Function at 0x180005660
Capabilities:
Copy file
Enumerate gui resources
Get common file path
Get memory capacity
Get system firmware table
Identify system language via api
Monitor clipboard content
Move file
Set console window title

Disassembly:
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x488]
sub rsp, 0x588
xor r12d, r12d
mov dword [rbp + 0x4d8], r12d
call fcn.18006d2d8
mov ebx, eax
mov eax, 0x51eb851f
imul ebx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub ebx, ecx
inc ebx
lea rcx, [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx r15d, word [rbp + 0x20]
add r15d, 0xfffffffc
xor r14b, r14b
lea rax, [0x180126720]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], r12
mov dword [rbp + 0x100], r12d
mov qword [rbp + 0x108], r12
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x120], xmm1
movdqa xmmword [rbp + 0x130], xmm0
mov byte [rbp + 0x140], r12b
mov esi, 1
mov dword [rbp + 0x4d8], esi
lea rax, [0x18011a868]
mov qword [rbp + 0xe8], rax
mov dword [rbp + 0xe4], 0x98
xor r8d, r8d
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0xe8]
call fcn.180017770
nop
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea rdi, [0x180126618]
mov qword [rbp + rcx + 0x40], rdi
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x3c], edx
lea rcx, [rbp + 0x48]
call fcn.180015fa0
nop
lea r13, [0x18011a848]
cmp r15d, 4
ja 0x180005995
lea r9, [0x1801275b8]
mov edx, esi
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rbp + 0x4e0]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x4e8]
lea r8, [rbp - 0x40]
lea rdx, [rbp + 0x4d8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x1800057d8
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x4d8]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea rdx, [rbp + 0x160]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], r12
mov qword [rbp + 0x10], r12
lea rax, [rbp + 0x160]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180005810
lea rdx, [rbp + 0x160]
lea rcx, [rbp - 8]
call fcn.18001a560
nop
mov r8d, 0x17
lea rdx, [0x1801275d8]
lea rcx, [rbp - 8]
call fcn.180016360
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov esi, 5
mov rdx, qword [rbp + 0x10]
cmp rdx, 0xf
jbe 0x1800058ae
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800058a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006c19
call fcn.180067290
mov qword [rbp + 8], r12
mov qword [rbp + 0x10], 0xf
mov byte [rbp - 8], 0
mov r8d, 2
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x270]
call fcn.180011f10
cmp qword [rbp + 0x2f8], 0
setne r14b
mov rax, qword [rbp + 0x270]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x270], rdi
mov rax, qword [rbp + 0x270]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x26c], edx
lea rcx, [rbp + 0x278]
call fcn.180011ae0
mov rax, qword [rbp + 0x270]
movsxd rcx, dword [rax + 4]
lea rax, [0x18011a868]
mov qword [rbp + rcx + 0x270], rax
mov rax, qword [rbp + 0x270]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx + 0x26c], edx
mov qword [rbp + 0x318], r13
lea rcx, [rbp + 0x318]
call fcn.180065fc4
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x180005995
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005990
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006c1f
call fcn.180067290
mov r8d, dword [0x18010e3e0]
cmp r8d, 0xebc9d12b
jne 0x180005ac7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolTimer]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTimeEx]
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1801275f0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStringTypeW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeLibraryWhenCallbackReturns]
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x180127628]
xor edx, edx
lea rcx, [0x180127658]
call qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CopyFileTransactedW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindClose]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumLanguageGroupLocalesW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SleepConditionVariableCS]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeSRWLock]
