Function at 0x180064b40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x18007b358]
xor rax, rsp
mov qword [rbp + 0x50], rax
mov dword [rsp + 0x30], r9d
mov qword [rbp - 0x70], r8
mov qword [rbp - 0x68], rdx
mov r13, rcx
mov qword [rbp - 0x80], rcx
xor esi, esi
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], si
mov dword [rsp + 0x38], r9d
lea eax, [r9 - 0xd]
lea r11, [0x180000000]
movabs r12, 0x7ffffffffffffffe
lea r14d, [rsi + 0x64]
mov edi, dword [rsp + 0x60]
cmp r9d, eax
jbe 0x18006562e
lea ebx, [rsi + 2]
mov r12d, dword [rsp + 0x40]
mov dword [rsp + 0x70], r12d
movzx r14d, byte [rsp + 0x34]
mov dword [rsp + 0x50], r14d
movzx r15d, byte [rsp + 0x34]
mov byte [rsp + 0x34], r15b
mov edx, dword [rsp + 0x40]
mov dword [rsp + 0x58], edx
mov r11d, dword [rsp + 0x40]
mov dword [rsp + 0x5c], r11d
mov r10, qword [rbp - 0x68]
mov qword [rbp - 0x78], r10
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x68], eax
mov r9d, dword [rsp + 0x40]
mov dword [rsp + 0x54], r9d
mov r8d, dword [rsp + 0x40]
mov dword [rsp + 0x40], r8d
mov esi, dword [rsp + 0x38]
mov ecx, esi
nop word [rax + rax]
lea eax, [rsi - 0xe7]
cmp eax, 0x2b
ja case.default.0x180064c4f
lea rcx, [0x180000000]
movzx eax, byte [rcx + rax + 0x65f50]
mov ecx, dword [rcx + rax*4 + 0x65f18]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
xor r13d, r13d
mov esi, r13d
mov qword [rbp - 0x30], r13
cmp qword [0x18007b098], r13
jbe 0x180065087
nop dword [rax + rax]
mov r8d, r13d
mov dword [rsp + 0x48], r13d
nop dword [rax + rax]
cmp r8d, 0x11
ja case.default.0x180064c9f
mov eax, r8d
lea r9, [0x180000000]
mov ecx, dword [r9 + rax*4 + 0x65f7c]
add rcx, r9
jmp rcx
mov eax, 0x43
mov word [rbp + 0x28], ax
mov dword [rbp + 0x2a], 0x6f006c
mov eax, 0x6e
mov word [rbp + 0x2e], ax
jmp case.default.0x180064c9f
mov qword [rbp - 0x58], r13
lea rcx, [rbp - 8]
call qword [sym.imp.WINMM.dll_mciGetDeviceIDW]
mov r12d, eax
mov dword [rsp + 0x70], eax
mov r8d, dword [rsp + 0x48]
mov r10, qword [rbp - 0x78]
mov edx, dword [rsp + 0x58]
mov r11d, dword [rsp + 0x5c]
jmp case.default.0x180064c9f
mov eax, 0x65
mov word [rbp + 0x30], ax
mov dword [rbp + 0x32], 0x690042
mov dword [rbp + 0x36], 0x6d0074
jmp case.default.0x180064c9f
mov dword [rbp + 0x3c], 0x410070
mov dword [rbp + 0x40], 0x650072
jmp case.default.0x180064c9f
mov dword [rbp - 8], 0x690072
mov dword [rbp - 4], 0x7a007a
mov dword [rbp], 0x200065
jmp case.default.0x180064c9f
mov eax, 0x61
mov word [rbp + 4], ax
mov dword [rbp + 6], 0x20007a
jmp case.default.0x180064c9f
mov dword [rbp + 0x44], 0x490061
mov word [rbp + 0x48], r13w
mov r14b, 1
mov dword [rsp + 0x50], r14d
jmp case.default.0x180064c9f
test r15b, r15b
je 0x180064d7e
mov ecx, r12d
call qword [sym.imp.WINMM.dll_mciGetCreatorTask]
mov r8d, dword [rsp + 0x48]
mov r10, qword [rbp - 0x78]
mov r11d, dword [rsp + 0x5c]
lea rax, [0x18007b088]
cmp qword [0x18007b0a0], 0x10
cmovae rax, qword [0x18007b088]
movsx edx, byte [rax + rsi]
mov word [rsp + 0x78], dx
mov r14, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x38]
