Function at 0x18005b660
Capabilities:
Execute command
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
movss xmm1, dword [0x1803d348c]
xor ecx, ecx
call fcn.180068ae0
mov rcx, qword [0x18039d780]
lea rdx, [rbp + 0x67]
mov dword [rbp + 0x67], 0x43870000
mov dword [rbp + 0x6b], 0x43a00000
mov rax, qword [rcx + 0x3eb0]
mov byte [rax + 0xb0], 1
mov rax, qword [rcx + 0x3eb0]
lea rcx, [0x18023c7fb]
movss xmm1, dword [rax + 0x18]
movss xmm0, dword [rax + 0x1c]
subss xmm1, dword [rax + 0x7c]
subss xmm0, dword [rax + 0x80]
mov byte [rax + 0x13d], 1
addss xmm1, dword [0x180243170]
addss xmm0, dword [0x180243180]
movss dword [rax + 0xf8], xmm1
movss dword [rax + 0xfc], xmm0
call fcn.180070770
movzx eax, word [0x180240fe0]
lea rdx, [rbp - 0x29]
xorps xmm0, xmm0
mov word [rbp - 1], ax
movzx eax, byte [0x180240fe2]
lea rcx, [rbp - 9]
xor r14d, r14d
mov byte [rbp + 1], al
movdqu xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], r14
movsd xmm0, qword [str.C:_Dast.tt_]
movsd qword [rbp - 9], xmm0
mov dword [rbp + 3], r14d
mov qword [rbp + 7], 0xb
mov qword [rbp + 0xf], 0xf
mov byte [rbp + 2], r14b
call fcn.180049790
mov rdx, qword [rbp + 0xf]
cmp rdx, 0x10
jb 0x18005b79c
mov rcx, qword [rbp - 9]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005b797
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005b9ad
call fcn.18010addc
lea rdx, [rbp - 0x49]
call fcn.180049bd0
mov r15, qword [rbp - 0x49]
lea r13, [0x18039b9a0]
mov r12, qword [rbp - 0x41]
mov rsi, r15
cmp r15, r12
je 0x18005b928
cmp qword [rsi + 0x18], 0x10
xorps xmm0, xmm0
mov rdi, qword [rsi + 0x10]
mov ecx, 0x16
mov qword [rbp + 7], r14
movabs rax, 0x7fffffffffffffff
mov qword [rbp + 0xf], r14
mov r14, rsi
movups xmmword [rbp - 9], xmm0
jb 0x18005b7ef
mov r14, qword [rsi]
cmp rdi, rax
ja 0x18005c1da
cmp rdi, 0x10
jae 0x18005b815
mov ebx, 0xf
mov qword [rbp + 7], rdi
mov qword [rbp + 0xf], rbx
movups xmm0, xmmword [r14]
movups xmmword [rbp - 9], xmm0
jmp 0x18005b862
mov rbx, rdi
mov qword [rbp + 0xf], 0xf
or rbx, 0xf
cmp rbx, rax
jbe 0x18005b82e
mov rbx, rax
jmp 0x18005b836
cmp rbx, 0x16
cmovb rbx, rcx
lea rdx, [rbx + 1]
call fcn.180008500
lea r8, [rdi + 1]
mov qword [rbp - 9], rax
mov rdx, r14
mov qword [rbp + 7], rdi
mov rcx, rax
mov qword [rbp + 0xf], rbx
call sub.VCRUNTIME140.dll_memcpy
mov rbx, qword [rbp + 0xf]
mov rdi, qword [rbp + 7]
cmp qword [0x18039b9b8], 0x10
lea rcx, [rbp - 9]
mov r14, qword [rbp - 9]
mov rdx, r13
cmovae rdx, qword [0x18039b9a0]
cmp rbx, 0x10
mov qword [rbp + 0x67], 0
cmovae rcx, r14
cmp rdi, qword [0x18039b9b0]
jne 0x18005b8a6
mov r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x18005b8a6
