dword [rbp + 0x11c]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [0x1800e25b0]
cvtpd2ps xmm6, xmm0
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_sinf
movaps xmm8, xmm0
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_cosf
movaps xmm12, xmm0
movss xmm1, dword [rbp + 0x118]
cvtps2pd xmm1, xmm1
mulsd xmm1, qword [0x1800e25b0]
cvtpd2ps xmm6, xmm1
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_sinf
movaps xmm7, xmm0
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_cosf
movaps xmm10, xmm0
movss xmm15, dword [0x1800e274c]
mulss xmm7, xmm15
movss xmm2, dword [rsp + 0x70]
movaps xmm9, xmm2
subss xmm9, xmm7
movaps xmm6, xmm0
mulss xmm6, xmm8
mulss xmm6, xmm15
movss xmm0, dword [rsp + 0x6c]
addss xmm6, xmm0
movss xmm1, dword [rsp + 0x68]
unpcklps xmm1, xmm0
movsd qword [rbp + 0x280], xmm1
movss dword [rbp + 0x288], xmm2
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x490]
call fcn.1800074e0
movss xmm8, dword [rax]
movss xmm11, dword [rax + 4]
mulss xmm10, xmm12
mulss xmm10, xmm15
addss xmm10, dword [rsp + 0x68]
movss dword [rbp + 0x1f0], xmm10
movss dword [rbp + 0x1f4], xmm6
movss dword [rbp + 0x1f8], xmm9
lea rdx, [rbp + 0x1f0]
lea rcx, [rbp + 0x1b8]
call fcn.1800074e0
movss xmm6, dword [rax]
movss xmm7, dword [rax + 4]
mov rax, qword [0x180148c20]
mov rax, qword [rax + 0x48d0]
lea r8, str.Background
xor edx, edx
mov rcx, qword [rax]
call fcn.18001f170
mov r10, rax
movups xmm0, xmmword [0x180148310]
movups xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.18001b050
movss dword [rbp + 0x1b0], xmm6
movss dword [rbp + 0x1b4], xmm7
movss dword [rbp + 0x1a8], xmm8
movss dword [rbp + 0x1ac], xmm11
movss xmm0, dword [0x1800e25b8]
movss dword [rsp + 0x20], xmm0
mov r9d, eax
lea r8, [rbp + 0x1b0]
lea rdx, [rbp + 0x1a8]
mov rcx, r10
call fcn.180038640
movss xmm10, dword [rbp + 0x44]
cmp byte [0x180148a9f], 0
je 0x18001675b
mov byte [rbp + 0x6d0], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], r13
lea rax, [rbp + 0x6d0]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1800160f0
lea rdx, [rbp + 0x6d0]
lea rcx, [rbp + 0x20]
call fcn.180018720
nop
mov dword [rbp + 0x6d0], r13d
mov dword [rbp - 0x4f], r13d
mov word [rbp - 0x4b], r13w
mov byte [rbp - 0x49], 0
mov dword [rbp - 0x70], 0xd2e3a2a9
lea rax, [r15 + 0x18]
mov qword [rbp - 0x68], rax
lea rax, [rbp + 0x6d0]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 4
mov eax, dword [0x180148a98]
mov dword [rbp - 0x6c], eax
mov byte [rbp - 0x50], 0
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
mov r9d, 0x28
lea r8, [rbp - 0x70]
mov edx, 0x936793c4
mov rcx, qword [0x180148a90]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edx, dword [rbp + 0x6d0]
lea rcx, [rbp + 0x138]
call fcn.1800077c0
mov rdx, rax
lea rcx, [rbp + 0x220]
call fcn.180009870
mov rbx, rax
lea rax, [rbp + 0x20]
cmp rax, rbx
je 0x180016204
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x1800161e6
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800161e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800170f9
call fcn.1800bc3e4
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rbp + 0x238]
cmp rdx, 0xf
jbe 0x180016245
inc rdx