mov r8d, dword [0x18010e3e0]
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp ebx, ecx
jne 0x180005ba7
movsxd rcx, dword [rbp + 0x4d0]
call fcn.180067ac4
mov rdi, rax
cmp dword [0x18010e3e0], 0x35d355dc
jne 0x180006568
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetPropW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalProcessorInformation]
call qword [sym.imp.USER32.dll_DestroyCaret]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_UnregisterPointerInputTargetEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSymbolicLinkW]
mov dword [rsp + 0x40], r12d
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DrawIconEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolStackInformation]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetCursorPos]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetClassLongW]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x180006568
mov eax, ebx
and eax, 0x80000003
jge 0x180005bb7
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x180006301
call fcn.18006d2d8
and eax, 0x80000003
jge 0x180005bd2
dec eax
or eax, 0xfffffffc
inc eax
inc eax
test al, 1
jne 0x180006237
mov dword [rbp + 0x4d8], 0x104
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add rax, 0x26a
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x38], 0x26a
xor eax, eax
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], r12
mov ecx, 0x10
call fcn.18006737c
mov qword [rax + 8], r12
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x60]
mov qword [rax], rcx
mov word [rbp - 0x70], 0
mov qword [rbp - 0x6a], r12
mov qword [rbp - 0x62], r12
xor eax, eax
mov word [rbp - 0x6d], ax
mov byte [rbp - 0x6b], al
mov word [rbp - 0x6a], ax
mov byte [rbp - 0x68], al
mov word [rbp - 0x67], ax
mov byte [rbp - 0x65], al
mov word [rbp - 0x64], ax
mov byte [rbp - 0x62], al
mov word [rbp - 0x61], ax
mov byte [rbp - 0x5f], al
mov word [rbp - 0x5e], ax
mov byte [rbp - 0x5c], al
mov dword [rsp + 0x5c], r12d
mov dword [rbp - 0x74], r12d
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x50], xmm0
lea r9, [rbp + 0x270]
lea r8, [rbp + 0x4d8]
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x50]
call fcn.180021640
nop
lea rcx, [rsp + 0x60]
call fcn.180024630
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x60], r12
mov edx, 0x10
call fcn.180067290
mov rax, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add rax, 0x219
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x38], 0x219
xor eax, eax
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], r12
mov ecx, 0x10
call fcn.18006737c
mov qword [rax + 8], r12
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x60]
mov qword [rax], rcx
mov word [rbp - 0x70], 0
mov qword [rbp - 0x6a], r12
mov qword [rbp - 0x62], r12
xor eax, eax
mov word [rbp - 0x6d], ax
mov byte [rbp - 0x6b], al
mov word [rbp - 0x6a], ax
mov byte [rbp - 0x68], al
mov word [rbp - 0x67], ax
mov byte [rbp - 0x65], al
mov word [rbp - 0x64], ax
mov byte [rbp - 0x62], al
mov word [rbp - 0x61], ax
mov byte [rbp - 0x5f], al
mov word [rbp - 0x5e], ax
mov byte [rbp - 0x5c], al
mov dword [rsp + 0x5c], r12d
mov dword [rbp - 0x74], r12d
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x50], xmm0
lea r8, [rbp + 0x270]
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x50]
call fcn.1800212f0
mov edi, dword [rsp + 0x54]
lea rcx, [rsp + 0x60]
call fcn.180024630
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x60], r12
mov edx, 0x10
call fcn.180067290
mov dword [rbp + 0x4d8], r12d
mov rax, qword [sym.imp.KERNEL32.dll_GlobalAlloc]
add rax, 0x280
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x38], 0x280
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r12
mov ecx, 0x10
call fcn.18006737c
mov qword [rax + 8], r12
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x68]
mov qword [rax], rcx
mov word [rbp - 0x68], 0
mov qword [rbp - 0x62], r12
mov qword [rbp - 0x5a], r12
