Function at 0x180001a3d
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get common file path
Link many functions at runtime

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x178
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], 0xfffffffffffffffe
cmp edx, 1
jne 0x180002539
xorps xmm0, xmm0
movaps xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], 0
mov qword [rbp - 0x48], 7
lea rcx, section..rdata
lea r9, [rbp + 0xd0]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rdi, qword [rbp + 0xd0]
mov rcx, rdi
call sub.msvcrt.dll_wcslen
mov rsi, rax
mov r14, qword [rbp - 0x48]
movabs r12, 0x7fffffffffffffff
cmp r14, rax
jae 0x180001b56
cmp rsi, r12
jae 0x180002557
mov rax, rsi
or rax, 7
movabs rdx, 0x7ffffffffffffffe
cmp rax, rdx
ja 0x180001b01
mov rcx, r14
shr rcx, 1
mov r8, rdx
sub r8, rcx
cmp r8, r14
jb 0x180001b01
add rcx, r14
cmp rax, rcx
cmova rcx, rax
mov rdx, rcx
lea rcx, [rbp + 0xb0]
mov qword [rcx], rdx
call fcn.18000131e
mov rbx, rax
mov qword [rbp - 0x50], rsi
mov rax, qword [rbp + 0xb0]
mov qword [rbp - 0x48], rax
mov r8, rsi
add r8, rsi
mov rcx, rbx
mov rdx, rdi
call sub.msvcrt.dll_memcpy
mov word [rbx + rsi*2], 0
cmp r14, 8
jb 0x180001b50
mov rcx, qword [rbp - 0x60]
lea rdx, [r14*2 + 2]
call fcn.1800012b5
mov qword [rbp - 0x60], rbx
jmp 0x180001b81
cmp r14, 8
jb 0x180001b62
mov rbx, qword [rbp - 0x60]
jmp 0x180001b66
lea rbx, [rbp - 0x60]
mov qword [rbp - 0x50], rsi
mov r8, rsi
add r8, rsi
mov rcx, rbx
mov rdx, rdi
call sub.msvcrt.dll_memmove
mov word [rbx + rsi*2], 0
mov rcx, qword [rbp + 0xd0]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rbx, qword [rbp - 0x50]
mov r14, qword [rbp - 0x48]
mov rax, r14
sub rax, rbx
cmp rax, 0xc
jae 0x180001c66
movabs rax, 0x800000000000000d
add rax, rbx
cmp rax, 0xb
jbe 0x18000255c
lea rsi, [rbx + 0xc]
mov rax, rsi
or rax, 7
movabs rdx, 0x7ffffffffffffffe
cmp rax, rdx
ja 0x180001bf5
mov rcx, r14
shr rcx, 1
mov r8, rdx
sub r8, rcx
cmp r8, r14
jb 0x180001bf5
add rcx, r14
cmp rax, rcx
cmova rcx, rax
mov rdx, rcx
lea rcx, [rbp + 0xb0]
mov qword [rcx], rdx
call fcn.18000131e
mov rdi, rax
mov qword [rbp - 0x50], rsi
mov rax, qword [rbp + 0xb0]
mov qword [rbp - 0x48], rax
cmp r14, 8
jb 0x180001ca5
mov rsi, qword [rbp - 0x60]
lea r8, [rbx + rbx]
mov rcx, rdi
mov rdx, rsi
call sub.msvcrt.dll_memcpy
movabs rax, 0x6c006c0064002e
mov qword [rdi + rbx*2 + 0x10], rax
movups xmm0, xmmword [str._version.dll]
movups xmmword [rdi + rbx*2], xmm0
mov word [rdi + rbx*2 + 0x18], 0
lea rdx, [r14*2 + 2]
mov rcx, rsi
call fcn.1800012b5
jmp 0x180001cd6
lea rax, [rbx + 0xc]
mov qword [rbp - 0x50], rax
cmp r14, 8
jb 0x180001c7a
mov rax, qword [rbp - 0x60]
jmp 0x180001c7e
lea rax, [rbp - 0x60]
movups xmm0, xmmword [str._version.dll]
movups xmmword [rax + rbx*2], xmm0
movabs rcx, 0x6c006c0064002e
mov qword [rax + rbx*2 + 0x10], rcx
mov word [rax + rbx*2 + 0x18], 0
mov rdi, qword [rbp - 0x60]
jmp 0x180001cda
lea r8, [rbx + rbx]
lea rdx, [rbp - 0x60]
mov rcx, rdi
call sub.msvcrt.dll_memcpy
movabs rax, 0x6c006c0064002e
mov qword [rdi + rbx*2 + 0x10], rax
movups xmm0, xmmword [str._version.dll]
movups xmmword [rdi + rbx*2], xmm0
mov word [rdi + rbx*2 + 0x18], 0
mov qword [rbp - 0x60], rdi
lea rsi, [rbp - 0x60]