mov rcx, qword [rbp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180016240
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800170f9
call fcn.1800bc3e4
cmp byte [0x180148a65], 0
je 0x18001657e
movzx eax, word [0x1800e09f4]
mov word [rbp + 0x6d0], ax
cmp byte [0x1800e09f5], 0
je 0x180016277
mov byte [rbp + 0x6d0], 0x20
xor byte [rbp + 0x6d1], 0x33
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x60], r13
lea rax, [rbp + 0x6d0]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180016294
lea rdx, [rbp + 0x6d0]
lea rcx, [rbp + 0x48]
call fcn.180018720
nop
lea rax, [rbp + 0x4a0]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1800162c0
mov r8, qword [rbp + 0x58]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
sub rax, r8
cmp rbx, rax
ja 0x18001637b
lea rax, [rbx + r8]
mov qword [rbp + 0x58], rax
lea rdi, [rbp + 0x48]
cmp rcx, 0xf
cmova rdi, qword [rbp + 0x48]
lea rax, [rbp + 0x4a0]
add rax, rbx
cmp rax, rdi
jbe 0x180016334
lea rax, [r8 + rdi]
lea rcx, [rbp + 0x4a0]
cmp rcx, rax
ja 0x180016334
lea rax, [rbp + 0x4a0]
cmp rdi, rax
ja 0x180016325
mov rsi, r13
jmp 0x180016337
lea rax, [rbp + 0x4a0]
mov rsi, rdi
sub rsi, rax
jmp 0x180016337
mov rsi, rbx
inc r8
lea rcx, [rdi + rbx]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
lea rdx, [rbp + 0x4a0]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r8, rbx
sub r8, rsi
lea rax, [rsi + rbx]
lea rdx, [rbp + 0x4a0]
add rdx, rax
lea rcx, [rsi + rdi]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x48]
jmp 0x180016398
mov qword [rsp + 0x28], rbx
lea rax, [rbp + 0x4a0]
mov qword [rsp + 0x20], rax
mov rdx, rbx
lea rcx, [rbp + 0x48]
call fcn.180018c00
xorps xmm0, xmm0
movups xmmword [rbp + 0x138], xmm0
mov qword [rbp + 0x148], r13
mov qword [rbp + 0x150], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x138], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x148], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0xf
cmova rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
lea rcx, [rbp + 0x138]
call fcn.180017fa0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x40]
movq rcx, xmm0
psrldq xmm1, 8
movq rax, xmm1
cmp rax, 0xf
cmova rdx, rcx
xorps xmm0, xmm0
movups xmmword [rbp + 0x220], xmm0
mov qword [rbp + 0x230], r13
mov qword [rbp + 0x238], r13
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x180016450
lea rcx, [rbp + 0x220]
call fcn.180018720
movsd qword [rbp + 0x290], xmm13
mov dword [rbp + 0x298], r12d
lea r8, [rbp + 0x220]
movaps xmm1, xmm10
lea rcx, [rbp + 0x290]
call fcn.180011d70
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1800164cc
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800164c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180017100
call fcn.1800bc3e4
nop
mov rdx, qword [rbp + 0x150]
cmp rdx, 0xf
jbe 0x18001650d
inc rdx
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180016508
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180017107
call fcn.1800bc3e4
mov qword [rbp + 0x148], r13
mov qword [rbp + 0x150], 0xf
mov byte [rbp + 0x138], 0
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x180016561
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001655c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001710e