xor eax, eax
mov word [rbp - 0x65], ax
mov byte [rbp - 0x63], al
mov word [rbp - 0x62], ax
mov byte [rbp - 0x60], al
mov word [rbp - 0x5f], ax
mov byte [rbp - 0x5d], al
mov word [rbp - 0x5c], ax
mov byte [rbp - 0x5a], al
mov word [rbp - 0x59], ax
mov byte [rbp - 0x57], al
mov word [rbp - 0x56], ax
mov byte [rbp - 0x54], al
mov dword [rsp + 0x64], r12d
mov dword [rbp - 0x6c], r12d
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x50], xmm0
lea r9, [rbp + 0x4d0]
lea r8, [rbp + 0x4d8]
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x50]
call fcn.180020f90
mov rbx, qword [rsp + 0x58]
lea rcx, [rsp + 0x68]
call fcn.180024630
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x68], r12
mov edx, 0x10
call fcn.180067290
mov qword [rbp + 0x4e8], rbx
lea rcx, [rbp + 0x160]
call fcn.1800101b0
nop
lea rdx, [0x180127690]
lea rcx, [rbp + 0x160]
call fcn.180019280
mov rcx, rax
lea rdx, [rbp + 0x270]
call fcn.180019280
mov rcx, rax
lea rdx, [0x18012768c]
call fcn.180019280
lea rdx, [0x1801276b8]
lea rcx, [rbp + 0x160]
call fcn.180019280
test dil, 0x10
je 0x180005ee7
lea rdx, [0x1801276d8]
lea rcx, [rbp + 0x160]
call fcn.180019280
test dil, 1
je 0x180005f00
lea rdx, [0x1801276f8]
lea rcx, [rbp + 0x160]
call fcn.180019280
test dil, 2
je 0x180005f19
lea rdx, [0x180127718]
lea rcx, [rbp + 0x160]
call fcn.180019280
test dil, 4
je 0x180005f32
lea rdx, [0x180127730]
lea rcx, [rbp + 0x160]
call fcn.180019280
test dil, 0x20
je 0x180005f4b
lea rdx, [0x180127748]
lea rcx, [rbp + 0x160]
call fcn.180019280
bt edi, 0xb
jae 0x180005f64
lea rdx, [0x180127768]
lea rcx, [rbp + 0x160]
call fcn.180019280
bt edi, 0xe
jae 0x180005f7d
lea rdx, [0x180127788]
lea rcx, [rbp + 0x160]
call fcn.180019280
bt edi, 8
jae 0x180005f97
lea rdx, [0x1801277a8]
lea rcx, [rbp + 0x160]
call fcn.180019280
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r12
mov ecx, 7
mov qword [rbp - 0x18], rcx
mov word [rbp - 0x30], r12w
or esi, 0x10
mov dword [rbp + 0x4d8], esi
xor eax, eax
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], rax
mov edx, dword [rbp + 0x1d8]
mov eax, edx
and al, 0x22
cmp al, 2
je 0x180006001
mov rax, qword [rbp + 0x1a8]
mov r8, qword [rax]
test r8, r8
je 0x180006001
mov rax, qword [rbp + 0x188]
mov rdx, qword [rax]
cmp r8, qword [rbp + 0x1d0]
cmovb r8, qword [rbp + 0x1d0]
sub r8, rdx
sar r8, 1
jmp 0x18000603f
test dl, 4
jne 0x180006037
mov rax, qword [rbp + 0x1a0]
mov r9, qword [rax]
test r9, r9
je 0x180006037
mov rax, qword [rbp + 0x180]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x1b8]
movsxd r8, dword [rax]
add r8, r8
sub r8, rdx
add r8, r9
sar r8, 1
jmp 0x18000603f
mov r8, qword [rbp]
mov rdx, qword [rbp - 8]
test rdx, rdx
je 0x180006051
lea rcx, [rbp - 0x30]
call fcn.180012fe0
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0x30]
cmp rcx, 7
cmova rax, qword [rbp - 0x30]
mov qword [rbp + 0x4e0], rax
mov rax, qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rax, 0x28f
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x38], 0x28f
xor eax, eax
mov word [rsp + 0x50], ax
mov byte [rsp + 0x52], al
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
mov ecx, 0x10
call fcn.18006737c
mov qword [rax + 8], r12
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x58]
mov qword [rax], rcx
mov word [rbp - 0x78], 0
mov qword [rbp - 0x72], r12
mov qword [rbp - 0x6a], r12
xor eax, eax
mov word [rbp - 0x75], ax
mov byte [rbp - 0x73], al
mov word [rbp - 0x72], ax
mov byte [rbp - 0x70], al
mov word [rbp - 0x6f], ax
mov byte [rbp - 0x6d], al
mov word [rbp - 0x6c], ax
mov byte [rbp - 0x6a], al
mov word [rbp - 0x69], ax
mov byte [rbp - 0x67], al
mov word [rbp - 0x66], ax
mov byte [rbp - 0x64], al
mov dword [rsp + 0x54], r12d
mov dword [rbp - 0x7c], r12d
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x50], xmm0
lea r8, [rbp + 0x4e0]
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x50]
call fcn.180020c40
nop
lea rcx, [rsp + 0x58]
call fcn.180024630
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x58], r12
mov edx, 0x10
call fcn.180067290