cmp r14, rcx
jae 0x180064dd9
lea rax, [r14 + 1]
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x50]
cmp rcx, 8
cmovae rax, qword [rbp - 0x50]
mov word [rax + r14*2], dx
mov word [rax + r14*2 + 2], r13w
mov r14d, dword [rsp + 0x50]
mov edx, dword [rsp + 0x58]
jmp case.default.0x180064c9f
movabs rdx, 0x7ffffffffffffffe
mov rax, rdx
sub rax, r14
cmp rax, 1
jb 0x180065f12
lea r13, [r14 + 1]
mov r12, qword [rbp - 0x38]
mov rsi, r13
or rsi, 7
cmp rsi, rdx
jbe 0x180064e0c
mov rsi, rdx
jmp 0x180064e2d
mov rcx, r12
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp r12, rax
jbe 0x180064e22
mov rsi, rdx
jmp 0x180064e2d
lea rax, [r12 + rcx]
cmp rsi, rax
cmovb rsi, rax
lea rdx, [rsi + 1]
lea rcx, [rbp - 0x50]
call fcn.180030e90
mov r15, rax
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], rsi
add r14, r14
mov r8, r14
mov rcx, rax
cmp r12, 8
jb 0x180064edb
mov rsi, qword [rbp - 0x50]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [rsp + 0x78]
mov word [r14 + r15], ax
xor r13d, r13d
mov word [r14 + r15 + 2], r13w
lea rdx, [r12*2 + 2]
cmp rdx, 0x1000
jb 0x180064ea4
add rdx, 0x27
mov rcx, qword [rsi - 8]
sub rsi, rcx
lea rax, [rsi - 8]
cmp rax, 0x1f
ja 0x180065606
mov rsi, rcx
mov rcx, rsi
call fcn.180069570
mov qword [rbp - 0x50], r15
mov r8d, dword [rsp + 0x48]
mov rsi, qword [rbp - 0x30]
mov r14d, dword [rsp + 0x50]
movzx r15d, byte [rsp + 0x34]
mov r12d, dword [rsp + 0x70]
mov r10, qword [rbp - 0x78]
mov edx, dword [rsp + 0x58]
mov r11d, dword [rsp + 0x5c]
jmp case.default.0x180064c9f
lea rdx, [rbp - 0x50]
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [rsp + 0x78]
mov word [r14 + r15], ax
xor r13d, r13d
mov word [r14 + r15 + 2], r13w
mov qword [rbp - 0x50], r15
mov r8d, dword [rsp + 0x48]
mov rsi, qword [rbp - 0x30]
mov r14d, dword [rsp + 0x50]
movzx r15d, byte [rsp + 0x34]
mov r12d, dword [rsp + 0x70]
mov r10, qword [rbp - 0x78]
mov edx, dword [rsp + 0x58]
mov r11d, dword [rsp + 0x5c]
jmp case.default.0x180064c9f
test r14b, r14b
je case.default.0x180064c9f
lea rax, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x5c]
mov r8d, edx
mov edx, r11d
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_BackupSeek]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rsp + 0x48]
mov r10, qword [rbp - 0x78]
mov edx, dword [rsp + 0x58]
mov r11d, dword [rsp + 0x5c]
jmp case.default.0x180064c9f
mov r15b, 1
mov byte [rsp + 0x34], r15b
mov r11d, 0x182aa
mov dword [rsp + 0x5c], r11d
mov edx, r13d
mov dword [rsp + 0x58], edx
jmp case.default.0x180064c9f
mov dword [rbp + 0xa], 0x530041
jmp case.default.0x180064c9f
mov eax, 0x61
mov word [rbp + 0x3a], ax
jmp case.default.0x180064c9f
mov dword [rbp + 0x10], 0x200049
jmp case.default.0x180064c9f
mov eax, 0x50
mov word [rbp + 0xe], ax
jmp case.default.0x180064c9f
mov dword [rbp + 0x24], 0x700069
jmp case.default.0x180064c9f
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
xor r9d, r9d
xor edx, edx
lea rcx, [rdx - 1]
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r10, rax
mov qword [rbp - 0x78], rax
mov edx, r13d