call fcn.1800bc3e4
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x60], 0xf
mov byte [rbp + 0x48], 0
mov r13, qword [rbp + 0x38]
mov r14, qword [rbp + 0x20]
jmp 0x180016724
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
lea r15, [rbp + 0x20]
mov r14, qword [rbp + 0x20]
mov r13, qword [rbp + 0x38]
cmp r13, 0xf
cmova r15, r14
mov rsi, qword [rbp + 0x30]
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x180017404
cmp rsi, 0xf
ja 0x1800165e3
mov qword [rsp + 0x50], rsi
mov ebx, 0xf
mov qword [rsp + 0x58], rbx
movups xmm0, xmmword [r15]
movups xmmword [rsp + 0x40], xmm0
movq rdi, xmm0
jmp 0x180016678
mov rbx, rsi
or rbx, 0xf
cmp rbx, rax
jbe 0x180016602
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x180016632
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x18001661c
xor edi, edi
jmp 0x180016659
cmp rcx, 0x1000
jb 0x180016651
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800173fe
mov rcx, rax
call fcn.1800bc50c
test rax, rax
je 0x180017115
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180016659
call fcn.1800bc50c
mov rdi, rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rbx
lea r8, [rsi + 1]
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
nop
lea rdx, [rsp + 0x40]
cmp rbx, 0xf
cmova rdx, rdi
xorps xmm0, xmm0
movups xmmword [rbp + 0x420], xmm0
xor eax, eax
mov qword [rbp + 0x430], rax
mov qword [rbp + 0x438], rax
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], al
jne 0x1800166a6
lea rcx, [rbp + 0x420]
call fcn.180018720
movsd qword [rbp + 0x2a0], xmm13
mov dword [rbp + 0x2a8], r12d
lea r8, [rbp + 0x420]
movaps xmm1, xmm10
lea rcx, [rbp + 0x2a0]
call fcn.180011d70
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x180016720
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001671b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180017115
call fcn.1800bc3e4
mov r15, qword [rbp - 0x10]
cmp r13, 0xf
jbe 0x18001675b
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x180016753
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001711c
mov rcx, r14
call fcn.1800bc3e4
xor r12d, r12d
cmp byte [0x180148a9e], r12b
je 0x180016c29
mov qword [rbp + 0x6d0], r12
mov dword [rbp - 0x4f], r12d
mov word [rbp - 0x4b], r12w
mov byte [rbp - 0x49], r12b
mov dword [rbp - 0x70], 0xd2e3a2a9
lea rax, [r15 + 0x988]
mov qword [rbp - 0x68], rax
lea rax, [rbp + 0x6d0]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 8
mov eax, dword [0x180148a98]
mov dword [rbp - 0x6c], eax
mov byte [rbp - 0x50], r12b
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, 0x28
lea r8, [rbp - 0x70]
mov edx, 0x936793c4
mov rcx, qword [0x180148a90]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov qword [rbp - 0x10], r12
mov dword [rbp + 0x19], r12d
mov word [rbp + 0x1d], r12w
mov byte [rbp + 0x1f], r12b
mov dword [rbp - 8], 0xd2e3a2a9
mov rax, qword [rbp + 0x6d0]
add rax, 0x248
mov qword [rbp], rax
lea rax, [rbp - 0x10]
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], 8
mov eax, dword [0x180148a98]
mov dword [rbp - 4], eax
mov byte [rbp + 0x18], r12b
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, 0x28
lea r8, [rbp - 8]
mov edx, 0x936793c4