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x18000617d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006178
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006c25
call fcn.180067290
mov rax, qword [sym.imp.KERNEL32.dll_GlobalLock]
add rax, 0x1a2
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x38], 0x1a2
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x50], xmm0
lea rdx, [rbp + 0x4e8]
lea rcx, [rbp - 0x50]
call fcn.180019540
mov rdi, rax
mov rax, qword [rbp + 0x160]
movsxd rcx, dword [rax + 4]
lea rax, [0x180126820]
mov qword [rbp + rcx + 0x160], rax
mov rax, qword [rbp + 0x160]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rbp + rcx + 0x15c], edx
lea rcx, [rbp + 0x168]
call fcn.18000fef0
mov rax, qword [rbp + 0x160]
movsxd rcx, dword [rax + 4]
lea rax, [0x180126730]
mov qword [rbp + rcx + 0x160], rax
mov rax, qword [rbp + 0x160]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx + 0x15c], edx
mov qword [rbp + 0x1e8], r13
lea rcx, [rbp + 0x1e8]
call fcn.180065fc4
nop
jmp 0x180006568
movsxd rdx, dword [rbp + 0x4d0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp + 0x4d8], rax
cmp dword [0x18010e3e0], 0x55248a48
jne 0x1800062c8
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNode]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentConsoleFont]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetMenu]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_KillTimer]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetUpdateRect]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadAcceleratorsW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindClose]
xor ecx, ecx
call qword [sym.imp.USER32.dll_AddClipboardFormatListener]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
mov rax, qword [sym.imp.KERNEL32.dll_LocalLock]
add rax, 0x217
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x38], 0x217
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x50], xmm0
lea rdx, [rbp + 0x4d8]
lea rcx, [rbp - 0x50]
call fcn.180019540
mov rdi, rax
jmp 0x180006568
test bl, 1
jne 0x1800063d0
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
add rax, 0x1a8
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x38], 0x1a8
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x50], xmm0
lea rcx, [rbp - 0x50]
call fcn.180019630
mov rbx, rax
cmp dword [0x18010e3e0], 0x626357c5
jne 0x1800063b3
xor edx, edx
mov qword [rsp + 0x20], r12
mov r9d, dword [rbp + 0x4d8]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
mov qword [rsp + 0x20], r12
mov r9d, dword [rbp + 0x4d8]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryThreadpoolStackInformation]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsBadStringPtrW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryThreadpoolStackInformation]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
movsxd r8, dword [rbp + 0x4d0]
mov edx, 8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
jmp 0x180006568
cmp r8d, 0x967b80e7
jne 0x180006458
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumberOfConsoleInputEvents]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProfileIntW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCompact]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForThreadpoolWaitCallbacks]
mov dword [rbp + 0x4d8], 4
mov dword [rbp + 0x4e0], 0x3000
mov qword [rbp + 0x4e8], r12
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x249
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x48], 0x249
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r12
mov ecx, 0x10
call fcn.18006737c
mov qword [rax + 8], r12
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x68]
mov qword [rax], rcx
mov word [rbp - 0x68], 0
mov qword [rbp - 0x62], r12
mov qword [rbp - 0x5a], r12
xor eax, eax
mov word [rbp - 0x65], ax
mov byte [rbp - 0x63], al
mov word [rbp - 0x62], ax
mov byte [rbp - 0x60], al
mov word [rbp - 0x5f], ax
mov byte [rbp - 0x5d], al
mov word [rbp - 0x5c], ax
mov byte [rbp - 0x5a], al
mov word [rbp - 0x59], ax