movzx ecx, r15b
test r12d, r12d
cmovne edx, ecx
movzx r15d, dl
mov byte [rsp + 0x34], dl
movzx r14d, r14b
test rax, rax
cmove r14d, r13d
mov dword [rsp + 0x50], r14d
mov r8d, dword [rsp + 0x48]
mov edx, dword [rsp + 0x58]
mov r11d, dword [rsp + 0x5c]
jmp case.default.0x180064c9f
mov word [rbp + 0x1e], r13w
mov dword [rbp + 0x20], 0x640047
jmp case.default.0x180064c9f
mov dword [rbp + 0x14], 0x650074
mov dword [rbp + 0x18], 0x65006c
mov eax, 0x70
mov word [rbp + 0x1c], ax
inc r8d
mov dword [rsp + 0x48], r8d
lea eax, [r8 + 0x22]
cmp eax, 0x34
jb 0x180064c80
inc rsi
mov qword [rbp - 0x30], rsi
cmp rsi, qword [0x18007b098]
jb 0x180064c70
mov r9d, dword [rsp + 0x54]
mov r14, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x38]
cmp r14, rcx
jae 0x1800650fc
lea rax, [r14 + 1]
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x50]
cmp rcx, 8
cmovae rax, qword [rbp - 0x50]
mov dword [rax + r14*2], 0x2e
mov esi, dword [rsp + 0x38]
mov r14d, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x30]
lea r11, [0x180000000]
dec esi
mov dword [rsp + 0x38], esi
lea eax, [rcx - 0xd]
mov r13, qword [rbp - 0x80]
cmp esi, eax
jbe 0x18006561d
mov r8d, dword [rsp + 0x40]
movzx r15d, byte [rsp + 0x34]
mov r12d, dword [rsp + 0x70]
mov r10, qword [rbp - 0x78]
mov edx, dword [rsp + 0x58]
mov r11d, dword [rsp + 0x5c]
jmp 0x180064c20
movabs rdx, 0x7ffffffffffffffe
mov rax, rdx
sub rax, r14
cmp rax, 1
jb 0x180065f0c
lea r13, [r14 + 1]
mov r15, qword [rbp - 0x38]
mov rsi, r13
or rsi, 7
cmp rsi, rdx
jbe 0x18006512f
mov rsi, rdx
jmp 0x180065150
mov rcx, r15
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp r15, rax
jbe 0x180065145
mov rsi, rdx
jmp 0x180065150
lea rax, [r15 + rcx]
cmp rsi, rax
cmovb rsi, rax
lea rdx, [rsi + 1]
lea rcx, [rbp - 0x50]
call fcn.180030e90
mov r12, rax
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], rsi
add r14, r14
mov r8, r14
mov rcx, rax
cmp r15, 8
jb 0x1800651d7
mov rsi, qword [rbp - 0x50]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov dword [r14 + r12], 0x2e
lea rdx, [r15*2 + 2]
cmp rdx, 0x1000
jb 0x1800651b8
add rdx, 0x27
mov rcx, qword [rsi - 8]
sub rsi, rcx
lea rax, [rsi - 8]
cmp rax, 0x1f
ja 0x180065e93
mov rsi, rcx
mov rcx, rsi
call fcn.180069570
mov qword [rbp - 0x50], r12
mov esi, dword [rsp + 0x38]
mov r14d, dword [rsp + 0x50]
mov r9d, dword [rsp + 0x54]
jmp case.0x180064c4f.233
lea rdx, [rbp - 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov dword [r14 + r12], 0x2e
mov qword [rbp - 0x50], r12
mov esi, dword [rsp + 0x38]
mov r14d, dword [rsp + 0x50]
mov r9d, dword [rsp + 0x54]
jmp case.0x180064c4f.233
mov edi, 1
mov dword [rsp + 0x60], edi
jmp case.0x180064c4f.233
mov eax, dword [r13]
xor ecx, ecx
lea rdx, [0x180000000]
mov dword [rdx + rax*4 + 0x7bcb0], ecx
mov dword [rsp + 0x38], ebx
mov eax, dword [r13]
mov dword [rsp + 0x48], eax
lea r9, [rsp + 0x38]
mov r8d, 0xd0
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x10]
call fcn.180038330
mov dword [0x18007bcb4], eax
test eax, eax
jne 0x180065616
mov r9d, dword [rsp + 0x54]