cmp qword [rsi + 0x18], 8
cmovb rdi, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
lea rdx, [0x1800062ac]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180009978], rax
lea rdx, [0x1800061c0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180009980], rax
lea rdx, [0x18000627c]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180009988], rax
lea rdx, [0x1800061e3]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180009990], rax
lea rdx, [0x1800062c0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180009998], rax
lea rdx, [0x180006292]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800099a0], rax
lea rdx, [0x1800061f9]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800099a8], rax
lea rdx, [0x180006227]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800099b0], rax
lea rdx, [0x180006213]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800099b8], rax
lea rdx, [0x180006308]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800099c0], rax
lea rdx, [0x18000626f]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800099c8], rax
lea rdx, [0x1800062f8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800099d0], rax
lea rdx, [0x18000625f]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800099d8], rax
lea rdx, [0x1800062e7]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800099e0], rax
lea rdx, [0x18000624e]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800099e8], rax
lea rdx, [0x1800062d8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800099f0], rax
lea rdx, [0x18000623f]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800099f8], rax
mov rax, qword [rbp - 0x48]
cmp rax, 8
jb 0x180001e95
mov rcx, qword [rbp - 0x60]
lea rdx, [rax*2 + 2]
call fcn.1800012b5
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
mov rdx, rsi
mov r8d, 0x100
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rcx, rsi
call sub.msvcrt.dll_strlen
lea rbx, [rbp + 0xd0]
mov qword [rbx], rsi
mov qword [rbx + 8], rax
call fcn.180002cf0
lea rdi, [rbp + 0xb0]
mov rcx, rdi
mov edx, eax
mov r8, rbx
call fcn.180001066
lea rax, str.MuseDash.exe
mov qword [rbx], rax
mov qword [rbx + 8], 0xc
call fcn.180002cf0
lea r15, [rbp - 0x60]
lea r14, [rbp + 0xd0]
mov rcx, r15
mov edx, eax
mov r8, r14
call fcn.180001066
mov rax, qword [rbp + 0xc0]
cmp qword [rbp + 0xc8], 8
jb 0x180001f25
mov rdi, qword [rbp + 0xb0]
lea rsi, [rdi + rax*2]
mov rcx, rdi
mov rdx, rsi
call fcn.180002643
mov rdi, rsi
cmp rax, rsi
je 0x180001f58
mov rdi, rax
movzx eax, word [rdi]
cmp eax, 0x5c
je 0x180001f4c
cmp eax, 0x2f
jne 0x180001f58
add rdi, 2
cmp rdi, rsi
jne 0x180001f3f
mov rdi, rsi
mov rax, rsi
cmp rax, rdi
je 0x180001f79
movzx ecx, word [rax - 2]
add rax, 0xfffffffffffffffe
cmp ecx, 0x5c
je 0x180001f72
cmp ecx, 0x2f
jne 0x180001f5b
add rax, 2
mov rdi, rax
sub rsi, rdi
mov r13, rsi
sar r13, 1
xorps xmm0, xmm0
movaps xmmword [rbp + 0xe0], xmm0
movaps xmmword [rbp + 0xd0], xmm0
cmp r13, r12
jae 0x180002552
cmp r13, 7
ja 0x180001fcd
lea rcx, [rbp + 0xd0]
mov qword [rcx + 0x10], r13
mov qword [rcx + 0x18], 7
mov rdx, rdi
mov r8, rsi
call sub.msvcrt.dll_memcpy
mov word [rbp + r13*2 + 0xd0], 0
jmp 0x180002034
mov rax, r13
or rax, 7
cmp rax, 0xb
