Function at 0x180092b20
Capabilities:
Create thread
Encode data using base64
Enumerate disk volumes
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x798]
sub rsp, 0x860
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
movaps xmmword [rax - 0x88], xmm10
mov rax, qword [0x180143ae0]
xor rax, rsp
mov qword [rbp + 0x700], rax
mov r12, r9
mov qword [rbp - 0x80], r9
mov rbx, r8
mov r13, rdx
mov r15, rcx
mov qword [rbp - 0x70], rcx
movdqa xmm0, xmmword [0x180138af0]
movdqa xmmword [rbp + 0x1e0], xmm0
mov byte [rbp + 0x1d0], 0
movdqa xmm1, xmm0
movdqa xmmword [rbp + 0x200], xmm0
mov byte [rbp + 0x1f0], 0
movdqa xmmword [rbp + 0x220], xmm0
mov byte [rbp + 0x210], 0
movdqa xmmword [rbp + 0x240], xmm0
mov byte [rbp + 0x230], 0
movdqa xmmword [rbp + 0x270], xmm0
mov byte [rbp + 0x260], 0
movdqa xmmword [rbp + 0x290], xmm0
mov byte [rbp + 0x280], 0
xor edi, edi
mov qword [rbp + 0x70], rdi
mov word [rbp + 0x78], di
movdqu xmmword [rbp + 0x8a], xmm0
mov byte [rbp + 0x7a], dil
mov qword [rbp + 0x40], rdi
mov word [rbp + 0x48], di
movdqu xmmword [rbp + 0x5a], xmm0
mov byte [rbp + 0x4a], dil
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], rdi
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], rdi
mov qword [rbp + 0xa0], rdi
mov qword [rbp + 0xa8], rdi
mov qword [rbp + 0xb0], rdi
lea ecx, [rdi + 0x30]
call fcn.1800c96c8
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xb8], rdi
xorps xmm2, xmm2
movsd qword [rbp + 0xc0], xmm2
mov qword [rbp + 0xc8], rdi
mov dword [rbp + 0xd0], 1
mov qword [rbp + 0xd8], rdi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xe0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xf0], xmm1
movdqa xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rdi
mov qword [rbp + reloc.SHLWAPI.dll_SHRegGetIntW], 0xffffffffffffffff
mov dword [rbp + 0x120], edi
xor eax, eax
movups xmmword [rbp + 0x128], xmm0
movups xmmword [rbp + 0x138], xmm0
movups xmmword [rbp + 0x148], xmm0
movups xmmword [rbp + 0x158], xmm0
mov qword [rbp + 0x168], rax
movdqa xmm0, xmmword [0x180138af0]
movdqa xmmword [rbp + 0x180], xmm0
mov byte [rbp + 0x170], al
mov word [rbp + 0x190], di
mov dword [rbp + 0x194], edi
mov qword [rbp + 0x198], rdi
xorps xmm0, xmm0
movaps xmmword [rbp + 0x1a0], xmm0
movsd qword [rbp + 0x1b0], xmm2
mov byte [rbp + 0x1b8], al
mov qword [rbp + 0x1bc], rdi
mov eax, dword [rbp + 0x7c0]
lea r14d, [rax - 0xf]
lea rcx, [0x180000000]
mov rdx, qword [rbp - 0x70]
mov r8, qword [rbp - 0x70]
mov r11d, dword [rsp + 0x50]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], r8
mov dword [rsp + 0x48], r11d
cmp eax, r14d
jbe 0x18009356e
lea edi, [rax - 0xc6]
mov r9d, 0x61
mov r10d, 0x6376
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x68], eax
movss xmm8, dword [rsp + 0x78]
movss xmm10, dword [rsp + 0x78]
mov rsi, qword [rbp - 0x80]
movss xmm9, dword [rsp + 0x78]
movss xmm6, dword [rsp + 0x78]
movss xmm7, dword [rsp + 0x78]
cmp edi, 0x3f
ja case.default.0x180092dc7
movzx eax, byte [rcx + rdi + 0x940f8]