mov dl, 1
jmp 0x18005b8a8
xor edx, edx
cmp rbx, 0x10
lea rcx, [rbp - 9]
lea r9, [rbp + 0x67]
cmovae rcx, r14
call fcn.1800974d0
test al, al
je 0x18005b8db
cmp qword [rbp + 0xf], 0x10
lea rdx, [rbp - 9]
mov r8, qword [rbp + 7]
mov rcx, r13
cmovae rdx, qword [rbp - 9]
call fcn.18005f8a0
mov rdx, qword [rbp + 0xf]
cmp rdx, 0x10
jb 0x18005b912
mov rcx, qword [rbp - 9]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005b90d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005b921
call fcn.18010addc
add rsi, 0x20
xor r14d, r14d
cmp rsi, r12
jmp 0x18005b7ba
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test r15, r15
je 0x18005b96c
mov rdx, r12
mov rcx, r15
call fcn.180061000
mov rdx, qword [rbp - 0x39]
mov rax, r15
sub rdx, r15
and rdx, 0xffffffffffffffe0
cmp rdx, 0x1000
jb 0x18005b964
mov r15, qword [r15 - 8]
add rdx, 0x27
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005b9ad
mov rcx, r15
call fcn.18010addc
mov rbx, qword [rbp - 0x29]
test rbx, rbx
je 0x18005b9bc
mov rdx, qword [rbp - 0x21]
mov rcx, rbx
call fcn.180061000
mov rdx, qword [rbp - 0x19]
mov rax, rbx
sub rdx, rbx
and rdx, 0xffffffffffffffe0
cmp rdx, 0x1000
jb 0x18005b9b4
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18005b9b4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.18010addc
call fcn.180070810
mov r10, qword [0x18039d780]
mov rcx, qword [r10 + 0x3eb0]
cmp byte [rcx + 0xb3], 0
jne 0x18005ba23
movss xmm0, dword [rcx + 0x104]
movss xmm1, dword [rcx + 0x100]
addss xmm1, dword [0x1802430e0]
movss dword [rcx + 0xf8], xmm1
movss dword [rcx + 0xfc], xmm0
movsd xmm0, qword [rcx + 0x128]
mov eax, dword [rcx + 0x138]
movsd qword [rcx + 0x120], xmm0
mov dword [rcx + 0x134], eax
mov byte [rcx + 0x13c], 1
mov rax, qword [r10 + 0x3eb0]
lea r8, [0x18023e859]
mov dword [rbp + 0x67], 0x43898000
lea r11, [0x1802380a0]
mov dword [rbp + 0x6b], 0x43a00000
mov dl, 0x20
mov byte [rax + 0xb0], 1
mov rax, qword [r10 + 0x3eb0]
movsxd rcx, dword [rax + 0xe8]
mov rax, qword [rax + 0xf0]
mov r9d, dword [rax + rcx*4 - 4]
not r9d
mov ebx, r9d
nop
cmp dl, 0x23
jne 0x18005ba82
cmp byte [r8], dl
jne 0x18005ba82
cmp byte [r8 + 1], dl
cmove ebx, r9d
movzx ecx, bl
movzx eax, dl
movzx edx, byte [r8]
xor rcx, rax
shr ebx, 8
inc r8
xor ebx, dword [r11 + rcx*4]
test dl, dl
jne 0x18005ba70
not ebx
cmp dword [r10 + 0x3ef8], ebx
jne 0x18005babb
lea r8, [0x18023e858]
mov edx, 0xb
mov ecx, ebx
call fcn.18007de00
lea r8, [rbp + 0x67]
mov dword [rsp + 0x20], r14d
mov edx, ebx
lea rcx, [0x18023e858]
call fcn.18006f5d0
mov rcx, qword [0x18039d780]
mov rax, qword [rcx + 0x3eb0]
mov byte [rax + 0xb0], 1
mov rax, qword [rcx + 0x3eb0]