mov edx, 0xa
cmovae rdx, rax
movabs rax, 0x7ffffffffffffffe
cmp rdx, rax
cmovae rdx, rax
lea rcx, [rbp + 0xa0]
mov qword [rcx], rdx
call fcn.18000131e
mov rbx, rax
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xe0], r13
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0xe8], rax
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call sub.msvcrt.dll_memcpy
mov word [rbx + rsi], 0
mov rbx, qword [rbp - 0x50]
mov r13, qword [rbp - 0x48]
cmp r13, 8
jb 0x180002046
mov r15, qword [rbp - 0x60]
mov rsi, qword [rbp + 0xe8]
cmp rsi, 8
mov rcx, qword [rbp + 0xd0]
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0xa8], rcx
cmovae r14, rcx
lea rdi, [r14 + rax*2]
mov rcx, r14
mov rdx, rdi
call fcn.180002643
mov r12, rax
lea rbx, [r15 + rbx*2]
mov rcx, r15
mov rdx, rbx
call fcn.180002643
mov rcx, rax
sub rcx, r15
sar rcx, 1
mov rdx, r12
sub rdx, r14
sar rdx, 1
cmp rcx, rdx
mov r8, rdx
cmovb r8, rcx
test r8, r8
je 0x1800020c7
xor r9d, r9d
movzx r10d, word [r14 + r9*2]
cmp r10w, word [r15 + r9*2]
jne 0x1800021e8
inc r9
cmp r8, r9
jne 0x1800020af
cmp rcx, rdx
jne 0x1800021e8
mov rdx, rdi
cmp r12, rdi
je 0x1800020f4
mov rdx, r12
movzx ecx, word [rdx]
cmp ecx, 0x5c
je 0x1800020e8
cmp ecx, 0x2f
jne 0x1800020f4
add rdx, 2
cmp rdx, rdi
jne 0x1800020db
mov rdx, rdi
mov rcx, rbx
cmp rax, rbx
je 0x18000211b
mov rcx, rax
movzx r8d, word [rcx]
cmp r8d, 0x5c
je 0x18000210f
cmp r8d, 0x2f
jne 0x18000211b
add rcx, 2
cmp rcx, rbx
jne 0x1800020ff
mov rcx, rbx
cmp rax, rcx
setne al
cmp r12, rdx
sete r8b
cmp al, r8b
je 0x1800021e8
cmp rcx, rbx
sete al
cmp rdx, rdi
sete r14b
je 0x1800022fa
cmp rcx, rbx
je 0x1800022fa
movzx eax, word [rdx]
cmp eax, 0x2f
sete r8b
cmp eax, 0x5c
sete r9b
or r9b, r8b
movzx r8d, word [rcx]
cmp r8w, 0x5c
sete r10b
cmp r8w, 0x2f
sete r11b
or r11b, r10b
cmp r11b, r9b
jne 0x1800021e8
cmp eax, 0x5c
je 0x180002189
cmp eax, 0x2f
jne 0x1800021b0
add rdx, 2
mov rax, rdi
cmp rdx, rdi
je 0x1800021c6
movzx eax, word [rdx]
cmp eax, 0x5c
je 0x1800021a2
cmp eax, 0x2f
jne 0x1800021c3
add rdx, 2
cmp rdx, rdi
jne 0x180002195
mov rax, rdi
jmp 0x1800021c6
cmp ax, r8w
jne 0x1800021e8
add rdx, 2
add rcx, 2
jmp 0x180002131
mov rax, rdx
add rcx, 2
cmp rcx, rbx
je 0x1800022f1
movzx edx, word [rcx]
cmp edx, 0x5c
je 0x1800021c6
cmp edx, 0x2f
je 0x1800021c6
mov rdx, rax
jmp 0x180002131
xor r14d, r14d
cmp rsi, 8
jb 0x180002209
lea rdx, [rsi*2 + 2]
mov rcx, qword [rbp + 0xa8]
call fcn.1800012b5
mov r13, qword [rbp - 0x48]
cmp r13, 8
jb 0x180002220
mov rcx, qword [rbp - 0x60]
lea rdx, [r13*2 + 2]
call fcn.1800012b5
mov rax, qword [rbp + 0xc8]
cmp rax, 8
jb 0x180002241
mov rcx, qword [rbp + 0xb0]
lea rdx, [rax*2 + 2]
call fcn.1800012b5
test r14b, r14b
je 0x180002539
lea rcx, str.GameAssembly.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x180002539
movsxd rax, dword [rsi + 0x3c]
movzx ecx, word [rax + rsi + 0x18]
cmp ecx, 0x20b
jne 0x180002539
mov r14d, dword [rsi + rax + 0x1c]
mov eax, dword [rsi + rax + 0x2c]
add rsi, rax
movabs rax, 0x101000101010001
mov qword [rbp - 0x59], rax
movabs r15, 0x101010000000001
mov qword [rbp - 0x60], r15
movabs rax, 0x75c08400000000e8
mov qword [rbp - 0x51], rax
movabs rax, 0xb0c300c483480075
mov qword [rbp - 0x4a], rax
cmp r14, 0xf