mov ecx, dword [rcx + rax*4 + 0x940b8]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov rdx, qword [rbx]
mov qword [rsp + 0x60], rdx
mov r8, qword [r13]
mov qword [rsp + 0x58], r8
lea rcx, [0x180000000]
jmp 0x180092fb6
mov eax, dword [rbx + 0xc]
mov dword [rsp + 0x68], eax
jmp case.0x180092dc7.15
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, rbx
mov edx, 0xda
mov rcx, r13
call fcn.1800413f0
mov r11d, dword [rsp + 0x48]
mov r9d, 0x61
mov r10d, 0x6376
jmp case.0x180092dc7.15
mov word [rbp + 0x2a1], r9w
jmp case.0x180092dc7.15
mov dword [rbp + 0x2a6], 0x6f6b6e
jmp case.0x180092dc7.15
movaps xmm0, xmm8
divss xmm0, xmm10
xorps xmm0, xmmword [0x180138c80]
movss dword [rsp + 0x4c], xmm0
jmp case.0x180092dc7.15
mov r11d, dword [rbx + 0x10]
mov dword [rsp + 0x48], r11d
jmp case.0x180092dc7.15
movss xmm10, dword [r12 + 4]
movss xmm2, dword [r12]
movss xmm3, dword [r12 + 8]
movaps xmm9, xmm10
mulss xmm9, dword [r15 + 4]
movaps xmm0, xmm2
mulss xmm0, dword [r15]
addss xmm9, xmm0
movaps xmm1, xmm3
mulss xmm1, dword [r15 + 8]
addss xmm9, xmm1
xorps xmm9, xmmword [0x180138c80]
mulss xmm10, dword [rbx + 4]
mulss xmm2, dword [rbx]
addss xmm10, xmm2
mulss xmm3, dword [rbx + 8]
addss xmm10, xmm3
jmp case.0x180092dc7.15
mov eax, 0x73
mov word [rbp + 0x2a0], ax
jmp case.0x180092dc7.15
movss xmm8, dword [r13 + 4]
mulss xmm8, dword [r12 + 4]
movss xmm0, dword [r13]
mulss xmm0, dword [r12]
addss xmm8, xmm0
movss xmm1, dword [r13 + 8]
mulss xmm1, dword [r12 + 8]
addss xmm8, xmm1
addss xmm8, xmm9
jmp case.0x180092dc7.15
xor edx, edx
cmp dword [r15], edx
jle case.0x180092dc7.15
mov ecx, 0x36
mov eax, ecx
sub eax, 0x36
je 0x180092f7d
sub eax, 0x38
je 0x180092f69
sub eax, 0x38
je 0x180092f5a
sub eax, 0x38
je 0x180092f47
cmp eax, 0x38
jne 0x180092f81
add r13, 0xc
jmp 0x180092f81
movaps xmm0, xmm7
mulss xmm0, xmm6
movss dword [r13 + 8], xmm0
add rbx, 8
jmp 0x180092f81
movaps xmm0, xmm7
mulss xmm0, xmm7
movss dword [r13 + 4], xmm0
jmp 0x180092f81
movss xmm7, dword [rbx + 4]
movaps xmm0, xmm6
mulss xmm0, xmm6
movss dword [r13], xmm0
jmp 0x180092f81
movss xmm6, dword [rbx]
add ecx, 0x38
cmp ecx, 0x14e
jb 0x180092f26
inc edx
cmp edx, dword [r15]
jl 0x180092f21
jmp case.0x180092dc7.15
mov rsi, qword [r13 + 0x18]
jmp case.0x180092dc7.15
mov dword [rbp + 0x2a2], 0x65686376
lea rcx, [0x180000000]
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
dec edi
lea eax, [rdi + 0xc6]
cmp eax, r14d
ja 0x180092da5
mov ebx, dword [rsp + 0x68]
mov r15d, dword [rbp + 0x7c0]
mov r10d, r15d
mov dword [rsp + 0x40], r15d
lea eax, [r15 - 0xd]
mov ecx, 0x1bb
mov edi, dword [rsp + 0x4c]
cmp r15d, eax
jbe 0x180093a51
mov esi, 0x746f
mov r9d, 0x6f
mov dword [rsp + 0x50], edi
mov r13d, dword [rsp + 0x78]
mov r15d, dword [rsp + 0x78]
mov r12, qword [rbp - 0x80]
mov r14, qword [rbp - 0x80]
movzx eax, byte [rsp + 0x40]
mov dword [rsp + 0x4c], eax
mov ecx, r10d
nop dword [rax]
lea eax, [r10 - 0xc8]
cmp eax, 0x3d
ja case.default.0x180093050
lea rcx, [0x180000000]