cmp byte [rax + 0xb3], 0
jne 0x18005bb10
movss xmm1, dword [0x18024327c]
lea rcx, [rbp + 0x67]
mov qword [rbp + 0x67], 0
call fcn.180076ac0
cmp byte [0x18039d7df], 0
lea rdi, [0x180241008]
lea rbx, str.Apply
mov qword [rbp + 0x67], 0
lea rdx, [rbp + 0x67]
jne 0x18005bb65
cmp byte [0x18039d4d3], 0
lea rax, [0x180240fe8]
lea rcx, str.Save
cmovne rcx, rax
call fcn.18008b110
test al, al
je 0x18005bc1c
mov byte [0x18039d7df], 1
jmp 0x18005bc1c
cmp byte [0x18039d4d3], 0
mov rcx, rbx
cmovne rcx, rdi
call fcn.18008b110
test al, al
je 0x18005bc1c
mov rdx, r13
lea rcx, [rbp + 0x17]
call fcn.18005f2f0
mov rcx, rax
call fcn.180022f60
mov eax, dword [str.Saved]
lea r9, [rbp - 0x49]
movdqa xmm1, xmmword [0x1802433f0]
lea r8, [rbp - 0x29]
movaps xmm3, xmmword [0x180243760]
lea rdx, [rbp - 9]
movaps xmm2, xmmword [0x180243700]
lea rcx, [rbp + 0x17]
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x49], xmm3
movups xmmword [rbp - 9], xmm0
mov dword [rbp - 9], eax
movzx eax, byte [0x180241028]
movups xmmword [rbp + 0x17], xmm0
mov byte [rbp - 5], al
mov eax, dword [str.Config]
mov dword [rbp + 0x17], eax
movzx eax, word [0x18023f810]
movdqu xmmword [rbp + 7], xmm1
mov word [rbp + 0x1b], ax
movdqa xmm1, xmmword [0x180243400]
mov byte [rbp - 4], 0
movdqu xmmword [rbp + 0x27], xmm1
mov byte [rbp + 0x1d], 0
movdqa xmmword [rbp - 0x29], xmm2
call fcn.180028a40
mov byte [0x18039d7df], 0
mov rax, qword [0x18039d780]
mov rcx, qword [rax + 0x3eb0]
cmp byte [rcx + 0xb3], 0
jne 0x18005bc7e
movss xmm1, dword [rax + 0x382c]
movss xmm0, dword [rcx + 0x104]
addss xmm1, dword [rcx + 0x100]
movss dword [rcx + 0xf8], xmm1
movss dword [rcx + 0xfc], xmm0
movsd xmm0, qword [rcx + 0x128]
mov eax, dword [rcx + 0x138]
movsd qword [rcx + 0x120], xmm0
mov dword [rcx + 0x134], eax
mov byte [rcx + 0x13c], 1
cmp byte [0x18039e83c], 0
lea rdx, [rbp + 0x67]
mov qword [rbp + 0x67], 0
jne 0x18005bcc5
cmp byte [0x18039d4d3], 0
lea rax, [0x180241030]
lea rcx, str.Load
cmovne rcx, rax
call fcn.18008b110
test al, al
je 0x18005bd75
mov byte [0x18039e83c], 1
jmp 0x18005bd75
cmp byte [0x18039d4d3], 0
mov rcx, rbx
cmovne rcx, rdi
call fcn.18008b110
test al, al
je 0x18005bd75
mov rdx, r13
lea rcx, [rbp + 0x17]
call fcn.18005f2f0
mov rcx, rax
call fcn.1800258e0
mov eax, dword [str.Loaded]
lea r9, [rbp - 0x29]
movdqa xmm1, xmmword [0x180243400]
lea r8, [rbp - 0x49]
movaps xmm3, xmmword [0x180243760]
lea rdx, [rbp + 0x17]
movaps xmm2, xmmword [0x180243700]
lea rcx, [rbp - 9]
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x29], xmm3
movups xmmword [rbp + 0x17], xmm0
mov dword [rbp + 0x17], eax
movzx eax, word [0x180241050]