jmp case.0x180064c4f.233
xor eax, eax
mov edx, eax
lea rcx, [0x18007b030]
nop dword [rax]
movzx eax, byte [rcx]
cmp byte [rbp - 0x10], al
je 0x180065282
inc edx
inc rcx
cmp edx, 2
jb 0x180065270
mov dword [rsp + 0x68], edx
mov esi, 0x111
cmp edx, 2
jb case.0x180064c4f.233
mov eax, ebx
jmp 0x180065e9c
mov eax, dword [r13]
mov edx, dword [rsp + 0x68]
lea r11, [0x180000000]
mov dword [r11 + rax*8 + 0x7bc98], edx
xor r13d, r13d
mov r9d, r13d
nop dword [rax + rax]
mov ecx, 0x100
mov eax, ecx
sub eax, 0x100
je 0x1800652db
cmp eax, 1
jne 0x180065314
cmp r8d, 2
jb 0x180065327
jmp 0x180065314
mov r8d, r13d
mov ecx, edx
mov eax, r9d
lea rdx, [rax + rcx*8]
lea rcx, [r11 + 0x7b038]
lea rcx, [rcx + rdx*2]
movzx eax, byte [rcx]
cmp byte [rbp - 0xf], al
je 0x180065306
inc r8d
inc rcx
cmp r8d, 2
jb 0x1800652f2
mov dword [rsp + 0x40], r8d
mov ecx, 0x100
mov edx, dword [rsp + 0x68]
inc ecx
cmp ecx, 0x102
jb 0x1800652c5
inc r9d
cmp r9d, 8
jb 0x1800652c0
mov dword [rsp + 0x54], r9d
mov esi, 0x110
mov ecx, dword [rsp + 0x30]
jmp 0x1800650c5
mov r15, qword [rbp - 0x70]
mov eax, dword [r15 + 8]
mov dword [rsp + 0x38], eax
mov edx, 0xaa
lea rcx, [rsp + 0x38]
call fcn.1800481f0
mov rcx, rax
mov dword [r15], eax
test eax, eax
jne 0x18006536b
mov dword [r15], 1
mov ecx, 1
mov rax, qword [rbp - 0x68]
mov edx, dword [rax]
cmp edx, ecx
jl 0x18006537a
mov eax, edx
cdq
idiv ecx
mov dword [r15 + 4], edx
mov r9d, dword [rsp + 0x54]
jmp case.0x180064c4f.233
mov r14, qword [0x18007b078]
lea rsi, [0x18007b068]
cmp qword [0x18007b080], 8
cmovae rsi, qword [0x18007b068]
cmp r14, 8
jae 0x1800653bf
movups xmm0, xmmword [rsi]
movups xmmword [rbp - 0x30], xmm0
mov r15d, 7
mov r13, qword [rbp - 0x30]
jmp 0x1800653fe
mov r15, r14
or r15, 7
movabs rax, 0x7ffffffffffffffe
cmp r15, rax
cmova r15, rax
lea rdx, [r15 + 1]
lea rcx, [rbp - 0x30]
call fcn.180030e90
mov r13, rax
mov qword [rbp - 0x30], rax
lea r8, [r14*2 + 2]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x20], r14
lea r12, [rbp - 0x30]
cmp r15, 8
cmovae r12, r13
cmp r14, 8
jae 0x180065427
movups xmm0, xmmword [r12]
mov qword [rbp + 0x10], 7
jmp 0x18006546b
mov rsi, r14
or rsi, 7
movabs rax, 0x7ffffffffffffffe
cmp rsi, rax
cmova rsi, rax
lea rdx, [rsi + 1]
lea rcx, [rbp - 8]
call fcn.180030e90
mov qword [rbp - 8], rax
lea r8, [r14*2 + 2]
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x10], rsi
movups xmm0, xmmword [rbp - 8]
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp + 8], r14
mov rcx, qword [rbp - 0x38]
cmp rcx, 8
jb 0x1800654b3
lea rdx, [rcx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800654ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006560d
call fcn.180069570
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rbp - 0x50], xmm0
movups xmm0, xmmword [rbp + 8]
movups xmmword [rbp - 0x40], xmm0
cmp r15, 8
jb 0x1800651c4
lea rdx, [r15*2 + 2]
mov rax, r13
cmp rdx, 0x1000
jb 0x1800654fa
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180065e93
mov rcx, r13
call fcn.180069570
mov esi, dword [rsp + 0x38]