movzx eax, byte [rcx + rax + 0x94170]
mov ecx, dword [rcx + rax*4 + 0x94138]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov edi, dword [rsp + 0x4c]
mov r12d, dword [rsp + 0x78]
nop dword [rax + rax]
mov eax, 0xce
mov dword [rsp + 0x4c], eax
nop dword [rax]
cmp eax, 0xce
jne 0x180093516
lea rax, [r13 + 0x34]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, StrCmpNICA
call fcn.1800be6b0
mov rbx, rax
cmp eax, 0x100
jge 0x18009323d
mov r15d, 0xbd
nop dword [rax + rax]
mov eax, r15d
sub eax, 0xbd
je 0x1800930dd
cmp eax, 1
jne 0x180093228
mov byte [rsi], bl
inc rsi
jmp 0x180093228
test ebx, ebx
jns 0x1800931ba
mov r14d, 0x53
nop dword [rax + rax]
mov eax, r14d
sub eax, 0x53
je 0x18009317f
cmp eax, 0x40
jne 0x1800931a9
lea rcx, [rbp + reloc.SHLWAPI.dll_SHRegGetIntW]
call fcn.180003300
mov rbx, qword [rbp + 0x100]
test rbx, rbx
je 0x180093eaf
mov rsi, qword [rbp + 0x108]
cmp rbx, rsi
je 0x180093148
nop dword [rax]
mov rcx, rbx
call fcn.1800390a0
add rbx, 0x20
cmp rbx, rsi
jne 0x180093130
mov rbx, qword [rbp + 0x100]
mov r8, qword [rbp + 0x110]
sub r8, rbx
sar r8, 5
mov rdx, rbx
lea rcx, [rbp + 0x100]
call fcn.1800508b0
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x100], xmm0
xor r14d, r14d
mov qword [rbp + 0x110], r14
jmp 0x180093eb2
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
mov r9d, 0x111
xor r8d, r8d
xor edx, edx
lea rcx, str.428_429_432_M
call fcn.180070ab0
mov edi, eax
add r14d, 0x40
cmp r14d, 0xd3
jb 0x1800930f0
cmp rsi, qword [r13 + 0x28]
jb 0x180093228
mov r14d, 0x25
cmp r14d, 0x25
je 0x1800931db
cmp r14d, 0x13cd
jne 0x180093218
mov rsi, qword [r13 + 0x18]
jmp 0x180093218
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x50]
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 0x2d]
call fcn.1800b9c10
test eax, eax
jne 0x180093218
mov eax, SHRegGetIntW
cmp eax, 0x116
je 0x18009352f
add eax, 0x1c
cmp eax, 0x132
jb 0x180093203
add r14d, 0x13a8
cmp r14d, 0x2750
jbe 0x1800931c6
inc r15d
cmp r15d, 0xbf
jb 0x1800930c0
jmp 0x180093512
mov r14d, 0xb6
mov dword [rsp + 0x68], r14d
mov r15d, 7
nop
cmp r15d, 7
ja case.default.0x18009326e
mov eax, r15d
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0x941b0]
add rcx, rdx
jmp rcx
movsxd rax, ebx
mov ecx, dword [rdx + rax*4 + 0x141b60]
mov dword [rsp + 0x48], ecx
mov ecx, dword [rdx + rax*4 + 0x141be0]
test ecx, ecx
je case.default.0x18009326e
mov dword [rsp + 0x70], ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x7e
xor r9d, r9d
mov r8, r13
lea rdx, [rsp + 0x70]
xor ecx, ecx
call fcn.18009f3c0
add dword [rsp + 0x48], eax
jmp case.default.0x18009326e
movsxd rax, ebx
mov r12d, dword [rdx + rax*4 + 0x141a60]
jmp case.default.0x18009326e
mov rcx, rsi
sub rcx, qword [r13 + 0x20]
movsxd rax, dword [rsp + 0x48]
cmp rcx, rax
jge 0x1800932f8
mov eax, 9
cmp eax, 9
je 0x180093536
add eax, 0xab
cmp eax, 0xb4
jb 0x1800932e3
movsxd rax, r12d
add rax, rsi
cmp rax, qword [r13 + 0x28]
jbe case.default.0x18009326e
mov r14d, 0x7b
nop
cmp r14d, 0x7b