movups xmmword [rbp - 9], xmm0
mov word [rbp + 0x1b], ax
mov eax, dword [str.Config]
mov dword [rbp - 9], eax
movzx eax, word [0x18023f810]
mov word [rbp - 5], ax
movdqu xmmword [rbp + 0x27], xmm1
mov byte [rbp + 0x1d], 0
movdqu xmmword [rbp + 7], xmm1
mov byte [rbp - 3], 0
movdqa xmmword [rbp - 0x49], xmm2
call fcn.180028a40
mov byte [0x18039e83c], 0
mov rax, qword [0x18039d780]
mov rcx, qword [rax + 0x3eb0]
cmp byte [rcx + 0xb3], 0
jne 0x18005bdd7
movss xmm1, dword [rax + 0x382c]
movss xmm0, dword [rcx + 0x104]
addss xmm1, dword [rcx + 0x100]
movss dword [rcx + 0xf8], xmm1
movss dword [rcx + 0xfc], xmm0
movsd xmm0, qword [rcx + 0x128]
mov eax, dword [rcx + 0x138]
movsd qword [rcx + 0x120], xmm0
mov dword [rcx + 0x134], eax
mov byte [rcx + 0x13c], 1
cmp byte [0x18039d6e2], 0
lea rdx, [rbp + 0x67]
mov qword [rbp + 0x67], 0
jne 0x18005be1e
cmp byte [0x18039d4d3], 0
lea rax, [0x180241058]
lea rcx, str.Remove
cmovne rcx, rax
call fcn.18008b110
test al, al
je 0x18005bee9
mov byte [0x18039d6e2], 1
jmp 0x18005bee9
cmp byte [0x18039d4d3], 0
cmovne rbx, rdi
mov rcx, rbx
call fcn.18008b110
test al, al
je 0x18005bee9
cmp qword [0x18039b9b8], 0x10
cmovae r13, qword [0x18039b9a0]
mov rdx, r13
call fcn.18004a5d0
mov rax, qword [str.Removed]
lea r9, [rbp - 0x29]
movdqa xmm0, xmmword [0x1802433b0]
lea r8, [rbp - 0x49]
movaps xmm3, xmmword [0x180243760]
lea rdx, [rbp - 9]
movaps xmm2, xmmword [0x180243700]
lea rcx, [rbp + 0x17]
movdqa xmm1, xmmword [0x180243400]
mov dword [rbp - 9], eax
movzx eax, word [0x180241074]
mov word [rbp - 5], ax
movzx eax, byte [0x180241076]
mov byte [rbp - 3], al
mov eax, dword [str.Config]
movdqu xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], 0xf
xorps xmm0, xmm0
mov byte [rbp - 2], 0
movups xmmword [rbp + 0x17], xmm0
mov dword [rbp + 0x17], eax
movzx eax, word [0x18023f810]
mov word [rbp + 0x1b], ax
movdqu xmmword [rbp + 0x27], xmm1
mov byte [rbp + 0x1d], 0
movdqa xmmword [rbp - 0x29], xmm3
movdqa xmmword [rbp - 0x49], xmm2
call fcn.180028a40
mov byte [0x18039d6e2], 0
mov rax, qword [0x18039d780]
mov rcx, qword [rax + 0x3eb0]
cmp byte [rcx + 0xb3], 0
jne 0x18005bf4b
movss xmm1, dword [rax + 0x382c]
movss xmm0, dword [rcx + 0x104]
addss xmm1, dword [rcx + 0x100]
movss dword [rcx + 0xf8], xmm1
movss dword [rcx + 0xfc], xmm0
movsd xmm0, qword [rcx + 0x128]
mov eax, dword [rcx + 0x138]
movsd qword [rcx + 0x120], xmm0
mov dword [rcx + 0x134], eax
mov byte [rcx + 0x13c], 1
cmp byte [0x18039d4d3], 0
lea rax, [0x180241078]
lea rcx, str.Create
mov qword [rbp + 0x67], 0
cmovne rcx, rax
lea rdx, [rbp + 0x67]
call fcn.18008b110
test al, al
je 0x18005bf82