mov r14d, dword [rsp + 0x50]
mov r9d, dword [rsp + 0x54]
jmp case.0x180064c4f.233
mov r15, qword [rbp - 0x70]
mov eax, dword [r15 + 4]
shl eax, 2
movsxd rcx, eax
lea rax, [rcx + rcx*4]
movups xmm0, xmmword [r13 + rax*4 + 0x78]
movups xmmword [r15 + 0xc], xmm0
mov eax, dword [r13 + rax*4 + 0x88]
mov dword [r15 + 0x1c], eax
lea rax, [rcx + rcx*4]
movups xmm0, xmmword [r13 + rax*4 + 0x8c]
movups xmmword [r15 + 0x20], xmm0
mov eax, dword [r13 + rax*4 + 0x9c]
mov dword [r15 + 0x30], eax
lea rax, [rcx + rcx*4]
movups xmm0, xmmword [r13 + rax*4 + 0xa0]
movups xmmword [r15 + 0x34], xmm0
mov eax, dword [r13 + rax*4 + 0xb0]
mov dword [r15 + 0x44], eax
lea rax, [rcx + rcx*4]
movups xmm0, xmmword [r13 + rax*4 + 0xb4]
movups xmmword [r15 + 0x48], xmm0
mov eax, dword [r13 + rax*4 + 0xc4]
mov dword [r15 + 0x58], eax
jmp case.0x180064c4f.233
cmp r9d, 8
jae 0x180065e9c
jmp case.0x180064c4f.233
mov eax, dword [r13]
lea r11, [0x180000000]
mov dword [r11 + rax*8 + 0x7bc9c], r9d
mov ecx, dword [rsp + 0x30]
jmp 0x1800650c5
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
mov r15, qword [rbp - 0x70]
mov r9, r15
xor r8d, r8d
mov edx, 0xe1
xor ecx, ecx
call fcn.18004e4d0
mov ecx, 0xc
cmp dword [r13 + 0x74], ecx
cmovle ecx, dword [r13 + 0x74]
mov dword [r15 + 8], ecx
mov r9d, dword [rsp + 0x54]
jmp case.0x180064c4f.233
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov eax, edi
mov ebx, eax
jmp 0x180065e9c
mov r9d, dword [rsp + 0x30]
xor esi, esi
movabs r12, 0x7ffffffffffffffe
lea eax, [r9 + 0xe]
mov dword [rsp + 0x48], eax
cmp r9d, eax
jae case.0x18006566d.282
mov ebx, 0x21
lea r10d, [rbx + 0x53]
mov r8d, 0xffff
lea edx, [r8 - 0x11]
lea eax, [r9 - 0x104]
cmp eax, 0x16
ja case.0x18006566d.262
mov ecx, dword [r11 + rax*4 + 0x65fc4]
add rcx, r11
jmp rcx
mov r15, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x38]
cmp r15, rcx
jae 0x1800656a2
lea rax, [r15 + 1]
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x50]
cmp rcx, 8
cmovae rax, qword [rbp - 0x50]
mov dword [rax + r15*2], 0x64
mov r14, qword [rbp - 0x50]
jmp 0x180065791
mov rax, r12
sub rax, r15
cmp rax, 1
jb 0x180065f0c
lea r13, [r15 + 1]
mov r12, qword [rbp - 0x38]
mov rsi, r13
or rsi, 7
movabs rdx, 0x7ffffffffffffffe
cmp rsi, rdx
jbe 0x1800656d5
mov rsi, rdx
jmp 0x1800656f6
mov rcx, r12
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp r12, rax
jbe 0x1800656eb
mov rsi, rdx
jmp 0x1800656f6
lea rax, [r12 + rcx]
cmp rsi, rax
cmovb rsi, rax
lea rdx, [rsi + 1]
lea rcx, [rbp - 0x50]
call fcn.180030e90
mov r14, rax
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], rsi
add r15, r15
mov r8, r15
mov rcx, rax
cmp r12, 8
jb 0x180065768
mov rsi, qword [rbp - 0x50]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov dword [r14 + r15], 0x64
lea rdx, [r12*2 + 2]
cmp rdx, 0x1000
jb 0x18006575e
add rdx, 0x27
mov rcx, qword [rsi - 8]
sub rsi, rcx
lea rax, [rsi - 8]
cmp rax, 0x1f
ja 0x180065e93
mov rsi, rcx
mov rcx, rsi
call fcn.180069570
jmp 0x180065779
lea rdx, [rbp - 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov dword [r14 + r15], 0x64