mov rcx, qword [0x180148a90]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov byte [rbp + 0x6d0], r12b
xorps xmm0, xmm0
movups xmmword [rbp + 0x158], xmm0
mov qword [rbp + 0x168], r12
mov qword [rbp + 0x170], r12
lea rax, [rbp + 0x6d0]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r12b
jne 0x180016884
lea rdx, [rbp + 0x6d0]
lea rcx, [rbp + 0x158]
call fcn.180018720
nop
mov eax, dword [0x1800e0c28]
mov dword [rsp + 0x60], eax
movzx ecx, word [0x1800e0c2c]
mov word [rsp + 0x64], cx
movzx eax, byte [0x1800e0c2e]
mov byte [rsp + 0x60], 0x5b
xor byte [rsp + 0x61], 0x33
xor byte [rsp + 0x62], 0x34
xor byte [rsp + 0x63], 0x35
xor cl, 0x36
mov byte [rsp + 0x64], cl
xor byte [rsp + 0x65], 0x37
xor al, 0x38
mov byte [rsp + 0x66], al
movsd xmm2, qword [rbp + 0x350]
movq r8, xmm2
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x5a0]
call fcn.1800180a0
mov dword [rbp + 0x6d0], r12d
mov dword [rbp - 0x4f], r12d
mov word [rbp - 0x4b], r12w
mov byte [rbp - 0x49], 0
mov dword [rbp - 0x70], 0xd2e3a2a9
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x68], rax
lea rax, [rbp + 0x6d0]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 4
mov eax, dword [0x180148a98]
mov dword [rbp - 0x6c], eax
mov byte [rbp - 0x50], 0
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, 0x28
lea r8, [rbp - 0x70]
mov edx, 0x936793c4
mov rcx, qword [0x180148a90]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edx, dword [rbp + 0x6d0]
lea rcx, [rsp + 0x40]
call fcn.1800077c0
mov rdx, rax
lea rcx, [rbp - 8]
call fcn.18000cbe0
mov rbx, rax
lea rax, [rbp + 0x158]
cmp rax, rbx
je 0x180016a09
mov rdx, qword [rbp + 0x170]
cmp rdx, 0xf
jbe 0x1800169e5
inc rdx
mov rcx, qword [rbp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800169e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180017123
call fcn.1800bc3e4
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x158], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x168], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rbp + 0x10]
cmp rdx, 0xf
jbe 0x180016a44
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180016a3f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180017123
call fcn.1800bc3e4
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
lea r15, [rbp + 0x158]
mov r14, qword [rbp + 0x158]
mov r13, qword [rbp + 0x170]
cmp r13, 0xf
cmova r15, r14
mov rsi, qword [rbp + 0x168]
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x1800173f8
cmp rsi, 0xf
ja 0x180016ab5
mov qword [rsp + 0x50], rsi
mov ebx, 0xf
mov qword [rsp + 0x58], rbx
movups xmm0, xmmword [r15]
movups xmmword [rsp + 0x40], xmm0
movq rdi, xmm0
jmp 0x180016b4b
mov rbx, rsi
or rbx, 0xf
cmp rbx, rax
jbe 0x180016ad4
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x180016b05
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x180016aef
mov rdi, r12
jmp 0x180016b2c
cmp rcx, 0x1000
jb 0x180016b24
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18001740a
mov rcx, rax
call fcn.1800bc50c
test rax, rax
je 0x18001712a
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180016b2c
call fcn.1800bc50c
mov rdi, rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rbx
lea r8, [rsi + 1]