jne 0x18009335f
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x50]
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 0x2d]
call fcn.1800b9c10
test eax, eax
jne 0x18009335b
mov ecx, 0x73
nop dword [rax + rax]
mov eax, ecx
sub eax, 0x73
je 0x180093352
cmp eax, 1
je case.0x180093cfd.8
jmp 0x180093354
xor edi, edi
inc ecx
cmp ecx, 0x75
jb 0x180093340
mov rsi, qword [r13 + 0x18]
add r14d, 0x2670
cmp r14d, 0x2670
jbe 0x180093310
mov r14d, dword [rsp + 0x68]
jmp case.default.0x18009326e
movsxd rdx, dword [rsp + 0x48]
mov rcx, rsi
sub rcx, rdx
cmp edx, 1
jne 0x1800933d0
mov eax, 0x9c
nop
cmp eax, 0x9c
je 0x1800933b0
cmp eax, 0x618
jne 0x1800933b7
movzx edx, byte [rsp + 0x40]
mov byte [rsi], dl
inc rsi
sub r12d, 1
jne 0x1800933a3
jmp 0x1800933b7
movzx edx, byte [rcx]
mov byte [rsp + 0x40], dl
add eax, 0x57c
cmp eax, 0xaf8
jbe 0x180093390
jmp case.default.0x18009326e
movzx eax, byte [rcx]
mov byte [rsi], al
inc rsi
lea rcx, [rcx + 1]
sub r12d, 1
jne 0x1800933d0
jmp case.default.0x18009326e
sub ebx, 0x101
jmp case.default.0x18009326e
test ebx, ebx
jns case.default.0x18009326e
mov r14d, 0xd3
mov eax, r14d
sub eax, 0xd3
je 0x180093415
cmp eax, 1
je case.0x180093cfd.8
jmp 0x18009343f
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
mov r9d, 0x111
xor r8d, r8d
xor edx, edx
lea rcx, str.slotCheckVCard__
call fcn.180070ab0
mov edi, eax
inc r14d
cmp r14d, 0xd5
jb 0x180093400
mov r14d, dword [rsp + 0x68]
jmp case.default.0x18009326e
cmp ebx, 0x100
jne case.default.0x18009326e
mov ecx, 0x10d
nop word [rax + rax]
mov eax, ecx
sub eax, 0x10c
je case.0x180093cfd.8
cmp eax, 1
jne 0x180093488
mov qword [r13 + 0x18], rsi
mov edi, eax
dec ecx
cmp ecx, 0x10b
ja 0x180093470
jmp case.default.0x18009326e
movsxd rax, ebx
mov ecx, dword [rdx + rax*4 + 0x141ae0]
test ecx, ecx
je 0x1800934cc
mov dword [rsp + 0x50], ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x7e
xor r9d, r9d
mov r8, r13
lea rdx, [rsp + 0x50]
xor ecx, ecx
call fcn.18009f3c0
add r12d, eax
lea rax, [r13 + 0x818]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, StrCmpNICA
call fcn.1800be6b0
mov ebx, eax
dec r14d
mov dword [rsp + 0x68], r14d
dec r15d
cmp r14d, 0xae
ja 0x180093250
mov eax, dword [rsp + 0x4c]
add eax, 0x1688
mov dword [rsp + 0x4c], eax
cmp eax, 0x1688
jbe 0x180093070
jmp 0x180093060
xor edi, edi
jmp case.0x180093cfd.8
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
mov r9d, 0x111
xor r8d, r8d
xor edx, edx
lea rcx, str.bad_dist
call fcn.180070ab0
mov edi, eax
jmp case.0x180093cfd.8
mov edi, dword [rsp + 0x4c]
jmp case.0x180093cfd.8
mov ebx, dword [rsp + 0x50]
mov dword [rsp + 0x68], ebx
jmp 0x180092fcb
mov eax, 0x6c
mov word [rbp + 0x2ae], ax
jmp case.0x180093050.202
mov dword [rbp + 0x2ab], 0x622e74
jmp case.0x180093050.202
mov word [rbp + 0x2af], r9w
mov dword [rbp + 0x2b0], 0x707367
jmp case.0x180093050.202
xor edx, edx
mov r9d, edx
mov dword [rsp + 0x70], edx
test r11d, r11d
jle 0x180093796
mov edi, dword [rsp + 0x78]
nop dword [rax + rax]