lea r11, [0x180000000]
mov r10d, 0x74
mov r9d, dword [rsp + 0x30]
mov qword [rbp - 0x50], r14
xor esi, esi
mov r12, qword [rbp - 0x40]
mov r15, qword [rbp - 0x38]
cmp r12, r15
jae 0x1800657c4
lea rax, [r12 + 1]
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x50]
cmp r15, 8
cmovae rax, r14
mov dword [rax + r12*2], 0x61
mov r13, qword [rbp - 0x80]
jmp case.0x18006566d.262
movabs rdx, 0x7ffffffffffffffe
mov rax, rdx
sub rax, r12
cmp rax, 1
jb 0x180065f0c
lea r13, [r12 + 1]
mov rsi, r13
or rsi, 7
cmp rsi, rdx
jbe 0x1800657f4
mov rsi, rdx
jmp 0x180065815
mov rcx, r15
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp r15, rax
jbe 0x18006580a
mov rsi, rdx
jmp 0x180065815
lea rax, [r15 + rcx]
cmp rsi, rax
cmovb rsi, rax
lea rdx, [rsi + 1]
lea rcx, [rbp - 0x50]
call fcn.180030e90
mov r14, rax
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], rsi
add r12, r12
mov r8, r12
mov rcx, rax
cmp r15, 8
jb 0x180065887
mov rsi, qword [rbp - 0x50]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov dword [r12 + r14], 0x61
lea rdx, [r15*2 + 2]
cmp rdx, 0x1000
jb 0x18006587d
add rdx, 0x27
mov rcx, qword [rsi - 8]
sub rsi, rcx
lea rax, [rsi - 8]
cmp rax, 0x1f
ja 0x180065e93
mov rsi, rcx
mov rcx, rsi
call fcn.180069570
jmp 0x180065898
lea rdx, [rbp - 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov dword [r12 + r14], 0x61
mov qword [rbp - 0x50], r14
xor esi, esi
mov r13, qword [rbp - 0x80]
mov r10d, 0x74
mov r9d, dword [rsp + 0x30]
lea r11, [0x180000000]
jmp case.0x18006566d.262
mov r12d, dword [rsp + 0x40]
mov r13d, r12d
shr r13d, 0xa
mov r14d, esi
add r13d, 1
je 0x1800659a6
imul r15d, r14d, 0x3e8
mov r9d, r14d
shl r9d, 0xa
lea eax, [r9 + 0x400]
mov esi, r12d
cmp r12d, eax
cmovae esi, eax
cmp r9d, esi
jae 0x18006599a
mov r10d, r9d
add r10, r10
nop
mov rax, qword [rbp - 0x80]
mov r11d, dword [rax]
lea rax, [0x180000000]
mov rax, qword [rax + r11*8 + 0x7bca0]
movzx ecx, word [r10 + rax]
cmp cx, dx
je 0x18006598a
cmp cx, r8w
je 0x18006598a
test cx, cx
je 0x18006598a
mov edx, ecx
xor eax, eax
mov r8d, eax
mov ecx, 1
nop word [rax + rax]
mov eax, edx
shr eax, cl
and eax, 1
xor r8d, eax
inc ecx
cmp ecx, 0x10
jb 0x180065940
mov eax, edx
and eax, 1
cmp eax, r8d
mov r8d, 0xffff
jne 0x180065985
shr edx, 1
and edx, 0x3ff
add edx, r15d
cmp edx, r12d
jae 0x180065985
lea rax, [0x180000000]
mov rax, qword [rax + r11*8 + 0x7bca8]
mov word [rax + rdx*2], r9w
mov edx, 0xffee
inc r9d
add r10, 2
cmp r9d, esi
jb 0x180065900
inc r14d
cmp r14d, r13d
jb 0x1800658d2
mov r13, qword [rbp - 0x80]
mov esi, dword [r13]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
lea r11, [0x180000000]
mov ecx, dword [r11 + rsi*8 + 0x7bc9c]
lea r8, [rcx + rcx*4]
xor edx, edx
div dword [r11 + r8*8 + 0x6c4c8]
mov dword [r11 + rsi*4 + 0x7bcb8], edx
mov r9d, dword [rsp + 0x30]
xor esi, esi
lea r10d, [rsi + 0x74]
jmp case.0x18006566d.262
mov edi, esi
mov dword [rsp + 0x60], esi
jmp case.0x18006566d.262
mov r15d, esi
mov r12d, dword [rsp + 0x40]
test r12d, r12d
je 0x180065b4b
mov r14, rsi