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
nop
lea rdx, [rsp + 0x40]
cmp rbx, 0xf
cmova rdx, rdi
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], r12
mov qword [rbp + 0x10], r12
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x180016b70
lea rcx, [rbp - 8]
call fcn.180018720
movsd xmm0, qword [rbp + 0x2b0]
movsd qword [rbp + 0x80], xmm0
mov eax, dword [rbp + 0x2b8]
mov dword [rbp + 0x88], eax
lea r8, [rbp - 8]
movaps xmm1, xmm10
lea rcx, [rbp + 0x80]
call fcn.180011d70
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x180016bf2
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180016bec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001712a
call fcn.1800bc3e4
nop
cmp r13, 0xf
jbe 0x180016c29
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x180016c21
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180017131
mov rcx, r14
call fcn.1800bc3e4
mov ebx, dword [0x1801495b8]
xorps xmm0, xmm0
cvtsi2ss xmm0, rbx
mulss xmm0, xmm14
movss xmm7, dword [rbp + 0x70]
movaps xmm1, xmm7
subss xmm1, xmm0
mov edi, dword [0x1801493c4]
xorps xmm0, xmm0
cvtsi2ss xmm0, rdi
mulss xmm0, xmm14
movss xmm8, dword [rbp + 0x74]
movaps xmm2, xmm8
subss xmm2, xmm0
mulss xmm2, xmm2
mulss xmm1, xmm1
addss xmm2, xmm1
xorps xmm0, xmm0
ucomiss xmm0, xmm2
ja 0x180016c86
xorps xmm6, xmm6
sqrtss xmm6, xmm2
jmp 0x180016c91
movaps xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movaps xmm6, xmm0
shr edi, 1
cvttss2si eax, xmm8
sub edi, eax
movd xmm1, edi
cvtdq2ps xmm1, xmm1
shr ebx, 1
cvttss2si eax, xmm7
sub ebx, eax
movd xmm2, ebx
cvtdq2ps xmm2, xmm2
mulss xmm2, xmm2
mulss xmm1, xmm1
addss xmm2, xmm1
xorps xmm0, xmm0
ucomiss xmm0, xmm2
ja 0x180016ccd
xorps xmm3, xmm3
sqrtss xmm3, xmm2
jmp 0x180016cd8
movaps xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movaps xmm3, xmm0
cmp byte [0x180148b94], 0
je 0x180016d41
cmp byte [rbp + 0x6d8], 0
je 0x180016daf
movss xmm0, dword [rsp + 0x78]
mov eax, dword [rbp + 0x6e0]
xorps xmm12, xmm12
movss xmm9, dword [0x1800e2688]
movss xmm10, dword [0x1800e2538]
mov r13, qword [rbp - 0x80]
comiss xmm0, xmm6
jbe 0x180016dcf
movss xmm1, dword [0x180120c10]
comiss xmm1, xmm3
jbe 0x180016dcf
movss dword [rsp + 0x78], xmm6
mov esi, eax
mov dword [rbp + 0x6e8], eax
jmp 0x180016dd5
movss xmm0, dword [rsp + 0x78]
comiss xmm0, xmm6
jbe 0x180016daf
movss xmm0, dword [0x180120c10]
mov eax, dword [rbp + 0x6e0]
xorps xmm12, xmm12
movss xmm9, dword [0x1800e2688]
movss xmm10, dword [0x1800e2538]
mov r13, qword [rbp - 0x80]
comiss xmm0, xmm3
jmp 0x180016d28
movss xmm14, dword [0x1800e2574]
xor r12d, r12d
jmp 0x180016db3
movss xmm14, dword [0x1800e2574]
mov eax, dword [rbp + 0x6e0]
jmp 0x180016ddd
movss xmm14, dword [0x1800e2574]
mov eax, dword [rbp + 0x6e0]
mov esi, dword [rbp + 0x6e8]
jmp 0x180016ddd
mov r13, qword [rbp - 0x80]
mov eax, dword [rbp + 0x6e0]
movss xmm10, dword [0x1800e2538]
movss xmm9, dword [0x1800e2688]
xorps xmm12, xmm12
mov esi, dword [rbp + 0x6e8]
movss xmm6, dword [0x1800e2774]
inc eax
mov dword [rbp + 0x6e0], eax
mov r9, qword [rbp + 0x1a0]
inc r9
mov qword [rbp + 0x1a0], r9
mov rcx, qword [0x180148cf8]
mov r8, qword [0x180148cf0]
sub rcx, r8
movabs rax, 0xe38e38e38e38e39