mov esi, edx
test ebx, ebx
jle 0x180093777
nop word [rax + rax]
mov r8d, 0xb7
nop word [rax + rax]
lea eax, [r8 - 0xb2]
cmp eax, 5
ja case.default.0x180093618
lea rcx, [0x180000000]
mov ecx, dword [rcx + rax*4 + 0x941d0]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov r9d, r13d
movsxd r10, dword [rbp - 0x60]
cmp r13d, r15d
jg 0x180093683
movsxd r11, edi
mov r8d, r13d
imul r8d, ebx
mov rdx, r11
cmp r11, r10
jg 0x1800936c5
nop dword [rax]
mov ecx, 0x21
cmp ecx, 0x21
jne 0x1800936ab
movsxd rax, r8d
add rax, rdx
mov qword [rsp + 0x78], rcx
mov rcx, qword [rsp + 0x60]
movss xmm0, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x78]
comiss xmm0, dword [r12]
jbe 0x1800936ab
mov eax, 0x127
cmp eax, 0x127
je 0x180093698
cmp eax, 0xdf8e
jne 0x18009369f
mov r11d, dword [rsp + 0x48]
mov r9d, dword [rsp + 0x70]
mov r10d, dword [rsp + 0x40]
mov r8d, 0xb4
jmp case.default.0x180093618
mov dword [r14], 0
add eax, 0xde67
cmp eax, 0x1bcce
jbe 0x180093670
add ecx, 0x2f7
cmp ecx, 0x2f7
jbe 0x180093645
inc rdx
cmp rdx, r10
jle 0x180093640
inc r9d
add r8d, ebx
cmp r9d, r15d
jle 0x180093630
jmp 0x18009367e
mov rax, qword [rbp - 0x70]
mov eax, dword [rax]
lea ecx, [rax + rsi]
lea r10d, [rbx - 1]
lea edx, [rax + r9]
lea r15d, [r11 - 1]
cmp r10d, ecx
cmovge r10d, ecx
mov dword [rbp - 0x60], r10d
cmp r15d, edx
cmovge r15d, edx
mov r10d, dword [rsp + 0x40]
jmp case.default.0x180093618
mov rax, qword [rbp - 0x80]
movss xmm0, dword [rax]
comiss xmm0, dword [r12]
jbe 0x18009371e
mov dword [r14], edx
mov r8d, 0xb4
jmp case.default.0x180093618
mov eax, esi
mov rcx, qword [rbp - 0x70]
sub eax, dword [rcx]
mov edi, edx
cmovns edi, eax
jmp case.default.0x180093618
mov eax, r9d
mov rcx, qword [rbp - 0x70]
sub eax, dword [rcx]
mov r13d, edx
cmovns r13d, eax
jmp case.default.0x180093618
mov r10d, 0xc8
mov dword [rsp + 0x40], r10d
jmp case.default.0x180093618
add r12, 4
add r14, 4
dec r8d
cmp r8d, 0xb1
mov edx, 0
ja 0x1800935f0
mov dword [rsp + 0x78], edi
inc esi
cmp esi, ebx
jl 0x1800935e0
inc r9d
mov dword [rsp + 0x70], r9d
cmp r9d, r11d
jl 0x1800935d0
mov edi, dword [rsp + 0x50]
mov esi, 0x746f
mov r8, qword [rsp + 0x58]
mov r9d, 0x6f
mov ecx, dword [rbp + 0x7c0]
dec r10d
mov dword [rsp + 0x40], r10d
lea eax, [rcx - 0xd]
cmp r10d, eax
jbe 0x180093a45
mov ebx, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
jmp 0x180093020
mov eax, 0x6d
mov word [rbp + 0x2b8], ax
lea rax, [0x180142dd8]
mov qword [rsp + 0x30], rax
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], SHTestTokenMembership
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180076f90
test al, al
jne 0x1800939db
xor edx, edx
mov esi, edx
cmp esi, 8
ja case.0x180093823.0
mov eax, esi
lea r8, [0x180000000]
mov ecx, dword [r8 + rax*4 + 0x941e8]
add rcx, r8
jmp rcx
cmp byte [rsp + 0x4c], 0
je case.0x180093823.0
mov ebx, 0xfb
mov eax, ebx
sub eax, 0xfb
je 0x18009384f
cmp eax, 0x37
jne 0x180093866
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
jmp 0x180093866
mov r8d, 0x104