mov byte [rbp - 0x57], al
mov word [rbp - 0x56], ax
mov byte [rbp - 0x54], al
mov dword [rsp + 0x64], r12d
mov dword [rbp - 0x6c], r12d
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x50], xmm0
lea rax, [rbp + 0x4d8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x4e0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x4d0]
lea r8, [rbp + 0x4e8]
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x50]
call fcn.180020240
mov rdi, qword [rsp + 0x58]
lea rcx, [rsp + 0x68]
call fcn.180024630
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x68], r12
mov edx, 0x10
call fcn.180067290
test r14b, r14b
je 0x180006a19
cmp r15d, 4
ja 0x180006a19
lea rdx, [0x1801277d8]
lea rcx, [rbp + 0x40]
call fcn.1800180d0
mov rbx, rax
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov byte [rdx + rax + 0x58], 0x30
mov r14d, 2
mov edx, r14d
lea rcx, [rbp - 0x50]
call fcn.180066278
mov r8, qword [rax]
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
add rcx, rbx
mov rdx, qword [rax + 8]
call r8
movzx edx, word [rbp + 0x1e]
mov rcx, rbx
call fcn.180012bd0
mov rcx, rax
lea rdx, [0x1801277d4]
call fcn.1800180d0
mov rbx, rax
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov byte [rdx + rax + 0x58], 0x30
mov edx, r14d
lea rcx, [rbp - 0x40]
call fcn.180066278
mov r8, qword [rax]
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
add rcx, rbx
mov rdx, qword [rax + 8]
call r8
movzx edx, word [rbp + 0x1a]
mov rcx, rbx
call fcn.180012bd0
mov rcx, rax
lea rdx, [0x1801277d4]
call fcn.1800180d0
movzx edx, word [rbp + 0x18]
mov rcx, rax
call fcn.180012bd0
mov rcx, rax
lea rdx, [0x1801277d0]
call fcn.1800180d0
mov rbx, rax
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov byte [rdx + rax + 0x58], 0x30
mov edx, r14d
lea rcx, [rbp + 0x150]
call fcn.180066278
mov r8, qword [rax]
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
add rcx, rbx
mov rdx, qword [rax + 8]
call r8
movzx edx, word [rbp + 0x20]
mov rcx, rbx
call fcn.180012bd0
mov rcx, rax
lea rdx, [0x1801277cc]
call fcn.1800180d0
mov rbx, rax
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov byte [rdx + rax + 0x58], 0x30
mov edx, r14d
lea rcx, [rbp - 0x30]
call fcn.180066278
mov r8, qword [rax]
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
add rcx, rbx
mov rdx, qword [rax + 8]
call r8
movzx edx, word [rbp + 0x22]
mov rcx, rbx
call fcn.180012bd0
mov rcx, rax
lea rdx, [0x1801277cc]
call fcn.1800180d0
mov rbx, rax
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov byte [rdx + rax + 0x58], 0x30
mov edx, r14d
lea rcx, [rbp - 8]
call fcn.180066278
mov r8, qword [rax]
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
add rcx, rbx
mov rdx, qword [rax + 8]
call r8
movzx edx, word [rbp + 0x24]
mov rcx, rbx
call fcn.180012bd0
mov rcx, rax
lea rdx, [0x1801277c8]
call fcn.1800180d0
lea rdx, [0x1801277f0]
lea rcx, [rbp + 0x40]
call fcn.1800180d0
lea rdx, [0x180127818]
lea rcx, [rbp + 0x40]
call fcn.1800180d0
mov rbx, rax
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov byte [rdx + rax + 0x58], 0x30
mov edx, r14d
lea rcx, [rbp - 8]
call fcn.180066278
mov r8, qword [rax]
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
add rcx, rbx
mov rdx, qword [rax + 8]
call r8
movzx edx, word [rbp + 0x2e]
mov rcx, rbx
call fcn.180012bd0
mov rcx, rax
lea rdx, [0x1801277d4]
call fcn.1800180d0
mov rbx, rax
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov byte [rdx + rax + 0x58], 0x30
mov edx, r14d
lea rcx, [rbp - 0x30]
call fcn.180066278
mov r8, qword [rax]
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
add rcx, rbx
mov rdx, qword [rax + 8]
call r8
movzx edx, word [rbp + 0x2a]
mov rcx, rbx
call fcn.180012bd0
mov rcx, rax
lea rdx, [0x1801277d4]
call fcn.1800180d0
movzx edx, word [rbp + 0x28]
mov rcx, rax
call fcn.180012bd0
mov rcx, rax
lea rdx, [0x1801277d0]
call fcn.1800180d0
mov rbx, rax
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov byte [rdx + rax + 0x58], 0x30
mov edx, r14d
lea rcx, [rbp + 0x150]
call fcn.180066278
mov r8, qword [rax]