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movsxd rax, dword [rbp + 0x6e0]
cmp rax, rdx
jb 0x180014ef1
movss xmm6, dword [0x1800e264c]
cmp byte [0x180148b97], 0
je 0x180016f15
mov rax, qword [0x180148c20]
mov rcx, qword [rax + 0x48d0]
lea r8, str.Background
xor edx, edx
mov rcx, qword [rcx]
call fcn.18001f170
mov rbx, rax
lea rcx, [0x180120bc8]
call fcn.18001b050
mov edi, eax
mov ecx, dword [0x180148afc]
xorps xmm0, xmm0
cvtsi2ss xmm0, rcx
movss dword [rbp + 0x6d0], xmm0
mov ecx, dword [0x180148a60]
xorps xmm1, xmm1
cvtsi2ss xmm1, rcx
movss dword [rbp + 0x6d4], xmm1
test eax, 0xff000000
je 0x180016f0e
movss xmm2, dword [0x180120c10]
comiss xmm14, xmm2
ja 0x180016f0e
subss xmm2, xmm14
mov dword [rsp + 0x28], 0x3f
movss dword [rsp + 0x20], xmm6
movaps xmm3, xmm12
lea rdx, [rbp + 0x6d0]
mov rcx, rbx
call fcn.180037de0
movss xmm0, dword [0x1800e25a8]
movss dword [rsp + 0x28], xmm0
mov dword [rsp + 0x20], 1
mov r9d, edi
mov r8d, dword [rbx + 0x78]
mov rdx, qword [rbx + 0x80]
mov rcx, rbx
call fcn.180036370
mov dword [rbx + 0x78], r12d
mov r8, qword [0x180148cf0]
cmp byte [0x180148b9c], 0
je 0x180016f2a
call fcn.180011f90
mov r8, qword [0x180148cf0]
cmp byte [0x180148b95], 0
je 0x1800173a5
cmp esi, 0x539
je 0x1800173a5
movsxd rax, esi
lea rcx, [rax + rax*8]
movups xmm7, xmmword [r8 + rcx*8]
movups xmm8, xmmword [r8 + rcx*8 + 0x10]
movups xmm9, xmmword [r8 + rcx*8 + 0x20]
movups xmm10, xmmword [r8 + rcx*8 + 0x30]
movsd xmm6, qword [r8 + rcx*8 + 0x40]
movaps xmmword [rbp + 0x90], xmm7
movaps xmmword [rbp + 0xa0], xmm8
movaps xmmword [rbp + 0xb0], xmm9
movaps xmmword [rbp + 0xc0], xmm10
movsd qword [rbp + 0xd0], xmm6
lea r8, [rbp + 0x90]
mov edx, 8
lea rcx, [rbp + 0x1b8]
call fcn.1800079c0
movss xmm0, dword [rax]
movss dword [0x180148c78], xmm0
movss xmm1, dword [rax + 4]
movss dword [0x180148c7c], xmm1
movss xmm0, dword [rax + 8]
movss dword [0x180148c80], xmm0
movaps xmmword [rbp + 0x90], xmm7
movaps xmmword [rbp + 0xa0], xmm8
movaps xmmword [rbp + 0xb0], xmm9
movaps xmmword [rbp + 0xc0], xmm10
movsd qword [rbp + 0xd0], xmm6
lea r8, [rbp + 0x90]
mov edx, 6
lea rcx, [rbp + 0x1b8]
call fcn.1800079c0
movss xmm0, dword [rax]
movss dword [0x180148d18], xmm0
movss xmm1, dword [rax + 4]
movss dword [0x180148d1c], xmm1
movss xmm0, dword [rax + 8]
movss dword [0x180148d20], xmm0
movaps xmmword [rbp + 0x90], xmm7
movaps xmmword [rbp + 0xa0], xmm8
movaps xmmword [rbp + 0xb0], xmm9
movaps xmmword [rbp + 0xc0], xmm10
movsd qword [rbp + 0xd0], xmm6
lea r8, [rbp + 0x90]
mov edx, 3
lea rcx, [rbp + 0x1b8]
call fcn.1800079c0
movss xmm0, dword [rax]
movss dword [0x180148d28], xmm0
movss xmm1, dword [rax + 4]
movss dword [0x180148d2c], xmm1
movss xmm2, dword [rax + 8]
movss dword [0x180148d30], xmm2
mov eax, dword [0x180148c3c]
cdq
sub eax, edx
sar eax, 1
movd xmm7, eax
cvtdq2ps xmm7, xmm7
mov eax, dword [0x180148c34]
cdq
sub eax, edx
sar eax, 1
movd xmm6, eax
cvtdq2ps xmm6, xmm6
mov eax, dword [0x180148b98]
test eax, eax
jne 0x180017138
movss xmm0, dword [0x180148c78]
movss dword [0x180148ca8], xmm0
movss xmm1, dword [0x180148c7c]
movss xmm0, dword [0x180148c80]
movss dword [0x180148cb0], xmm0
jmp 0x18001717c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp eax, 1