lea rdx, [rbp + 0x2e0]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
add ebx, 0x37
cmp ebx, 0x169
jb 0x180093835
xor edx, edx
jmp case.0x180093823.0
mov qword [rbp - 0x78], 0xffffffffffffffff
jmp case.0x180093823.0
mov al, 1
mov dword [rsp + 0x4c], eax
jmp case.0x180093823.0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x4f0]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x2e0]
lea rax, [rbp + 0x4f0]
mov edx, 4
nop word [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x1800938c0
mov rax, qword [rax]
mov qword [rcx], rax
mov edx, 0x104
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov qword [rbp - 0x78], rax
xor edx, edx
jmp case.0x180093823.0
mov edi, 1
mov dword [rsp + 0x50], edi
jmp case.0x180093823.0
mov ecx, dword [rsp + 0x4c]
movzx ecx, cl
cmp qword [rbp - 0x78], 0xffffffffffffffff
cmove ecx, edx
mov dword [rsp + 0x4c], ecx
inc esi
lea eax, [rsi + 0xe8]
cmp eax, 0xf1
jb 0x180093806
mov r10d, dword [rsp + 0x40]
mov r11d, dword [rsp + 0x48]
jmp 0x18009378c
mov word [rbp + 0x2b3], si
jmp case.0x180093050.202
mov eax, 0x63
mov word [rbp + 0x2b6], ax
mov word [rbp + 0x2b7], r9w
jmp case.0x180093050.202
lea rax, [rbp + 0x2a0]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1800939a5
lea rdx, [rbp + 0x2a0]
lea rcx, [rbp + 0x1d0]
call fcn.180049be0
mov r8d, 1
lea rdx, [0x1800cbbc4]
lea rcx, [rbp + 0x1f0]
call fcn.180049be0
mov r10d, dword [rsp + 0x40]
mov r11d, dword [rsp + 0x48]
jmp 0x180093791
mov r12, rdx
mov r14, r8
jmp case.0x180093050.202
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov r10d, dword [rsp + 0x40]
mov r11d, dword [rsp + 0x48]
jmp 0x180093791
mov eax, 0x3632
mov word [rbp + 0x2a9], ax
jmp case.0x180093050.202
mov eax, PathMakeUniqueName
mov word [rbp + 0x2b5], ax
jmp case.0x180093050.202
mov eax, 0x1bb
mov word [rbp + 0x250], ax
jmp case.0x180093050.202
mov r15d, dword [rbp + 0x7c0]
mov ecx, 0x1bb
lea r14d, [r15 + 0x326]
cmp r15d, r14d
jae case.0x180093cfd.8
lea r13, [0x180142e58]
lea r12, [0x180011850]
lea rbx, [0x180142dd0]
mov rsi, qword [rbp - 0x80]
nop word [rax + rax]
cmp r15d, 0x279
ja 0x180093c1f
je 0x180093e6d
cmp r15d, 0x1bf
ja 0x180093b6c
je 0x180093b28
mov eax, r15d
sub eax, 0x105
je 0x180093b0c
sub eax, 0x3e
je 0x180093aee
cmp eax, 0x3e
jne 0x180093e98
mov word [rsp + 0x40], cx
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
lea r9, [0x180142e38]
lea r8, [rsp + 0x40]
mov edx, SHTestTokenMembership
lea rcx, [rbp + 0x70]
call fcn.18005a1c0
jmp 0x180093e98
mov r8d, 0x131
lea rdx, [rbp + 0x260]
lea rcx, [rbp + 0x1d0]
call fcn.18006c8f0
jmp 0x180093e98
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x210]
mov ecx, 0x122
call fcn.1800301b0
jmp 0x180093e98
mov word [rsp + 0x40], cx
mov dword [rsp + 0x28], 0x83
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [rbp + 0x40]
xor ecx, ecx
call fcn.180081f80
xor eax, eax
mov qword [rsp + 0x20], rax
mov r9d, 0xb0
lea r8, [rbp - 0x50]
xor edx, edx
xor ecx, ecx
call fcn.180025390
jmp 0x180093e98