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
add rcx, rbx
mov rdx, qword [rax + 8]
call r8
movzx edx, word [rbp + 0x30]
mov rcx, rbx
call fcn.180012bd0
mov rcx, rax
lea rdx, [0x1801277cc]
call fcn.1800180d0
mov rbx, rax
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov byte [rdx + rax + 0x58], 0x30
mov edx, r14d
lea rcx, [rbp - 0x50]
call fcn.180066278
mov r8, qword [rax]
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
add rcx, rbx
mov rdx, qword [rax + 8]
call r8
movzx edx, word [rbp + 0x32]
mov rcx, rbx
call fcn.180012bd0
mov rcx, rax
lea rdx, [0x1801277cc]
call fcn.1800180d0
mov rbx, rax
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov byte [rdx + rax + 0x58], 0x30
mov edx, r14d
lea rcx, [rbp - 0x40]
call fcn.180066278
mov r8, qword [rax]
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
add rcx, rbx
mov rdx, qword [rax + 8]
call r8
movzx edx, word [rbp + 0x34]
mov rcx, rbx
call fcn.180012bd0
mov rcx, rax
lea rdx, [0x1801277c8]
call fcn.1800180d0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov rsi, rax
test rax, rax
jne 0x18000691d
lea rdx, [0x180127830]
lea rcx, [rbp + 0x40]
call fcn.1800180d0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.1800127b0
mov rcx, rax
lea rdx, [0x1801277c8]
call fcn.1800180d0
jmp 0x1800069dc
mov edx, 8
mov r8d, 0x1000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
lea rcx, [rbp + 0x40]
test rax, rax
jne 0x18000696d
lea rdx, [0x180127848]
call fcn.1800180d0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.1800127b0
mov rcx, rax
lea rdx, [0x1801277c8]
call fcn.1800180d0
jmp 0x1800069d3
lea rdx, [0x180127868]
call fcn.1800180d0
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
mov rdx, rbx
mov rcx, rax
call fcn.1800125a0
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff3ff
bts ecx, 9
mov dword [rdx + rax + 0x18], ecx
lea rdx, [0x1801277c8]
mov rcx, rax
call fcn.1800180d0
mov r8, rbx
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
lea rcx, [rbp + 0x48]
call fcn.180015cd0
test rax, rax
jne 0x180006a19
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
mov eax, 6
cmp qword [rbp + rcx + 0x88], 0
cmovne eax, r14d
or eax, dword [rbp + rcx + 0x50]
and eax, 0x17
mov dword [rbp + rcx + 0x50], eax
and eax, dword [rbp + rcx + 0x54]
jne 0x180006bc9
test rdi, rdi
jne 0x180006b4c
cmp dword [0x18010e3e0], 0x95294c2f
jne 0x180006b18
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x180127888]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileMUIPath]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFiber]
xor r9d, r9d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UpdateResourceW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCompact]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
xor edx, edx
xor ecx, ecx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TerminateJobObject]
lea rax, [fcn.180074184]
add rax, 0x13d
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x48], 0x13d
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x50], xmm0
lea rdx, [rbp + 0x4d0]
lea rcx, [rbp - 0x50]
call fcn.180018700
mov rdi, rax
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [0x180126618]
mov qword [rbp + rcx + 0x40], rax
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x3c], edx
lea rcx, [rbp + 0x48]
call fcn.180011ae0
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [0x18011a868]
mov qword [rbp + rcx + 0x40], rax
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx + 0x3c], edx
mov qword [rbp + 0xe8], r13
lea rcx, [rbp + 0xe8]
call fcn.180065fc4
nop
mov rax, rdi
add rsp, 0x588
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
test al, 4
je 0x180006bd6
lea rbx, [0x1801272a0]
jmp 0x180006beb
test r14b, al
lea rbx, [0x1801272b8]
lea rax, [0x1801272d0]
cmove rbx, rax
mov edx, 1
lea rcx, [rbp - 8]
call fcn.180001950
mov r8, rax
mov rdx, rbx
lea rcx, [rbp - 0x30]
call fcn.180002a40
lea rdx, [0x18012f858]
lea rcx, [rbp - 0x30]
call fcn.1800694a0
nop
call fcn.18007410c
nop
call fcn.18007410c
nop
call fcn.18007410c
int3