nop dword [rax + rax]
mov dword [rsp + 0x68], 8
mov edx, dword [r13]
mov eax, dword [r11 + rdx*8 + 0x7bc9c]
lea rcx, [rax + rax*4]
mov eax, dword [r11 + rcx*8 + 0x6c4cc]
imul eax, r15d
shl eax, 9
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x70], edx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x10]
mov r8d, 0xf4
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x38]
call fcn.180013820
mov dword [0x18007bcb4], eax
test eax, eax
je 0x180065ac5
mov esi, SHSetFolderPathW
mov eax, esi
sub eax, 0xe6
je 0x180065a8a
cmp eax, 0x35
jne 0x180065ab8
mov ebx, dword [0x18007bcb4]
jmp 0x180065e9c
mov ecx, dword [r13]
lea rax, [0x180000000]
mov rcx, qword [rax + rcx*8 + 0x7bca0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [r13]
xor ecx, ecx
lea rdx, [0x180000000]
mov qword [rdx + rax*8 + 0x7bca0], rcx
add esi, 0x35
cmp esi, 0x150
jb 0x180065a71
xor esi, esi
movzx r9d, byte [rbp - 0xb]
cmp r9b, 0xff
je 0x180065b09
mov edx, esi
mov r8d, esi
nop word [rax + rax]
movzx eax, r9b
movzx ecx, dl
shr al, cl
test al, 1
lea eax, [r8 + 1]
cmove eax, r8d
mov r8d, eax
inc edx
cmp edx, 8
jb 0x180065ae0
cmp eax, 6
ja 0x180065b09
mov ecx, 0xffee
jmp 0x180065b18
movzx ecx, byte [rbp - 0xa]
shl cx, 8
movzx eax, byte [rbp - 9]
or cx, ax
lea r11, [0x180000000]
mov eax, dword [r13]
mov rax, qword [r11 + rax*8 + 0x7bca0]
mov word [r14 + rax], cx
inc r15d
add r14, 2
cmp r15d, r12d
jb 0x180065a10
mov r9d, dword [rsp + 0x30]
mov r10d, 0x74
mov eax, dword [r13]
mov rcx, qword [r11 + rax*8 + 0x7bca8]
test rcx, rcx
je case.0x18006566d.262
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1800658a2
mov eax, dword [r13]
lea rdx, [rax*8]
mov eax, dword [rdx + r11 + 0x7bc9c]
lea rcx, [rax + rax*4]
mov r12d, dword [r11 + rcx*8 + 0x6c4c4]
mov dword [rsp + 0x40], r12d
mov rcx, qword [rdx + r11 + 0x7bca0]
test rcx, rcx
je 0x180065ba3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea ecx, [r12 + r12]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, dword [r13]
lea r11, [0x180000000]
mov qword [r11 + rcx*8 + 0x7bca0], rax
mov r9d, dword [rsp + 0x30]
mov r10d, 0x74
jmp case.0x18006566d.262
mov r12d, dword [rsp + 0x40]
lea ecx, [r12 + r12]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, dword [r13]
lea r11, [0x180000000]
mov qword [r11 + rcx*8 + 0x7bca8], rax
mov eax, dword [r13]
cmp qword [r11 + rax*8 + 0x7bca8], 0
jne 0x180065c61
mov esi, 0x8a
cmp esi, 0x8a
je 0x180065c2c
cmp esi, 0x4e2a
je 0x180065c24
cmp esi, 0x9bca
je case.0x18006566d.282
jmp 0x180065c53
mov edi, ebx
mov dword [rsp + 0x60], ebx
jmp 0x180065c53
mov ecx, dword [r13]
mov rcx, qword [r11 + rcx*8 + 0x7bca0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [r13]
xor ecx, ecx
lea r11, [0x180000000]
mov qword [r11 + rax*8 + 0x7bca0], rcx
add esi, 0x4da0
cmp esi, 0xe8e0
jbe 0x180065c06
xor esi, esi
test r12d, r12d
je 0x180065bc0
mov ecx, esi
mov rdx, r12
nop dword [rax]
nop word [rax + rax]
mov eax, dword [r13]
mov rax, qword [r11 + rax*8 + 0x7bca8]
mov word [rcx + rax], si
lea rcx, [rcx + 2]
sub rdx, 1
jne 0x180065c80