mov byte [0x18039d4d5], 1
jmp 0x18005bf8f
cmp byte [0x18039d4d5], 0
je 0x18005c0cc
mov qword [rsp + 0x38], r14
lea rax, [rbp + 0x67]
mov qword [rsp + 0x30], r14
lea rbx, [0x1802caaf0]
mov dword [rsp + 0x28], r14d
lea rcx, [0x18023c7fb]
mov r8, rbx
mov qword [rsp + 0x20], rax
mov r9d, pe_nt_image_headers64
mov qword [rbp + 0x67], 0
xor edx, edx
call fcn.180090540
cmp byte [0x18039d4d3], 0
lea rax, [0x180241090]
lea rcx, str.Accept
mov qword [rbp + 0x67], 0
cmovne rcx, rax
lea rdx, [rbp + 0x67]
call fcn.18008b110
test al, al
je 0x18005c0cc
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 0x17], xmm0
mov r8, 0xffffffffffffffff
movdqu xmmword [rbp + 0x27], xmm1
inc r8
cmp byte [rbx + r8], 0
jne 0x18005c015
mov rdx, rbx
lea rcx, [rbp + 0x17]
call fcn.180008440
lea rcx, [rbp + 0x17]
call fcn.180022f60
mov rax, qword [str.Created]
lea r9, [rbp - 0x29]
movdqa xmm0, xmmword [0x1802433b0]
lea r8, [rbp - 0x49]
movaps xmm3, xmmword [0x180243760]
lea rdx, [rbp - 9]
movaps xmm2, xmmword [0x180243700]
lea rcx, [rbp + 0x17]
movdqa xmm1, xmmword [0x180243400]
mov dword [rbp - 9], eax
movzx eax, word [0x1802410b4]
mov word [rbp - 5], ax
movzx eax, byte [0x1802410b6]
mov byte [rbp - 3], al
mov eax, dword [str.Config]
movdqu xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], 0xf
xorps xmm0, xmm0
mov byte [rbp - 2], 0
movups xmmword [rbp + 0x17], xmm0
mov dword [rbp + 0x17], eax
movzx eax, word [0x18023f810]
mov word [rbp + 0x1b], ax
movdqu xmmword [rbp + 0x27], xmm1
mov byte [rbp + 0x1d], 0
movdqa xmmword [rbp - 0x29], xmm3
movdqa xmmword [rbp - 0x49], xmm2
call fcn.180028a40
mov byte [0x18039d4d5], 0
cmp byte [0x18039d4d3], 0
lea rax, [0x1802410b8]
lea rcx, str.Open_Folder
mov qword [rbp + 0x67], 0
cmovne rcx, rax
lea rdx, [rbp + 0x67]
call fcn.18008b110
test al, al
je 0x18005c107
lea rcx, str.start_C:Dast.tt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp byte [0x18039d4d3], 0
lea rax, [0x1802410f8]
lea rcx, str.Watermark
cmovne rcx, rax
lea rdx, [0x18027a97e]
call fcn.180055790
cmp byte [0x18039d4d3], 0
lea rax, [0x180241120]
lea rcx, str.Unload_Cheat
mov qword [rbp + 0x67], 0
cmovne rcx, rax
lea rdx, [rbp + 0x67]
call fcn.18008b110
test al, al
je 0x18005c1ab
mov ecx, 0xbb8
mov byte [0x18039d679], 0
mov byte [0x18039d695], 0
mov byte [0x18039d690], 0
mov dword [0x18039d66c], 0x3f800000
mov dword [0x1802caaac], 0
mov dword [0x1802caa7c], 0x3f800000
mov byte [0x18039d669], 1
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.180008210
mov byte [0x18039d5e4], 1
call fcn.180070810
mov ecx, 1
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp fcn.180068b60
call fcn.180008030
int3