mov eax, r15d
sub eax, 0x1fd
je 0x180093bb2
cmp eax, 0x3e
jne 0x180093e98
mov eax, dword [0x180142e80]
mov dword [rsp + 0x78], eax
xor eax, eax
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
xor edx, edx
xor ecx, ecx
mov r8d, 0xe7
call fcn.18001d9a0
jmp 0x180093e98
lea rax, [rbp + 0x70]
mov qword [rbp - 0x80], rax
mov rax, qword [rbp - 0x48]
cmp rax, qword [rbp - 0x40]
je 0x180093bd9
lea rcx, [rbp + 0x70]
mov qword [rax], rcx
mov rdx, qword [rbp - 0x48]
add rdx, 8
mov qword [rbp - 0x48], rdx
jmp 0x180093bee
lea r8, [rbp - 0x80]
mov rdx, qword [rbp - 0x48]
lea rcx, [rbp - 0x50]
call fcn.180001230
mov rdx, qword [rbp - 0x48]
lea rax, [rbp + 0x40]
mov qword [rbp - 0x80], rax
cmp rdx, qword [rbp - 0x40]
je 0x180093c0d
lea rax, [rbp + 0x40]
mov qword [rdx], rax
add qword [rbp - 0x48], 8
jmp 0x180093e98
lea r8, [rbp - 0x80]
lea rcx, [rbp - 0x50]
call fcn.180001230
jmp 0x180093e98
cmp r15d, 0x371
ja 0x180093e3c
je 0x180093e0c
mov eax, r15d
sub eax, 0x2b7
je 0x180093cb0
sub eax, 0x3e
je 0x180093ca2
cmp eax, 0x3e
jne 0x180093e98
mov qword [rbp - 0x80], r12
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x80]
mov ecx, 0xa2
call fcn.180008610
xor ecx, ecx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rbx
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor edx, edx
lea r8d, [rcx + 0x40]
lea rcx, [rbp - 0x50]
call fcn.18000d370
jmp 0x180093e98
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180093e98
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
lea r9, [rbp]
lea r8, [0x180029c50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
test rax, rax
jne 0x180093e98
xor edx, edx
mov ebx, edx
cmp ebx, 8
ja case.default.0x180093cfd
mov eax, ebx
lea r8, [0x180000000]
mov ecx, dword [r8 + rax*4 + 0x9420c]
add rcx, r8
jmp rcx
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0x4f0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x10]
lea r8, [rbp + 0x2a0]
xor edx, edx
lea rcx, [0x180122118]
call qword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
xor edx, edx
jmp case.default.0x180093cfd
mov edx, 0x104
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, 1
xor edx, edx
jmp case.default.0x180093cfd
mov r8d, 1
lea rdx, [0x18012ab28]
lea rcx, [rbp + 0x2b8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor edx, edx
mov word [rbp + 0x2ba], dx
jmp case.default.0x180093cfd
mov word [rbp + 0x2aa], dx
mov r8d, 2
lea rdx, [0x18012ab82]
lea rcx, [rbp + 0x2aa]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor edx, edx
jmp case.default.0x180093cfd
mov word [rbp + 0x2b8], dx
jmp case.default.0x180093cfd
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
jmp case.default.0x180093cfd
mov r8d, 5
lea rdx, str.wxID_SORT_DESCENDING
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor edx, edx
jmp case.default.0x180093cfd
movsd xmm0, qword [0x18012abe2]
movsd qword [rbp + 0x2ae], xmm0
movzx eax, word [0x18012abea]
mov word [rbp + 0x2b6], ax
inc ebx
lea eax, [rbx + 0x1a]
cmp eax, 0x23
jb 0x180093ce0