mov r9d, dword [rsp + 0x30]
lea r10d, [rdx + 0x74]
jmp case.0x18006566d.262
mov esi, dword [r13]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
lea r11, [0x180000000]
mov ecx, dword [r11 + rsi*8 + 0x7bc9c]
lea r8, [rcx + rcx*4]
xor edx, edx
div dword [r11 + r8*8 + 0x6c4c4]
mov dword [r11 + rsi*4 + 0x7bcbc], edx
mov eax, dword [r13]
mov dword [r11 + rax*4 + 0x7bcb0], 0xa
mov r9d, dword [rsp + 0x30]
xor esi, esi
lea r10d, [rsi + 0x74]
jmp case.0x18006566d.262
mov r14, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x38]
cmp r14, rcx
jae 0x180065d26
lea rax, [r14 + 1]
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x50]
cmp rcx, 8
cmovae rax, qword [rbp - 0x50]
mov dword [rax + r14*2], 0x74
jmp case.0x18006566d.262
mov rax, r12
sub rax, r14
cmp rax, 1
jb 0x180065f0c
lea r13, [r14 + 1]
mov r15, qword [rbp - 0x38]
mov rsi, r13
or rsi, 7
cmp rsi, r12
jbe 0x180065d4f
mov rsi, r12
jmp 0x180065d70
mov rcx, r15
shr rcx, 1
mov rax, r12
sub rax, rcx
cmp r15, rax
jbe 0x180065d65
mov rsi, r12
jmp 0x180065d70
lea rax, [rcx + r15]
cmp rsi, rax
cmovb rsi, rax
lea rdx, [rsi + 1]
lea rcx, [rbp - 0x50]
call fcn.180030e90
mov r12, rax
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], rsi
add r14, r14
mov r8, r14
mov rcx, rax
cmp r15, 8
jb 0x180065de9
mov rsi, qword [rbp - 0x50]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov dword [r14 + r12], 0x74
lea rdx, [r15*2 + 2]
cmp rdx, 0x1000
jb 0x180065dd8
add rdx, 0x27
mov rcx, qword [rsi - 8]
sub rsi, rcx
lea rax, [rsi - 8]
cmp rax, 0x1f
ja 0x180065e93
mov rsi, rcx
mov rcx, rsi
call fcn.180069570
mov qword [rbp - 0x50], r12
jmp 0x18006589c
lea rdx, [rbp - 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov r10d, 0x74
mov dword [r14 + r12], r10d
xor esi, esi
mov qword [rbp - 0x50], r12
mov r13, qword [rbp - 0x80]
mov r9d, dword [rsp + 0x30]
lea r11, [0x180000000]
jmp case.0x18006566d.262
mov eax, dword [r13]
lea r9, [rax*4 + 0x7bcb8]
mov r8d, dword [r9 + r11]
mov eax, 0x10624dd3
mul r8d
shr edx, 6
imul eax, edx, 0x3e8
mov ecx, r8d
sub ecx, eax
sub r8d, ecx
mov dword [r9 + r11], r8d
mov r9d, dword [rsp + 0x30]
jmp case.0x18006566d.262
mov r8, r13
lea rdx, [rbp - 0x50]
mov ecx, 0x124
call fcn.18000d290
mov byte [rsp + 0x60], al
mov edi, dword [rsp + 0x60]
jmp 0x1800658a2
mov eax, dword [r13]
cmp qword [r11 + rax*8 + 0x7bca0], 0
je 0x180065ea0
inc r9d
mov dword [rsp + 0x30], r9d
cmp r9d, dword [rsp + 0x48]
jae case.0x18006566d.282
movabs r12, 0x7ffffffffffffffe
jmp 0x180065648
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov ebx, edi
mov edi, ebx
mov ebx, edi
mov rcx, qword [rbp - 0x38]
cmp rcx, 8
jb 0x180065ee3
lea rdx, [rcx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180065ede
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180065ede
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180069570
mov eax, ebx
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.180069d20
mov rbx, qword [rsp + 0x1a8]
add rsp, 0x160
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180030db0
nop
call fcn.180030db0
int3