jne 0x180002306
movups xmm0, xmmword [0x180005c68]
movaps xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x50], 1
movups xmm0, xmmword [0x180005c79]
movups xmmword [rbp - 0x4f], xmm0
mov byte [rbp - 0x3f], 0xdf
mov rax, 0xfffffffffffffffe
jmp 0x1800023f2
cmp rax, rdi
sete r14b
mov al, 1
xor r14b, al
xor r14b, 1
jmp 0x1800021eb
lea rax, [r14 - 0xf]
xor ecx, ecx
xor edx, edx
mov r8d, edx
add r8, rsi
add rcx, rsi
xor r9d, r9d
cmp byte [rbp + r9 - 0x60], 0
je 0x18000232d
mov r10b, byte [r8 + r9]
cmp r10b, byte [rbp + r9 - 0x51]
jne 0x180002338
inc r9
cmp r9, 0xf
jne 0x18000231a
jmp 0x180002344
inc edx
mov rcx, rdx
cmp rax, rdx
ja 0x18000230e
jmp 0x180002391
test rcx, rcx
je 0x180002391
movsxd rax, dword [rcx + 1]
lea rdi, [rcx + rax]
add rdi, 5
mov r12, qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rbx, [rbp + 0xb0]
mov edx, 4
mov rcx, rdi
mov r8d, 0x40
mov r9, rbx
call r12
mov word [rdi], 0x1b0
mov byte [rdi + 2], 0xc3
mov r8d, dword [rbx]
mov edx, 4
mov rcx, rdi
mov r9, rbx
call r12
movups xmm0, xmmword [0x180005c68]
movaps xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x50], 1
movups xmm0, xmmword [0x180005c79]
movups xmmword [rbp - 0x4f], xmm0
mov byte [rbp - 0x3f], 0xdf
cmp r14d, 0x11
jne 0x1800023ee
movabs rax, 0x101010001010101
mov qword [rbp - 0x5b], rax
mov qword [rbp - 0x60], r15
movabs rax, 0xf6844000000000e8
mov qword [rbp - 0x53], rax
movabs rax, 0x75c0840075f68440
mov qword [rbp - 0x4e], rax
mov r14d, 4
jmp 0x1800024b5
lea rax, [r14 - 0x11]
xor ecx, ecx
xor edx, edx
mov r8d, edx
add r8, rsi
add rcx, rsi
xor r9d, r9d
cmp byte [rbp + r9 - 0x60], 0
je 0x180002415
mov r10b, byte [r8 + r9]
cmp r10b, byte [rbp + r9 - 0x4f]
jne 0x180002420
inc r9
cmp r9, 0x11
jne 0x180002402
jmp 0x18000242c
inc edx
mov rcx, rdx
cmp rax, rdx
ja 0x1800023f6
jmp 0x180002479
test rcx, rcx
je 0x180002479
movsxd rax, dword [rcx + 1]
lea rdi, [rcx + rax]
add rdi, 5
mov r12, qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rbx, [rbp + 0xb0]
mov edx, 4
mov rcx, rdi
mov r8d, 0x40
mov r9, rbx
call r12
mov word [rdi], 0x1b0
mov byte [rdi + 2], 0xc3
mov r8d, dword [rbx]
mov edx, 4
mov rcx, rdi
mov r9, rbx
call r12
movabs rax, 0x101010001010101
mov qword [rbp - 0x5b], rax
mov qword [rbp - 0x60], r15
movabs rax, 0xf6844000000000e8
mov qword [rbp - 0x53], rax
movabs rax, 0x75c0840075f68440
mov qword [rbp - 0x4e], rax
cmp r14d, 0xd
je 0x180002539
add r14, 0xfffffffffffffff3
xor eax, eax
xor ecx, ecx
mov edx, ecx
add rdx, rsi
add rax, rsi
xor r8d, r8d
cmp byte [rbp + r8 - 0x60], 0
je 0x1800024d7
mov r9b, byte [rdx + r8]
cmp r9b, byte [rbp + r8 - 0x53]
jne 0x1800024e2
inc r8
cmp r8, 0xd
jne 0x1800024c4
jmp 0x1800024ee
inc ecx
mov rax, rcx
cmp r14, rcx
ja 0x1800024b9
jmp 0x180002539
test rax, rax
je 0x180002539
movsxd rcx, dword [rax + 1]
lea rsi, [rax + rcx]
add rsi, 5
mov rbx, qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rdi, [rbp + 0xb0]
mov edx, 4
mov rcx, rsi
mov r8d, 0x40
mov r9, rdi
call rbx
mov word [rsi], 0x1b0
mov byte [rsi + 2], 0xc3
mov r8d, dword [rdi]
mov edx, 4
mov rcx, rsi
mov r9, rdi
call rbx
mov eax, 1
add rsp, 0x178
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.18000130c
call fcn.18000130c
call fcn.18000130c
int3