jne 0x180017167
movss xmm0, dword [0x180148d18]
movss dword [0x180148ca8], xmm0
movss xmm1, dword [0x180148d1c]
movss xmm0, dword [0x180148d20]
movss dword [0x180148cb0], xmm0
jmp 0x18001717c
cmp eax, 2
jne 0x180017184
movss dword [0x180148ca8], xmm0
movss dword [0x180148cb0], xmm2
movss dword [0x180148cac], xmm1
movsd xmm0, qword [0x180148ca8]
movsd qword [rbp + 0x70], xmm0
mov eax, dword [0x180148cb0]
mov dword [rbp + 0x78], eax
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x80]
call fcn.1800074e0
movss xmm2, dword [0x1800e2c50]
movss xmm1, dword [rbp + 0x80]
ucomiss xmm1, xmm12
jp 0x1800171c2
je 0x180017222
comiss xmm1, xmm7
jbe 0x1800171f0
movaps xmm0, xmm7
subss xmm0, xmm1
xorps xmm0, xmm2
cvttss2si eax, xmm0
cdq
idiv dword [0x180120c1c]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
addss xmm0, xmm7
addss xmm7, xmm7
comiss xmm0, xmm7
jmp 0x180017213
comiss xmm7, xmm1
jbe 0x180017222
subss xmm1, xmm7
cvttss2si eax, xmm1
cdq
idiv dword [0x180120c1c]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
addss xmm0, xmm7
comiss xmm12, xmm0
mov dword [0x180148ca0], eax
jbe 0x180017222
mov dword [0x180148ca0], r12d
movss xmm1, dword [rbp + 0x84]
ucomiss xmm1, xmm12
jp 0x180017232
je 0x180017292
comiss xmm1, xmm6
jbe 0x180017260
movaps xmm0, xmm6
subss xmm0, xmm1
xorps xmm0, xmm2
cvttss2si eax, xmm0
cdq
idiv dword [0x180120c0c]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
addss xmm0, xmm6
addss xmm6, xmm6
comiss xmm0, xmm6
jmp 0x180017283
comiss xmm6, xmm1
jbe 0x180017292
subss xmm1, xmm6
cvttss2si eax, xmm1
cdq
idiv dword [0x180120c0c]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
addss xmm0, xmm6
comiss xmm12, xmm0
mov dword [0x180148c84], eax
jbe 0x180017292
mov dword [0x180148c84], r12d
movsxd rsi, dword [0x180148ca4]
lea r14, [0x180117440]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180017336
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180017336
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xa70759a1
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180017331
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180017310
cmp r8d, 0xe860f0c1
je 0x18001733b
test r9d, r9d
jne 0x1800172f0
mov rax, qword [rax]
jmp 0x1800172c0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov ecx, dword [r14 + rsi*4]
call rax
test ax, ax
js 0x180017366
cmp byte [0x180148b96], 0
je 0x1800173a5
cmp byte [0x180148b9d], 0
je 0x180017399
mov r8d, dword [0x180148c84]
call fcn.180001f40
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x1800136a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r8d, dword [0x180148c84]
call fcn.180001f40
lea r11, [rsp + 0x788]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm7, xmmword [r11 - 0x28]
movaps xmm8, xmmword [r11 - 0x38]
movaps xmm9, xmmword [r11 - 0x48]
movaps xmm10, xmmword [r11 - 0x58]
movaps xmm11, xmmword [r11 - 0x68]
movaps xmm12, xmmword [r11 - 0x78]
movaps xmm13, xmmword [r11 - 0x88]
movaps xmm14, xmmword [r11 - 0x98]
movaps xmm15, xmmword [r11 - 0xa8]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1800015e0
nop
call fcn.180001520
int3
call fcn.1800015e0
nop
call fcn.180001520
int3