lea rbx, [0x180142dd0]
jmp 0x180093e98
xor eax, eax
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0xa0]
lea ecx, [rax + 0x6c]
call fcn.1800b22c0
mov edx, 1
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.SHLWAPI.dll_PathBuildRootW]
jmp 0x180093e98
mov eax, r15d
sub eax, 0x3af
je 0x180093e92
cmp eax, 0x3e
jne 0x180093e98
mov ecx, 0x18
mov eax, ecx
sub eax, 0x18
je 0x180093e62
cmp eax, 1
je case.0x180093cfd.8
jmp 0x180093e66
xor eax, eax
mov edi, eax
inc ecx
cmp ecx, 0x1a
jb 0x180093e50
lea rax, [rbp - 0x50]
mov qword [rbp - 0x70], rax
mov eax, dword [0x180142e80]
mov dword [rbp - 0x68], eax
mov eax, dword [0x180142e84]
mov dword [rbp - 0x64], eax
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp], xmm0
jmp 0x180093e98
call qword [sym.imp.SHELL32.dll_SHLoadNonloadedIconOverlayIdentifiers]
add r15d, 0x3e
cmp r15d, r14d
jae case.0x180093cfd.8
mov ecx, 0x1bb
jmp 0x180093a80
xor r14d, r14d
mov rdx, qword [rbp + 0xe8]
test rdx, rdx
je 0x180093eea
mov r8, qword [rbp + 0xf8]
sub r8, rdx
sar r8, 4
lea rcx, [rbp + 0xe8]
call fcn.180050810
mov qword [rbp + 0xe8], r14
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xf0], xmm0
lea rcx, [rbp + 0xa8]
call fcn.180003230
nop
mov rbx, qword [rbp - 0x38]
test rbx, rbx
je 0x180093f8b
mov rsi, qword [rbp - 0x30]
cmp rbx, rsi
je 0x180093f25
nop dword [rax]
mov rcx, rbx
call fcn.180002af0
add rbx, 0x28
cmp rbx, rsi
jne 0x180093f10
mov rbx, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x28]
sub rcx, rbx
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rax, rbx
cmp rdx, 0x1000
jb 0x180093f77
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180093f77
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1800c9704
mov qword [rbp - 0x38], r14
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
mov rdx, qword [rbp - 0x50]
test rdx, rdx
je 0x180093fb4
mov r8, qword [rbp - 0x40]
sub r8, rdx
sar r8, 3
lea rcx, [rbp - 0x50]
call fcn.1800507c0
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r14
mov rdx, qword [rbp + 0x62]
cmp rdx, 0x10
jb 0x180093ff2
inc rdx
mov rcx, qword [rbp + 0x4a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180093fed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180093fed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800c9704
movdqa xmm0, xmmword [0x180138af0]
movdqu xmmword [rbp + 0x5a], xmm0
mov byte [rbp + 0x4a], 0
mov rdx, qword [rbp + 0x92]
cmp rdx, 0x10
jb 0x180094044
inc rdx
mov rcx, qword [rbp + 0x7a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009403f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18009403f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800c9704
movdqa xmm0, xmmword [0x180138af0]
movdqu xmmword [rbp + 0x8a], xmm0
mov byte [rbp + 0x7a], 0
lea rcx, [rbp + 0x260]
call fcn.180002e50
nop
lea rcx, [rbp + 0x1d0]
call fcn.180002f00
mov eax, edi
mov rcx, qword [rbp + 0x700]
xor rcx, rsp
call fcn.1800c9c10
lea r11, [rsp + 0x860]
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret