Function at 0x140030570
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1e8]
sub rsp, 0x2c0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
movaps xmmword [rax - 0xa8], xmm13
movaps xmmword [rax - 0xb8], xmm14
movaps xmmword [rax - 0xc8], xmm15
mov rax, qword [0x14005e028]
xor rax, rsp
mov qword [rbp + 0x110], rax
movss xmm12, dword [0x140058214]
movss xmm15, dword [0x1400581f0]
cmp byte [0x14005f3eb], 0
je 0x1400306c4
mov r10, qword [0x14005f3f0]
movss xmm0, dword [0x14005f5b8]
movss dword [rbp - 0x50], xmm0
movss xmm1, dword [0x14005f5bc]
movss dword [rbp - 0x4c], xmm1
movss xmm0, dword [0x14005f5c0]
movss dword [rbp - 0x48], xmm0
mov dword [rbp - 0x44], 0x3f800000
lea rcx, [rbp - 0x50]
call fcn.140002c20
mov ecx, dword [0x14005f3ec]
xorps xmm4, xmm4
cvtsi2ss xmm4, rcx
movaps xmm1, xmm4
movss xmm3, dword [0x14005e058]
addss xmm1, xmm3
mov ecx, dword [0x14005f480]
xorps xmm2, xmm2
cvtsi2ss xmm2, rcx
movaps xmm0, xmm2
addss xmm0, xmm3
movss dword [rsp + 0x40], xmm0
movss dword [rsp + 0x44], xmm1
subss xmm4, xmm3
subss xmm2, xmm3
movss dword [rsp + 0x4c], xmm2
movss dword [rsp + 0x50], xmm4
movss dword [rsp + 0x30], xmm12
mov dword [rsp + 0x28], 0xf
movss dword [rsp + 0x20], xmm15
mov r9d, eax
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x4c]
lea rcx, [r10 + 0x1cc8]
call fcn.14001e180
mov r8, qword [0x14005f3f0]
movaps xmm0, xmmword [0x140058410]
movups xmmword [rbp - 0x80], xmm0
lea rcx, [rbp - 0x80]
call fcn.140002c20
mov edx, dword [0x14005f3ec]
xorps xmm1, xmm1
cvtsi2ss xmm1, rdx
mov edx, dword [0x14005f480]
xorps xmm0, xmm0
cvtsi2ss xmm0, rdx
movss dword [rsp + 0x40], xmm0
movss dword [rsp + 0x44], xmm1
movss xmm1, dword [0x1400581e0]
movss dword [rsp + 0x28], xmm1
mov r9d, eax
movss xmm2, dword [0x14005e058]
lea rdx, [rsp + 0x40]
lea rcx, [r8 + 0x1cc8]
call fcn.14001e770
cmp byte [0x14005f484], 0
je 0x140030812
mov r8, qword [0x14005f3f0]
movaps xmm0, xmmword [0x1400584d0]
movups xmmword [rbp - 0x80], xmm0
lea rcx, [rbp - 0x80]
call fcn.140002c20
mov edx, dword [0x14005f3ec]
xorps xmm1, xmm1
cvtsi2ss xmm1, rdx
mov edx, dword [0x14005f480]
xorps xmm0, xmm0
cvtsi2ss xmm0, rdx
movss dword [rsp + 0x40], xmm0
movss dword [rsp + 0x44], xmm1
mov dword [rsp + 0x20], 0x64
mov r9d, eax
movss xmm2, dword [0x14005e058]
lea rdx, [rsp + 0x40]
lea rcx, [r8 + 0x1cc8]
call fcn.14001e830
mov r8, qword [0x14005f3f0]
movaps xmm0, xmmword [0x140058510]
movups xmmword [rbp - 0x80], xmm0
lea rcx, [rbp - 0x80]
call fcn.140002c20
mov edx, dword [0x14005f3ec]
xorps xmm1, xmm1
cvtsi2ss xmm1, rdx
mov edx, dword [0x14005f480]
xorps xmm0, xmm0
cvtsi2ss xmm0, rdx
movss dword [rsp + 0x40], xmm0
movss dword [rsp + 0x44], xmm1
movss xmm1, dword [0x140058228]
movss dword [rsp + 0x28], xmm1
mov r9d, eax
movss xmm2, dword [0x14005e058]
lea rdx, [rsp + 0x40]
lea rcx, [r8 + 0x1cc8]
call fcn.14001e770
mov edx, 2
mov ecx, dword [0x14005f4e0]
test ecx, ecx
jne 0x14003082d
mov dword [0x14005f584], 0x44
jmp 0x140030860
cmp ecx, 1
jne 0x14003083e
mov dword [0x14005f584], 0x43
jmp 0x140030860
cmp ecx, edx
jne 0x14003084e
mov dword [0x14005f584], 0x24
jmp 0x140030860
mov eax, dword [0x14005f584]
cmp ecx, 3
cmove eax, edx
mov dword [0x14005f584], eax
mov esi, 3
mov ecx, dword [0x14005e188]
test ecx, ecx
jne 0x14003087e
mov dword [0x14005f580], 1
jmp 0x14003092f
cmp ecx, 1
jne 0x14003088e
mov dword [0x14005f580], edx
jmp 0x14003092f
cmp ecx, edx
jne 0x1400308a1
mov dword [0x14005f580], 4
jmp 0x14003092f
cmp ecx, esi
jne 0x1400308b1
mov dword [0x14005f580], 5
jmp 0x14003092f
cmp ecx, 4
jne 0x1400308c2
mov dword [0x14005f580], 6
jmp 0x14003092f
cmp ecx, 5
jne 0x1400308cf
mov dword [0x14005f580], esi
jmp 0x14003092f
cmp ecx, 6
jne 0x1400308e0
mov dword [0x14005f580], 8
jmp 0x14003092f
cmp ecx, 7
jne 0x1400308f1
mov dword [0x14005f580], 9
jmp 0x14003092f
cmp ecx, 8
jne 0x140030902
mov dword [0x14005f580], 0xc
jmp 0x14003092f
cmp ecx, 9
je 0x14003092f
cmp ecx, 0xa
jne 0x140030918
mov dword [0x14005f580], 0x10
jmp 0x14003092f
mov eax, dword [0x14005f580]
mov edx, 0x11
cmp ecx, 0xb
cmove eax, edx
mov dword [0x14005f580], eax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x98], xmm0
xor r15d, r15d
mov qword [rbp + 0xa8], r15
mov rcx, qword [0x14005f518]
sub rcx, qword [0x14005f510]
movabs r14, 0x2aaaaaaaaaaaaaab
mov rax, r14
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x140030a2c
movabs rax, 0xaaaaaaaaaaaaaaa
cmp rdx, rax
ja 0x1400317ba
lea rbx, [rdx + rdx*2]
shl rbx, 3
cmp rbx, 0x1000
jb 0x1400309c6
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x1400317b4
call fcn.1400339f0
test rax, rax
je 0x1400309bf
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400309db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rbx, rbx
je 0x1400309d8
mov rcx, rbx
call fcn.1400339f0
mov rdi, rax
jmp 0x1400309db
mov rdi, r15
mov qword [rbp + 0x98], rdi
lea rcx, [rbx + rdi]
mov qword [rbp + 0xa8], rcx
mov rbx, qword [0x14005f518]
mov rdx, qword [0x14005f510]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov rax, r14
imul rbx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rax, [rdx + rdx*2]
lea rcx, [rdi + rax*8]
mov qword [rbp + 0xa0], rcx
movss xmm13, dword [0x140058318]
mov rbx, r15
mov qword [rsp + 0x40], rbx
mov rdx, qword [0x14005f4a8]
add rdx, 0x103058d8
call fcn.1400330b0
mov qword [0x14005f4e8], rax
lea rdx, [rax + 0x1b8]
call fcn.1400330b0
lea rdx, [rax + 0x38]
call fcn.1400330b0
mov rdx, rax
call fcn.1400330b0
mov qword [0x14005f4d0], rax
lea rdx, [rax + 0x30]
call fcn.1400330b0
mov qword [0x14005f3f8], rax
lea rdx, [rax + 0x330]
call fcn.1400330b0
mov qword [0x14005f498], rax
lea rdx, [rax + 0x2a8]
call fcn.1400330b0
mov qword [0x14005f488], rax
mov rdx, qword [0x14005f498]
add rdx, 0x190
call fcn.1400330b0
mov qword [0x14005f4d8], rax
mov rdx, qword [0x14005f4e8]
add rdx, 0x30
call fcn.1400330b0
mov qword [0x14005f4b8], rax
lea rcx, [rax + 0xa0]
mov r10, qword [0x14005f4f0]
mov eax, dword [r10 + 8]
mov dword [rbp + 0xf4], r15d
mov dword [rbp + 0xf0], eax
mov qword [rbp + 0xf8], rcx
lea rax, [rsp + 0x48]
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x108], 4
mov dword [rbp - 0x70], r15d
mov qword [rsp + 0x38], r15
lea rax, [rbp - 0x70]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x20
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
lea r8, [rbp + 0xf0]
mov edx, 0x21a68c90
mov rcx, qword [r10]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, dword [rsp + 0x48]
mov dword [rsp + 0x4c], edi
mov rdx, qword [0x14005f4b8]
add rdx, 0x98
call fcn.1400330b0
mov rcx, rax
mov qword [rbp - 0x50], rax
mov r12d, r15d
movss xmm14, dword [0x14005824c]
test edi, edi
je 0x1400313c9
nop word [rax + rax]
movsxd rax, r12d
lea rdx, [rcx + rax*8]
call fcn.1400330b0
mov r14, rax
lea rdx, [rax + 0x310]
call fcn.1400330b0
mov r13, rax
lea rdx, [r14 + 0x4540]
call fcn.140033210
ucomiss xmm0, dword [0x1400582b8]
jp 0x1400313b4
jne 0x1400313b4
mov rdx, qword [0x14005f488]
add rdx, 0x10b8
call fcn.1400332e0
mov ebx, eax
lea rdx, [r14 + 0x2a8]
call fcn.1400330b0
lea rdx, [rax + 0x10b8]
call fcn.1400332e0
cmp ebx, eax
je 0x1400313af
cmp r14, qword [0x14005f498]
je 0x1400313af
mov r8d, 0x6a
mov rdx, r13
lea rcx, [rbp - 0x68]
call fcn.14002e240
mov rdx, qword [0x14005f4d8]
add rdx, 0x128
mov rcx, qword [0x14005f4f0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
movsd qword [rsp + 0x70], xmm0
mov eax, dword [rcx + 8]
mov dword [rbp + 0xd4], r15d
mov dword [rbp + 0xd0], eax
mov qword [rbp + 0xd8], rdx
lea rax, [rsp + 0x60]
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xe8], 0x18
mov dword [rsp + 0x48], r15d
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x20
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
lea r8, [rbp + 0xd0]
mov edx, 0x21a68c90
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
movsd xmm6, qword [rsp + 0x60]
movsd qword [0x14005f588], xmm6
movsd xmm1, qword [rsp + 0x68]
movsd qword [0x14005f590], xmm1
movsd xmm7, qword [rsp + 0x70]
movsd qword [0x14005f598], xmm7
movsd xmm9, qword [rbp - 0x60]
movaps xmm0, xmm9
subsd xmm0, xmm1
cvtpd2ps xmm0, xmm0
movaps xmm1, xmm14
call sub.api_ms_win_crt_math_l1_1_0.dll_powf
movaps xmm8, xmm0
movsd xmm10, qword [rbp - 0x68]
movaps xmm0, xmm10
subsd xmm0, xmm6
cvtpd2ps xmm0, xmm0
movaps xmm1, xmm14
call sub.api_ms_win_crt_math_l1_1_0.dll_powf
addss xmm8, xmm0
movsd xmm11, qword [rbp - 0x58]
movaps xmm1, xmm11
subsd xmm1, xmm7
cvtpd2ps xmm0, xmm1
movaps xmm1, xmm14
call sub.api_ms_win_crt_math_l1_1_0.dll_powf
addss xmm8, xmm0
xorps xmm1, xmm1
ucomiss xmm1, xmm8
ja 0x140030d61
xorps xmm6, xmm6
sqrtss xmm6, xmm8
jmp 0x140030d6d
movaps xmm0, xmm8
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movaps xmm6, xmm0
divss xmm6, dword [0x1400582f0]
xor r8d, r8d
mov rdx, r13
lea rcx, [rbp + 0x10]
call fcn.14002e240
movups xmm1, xmmword [rbp + 0x10]
movaps xmmword [rsp + 0x60], xmm1
movsd xmm2, qword [rbp + 0x20]
movsd qword [rsp + 0x70], xmm2
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0xf0]
call fcn.14002e9b0
movaps xmm0, xmm11
addsd xmm0, qword [0x140058268]
cvtpd2ps xmm4, xmm0
cvtpd2ps xmm1, xmm9
cvtpd2ps xmm0, xmm10
cvtps2pd xmm0, xmm0
cvtps2pd xmm3, xmm1
cvtps2pd xmm5, xmm4
unpcklpd xmm0, xmm3
movaps xmmword [rbp + 0x10], xmm0
movsd qword [rbp - 0x58], xmm5
movsd qword [rbp + 0x20], xmm5
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0xb0]
call fcn.14002e9b0
movaps xmm0, xmm10
unpcklpd xmm0, xmm9
movaps xmmword [rbp + 0x10], xmm0
movsd qword [rbp + 0x20], xmm11
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x30]
call fcn.14002e9b0
movsd xmm8, qword [rbp + 0xb8]
movaps xmm1, xmm8
subsd xmm1, qword [rbp + 0xf8]
cvtpd2ps xmm0, xmm1
andps xmm1, xmmword [0x1400586d0]
cvtpd2ps xmm9, xmm1
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [str.q_np]
cvtpd2ps xmm7, xmm0
movss xmm0, dword [0x140058334]
comiss xmm0, xmm6
jbe 0x1400312fd
cmp byte [0x14005f4e5], 0
je 0x14003112a
mov rax, qword [0x14005f3f0]
lea r10, [rax + 0x1cc8]
movss xmm0, dword [0x14005f600]
movss xmm1, dword [0x14005f604]
movss xmm2, dword [0x14005f608]
movss dword [rbp + 0x48], xmm0
movss dword [rbp + 0x4c], xmm1
movss dword [rbp + 0x50], xmm2
movss xmm0, dword [rax + 0x1550]
addss xmm0, xmm0
movss dword [rbp + 0x54], xmm0
lea rcx, [rbp + 0x48]
call fcn.140002c20
mov r9d, eax
mov eax, dword [0x14005f4a0]
cdq
sub eax, edx
sar eax, 1
movd xmm1, eax
cvtdq2ps xmm1, xmm1
mov edx, dword [0x14005f4a4]
test edx, edx
jns 0x140030ed0
inc edx
sar edx, 1
lea eax, [rdx - 0xa]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rbp - 0x70], xmm0
movss dword [rbp - 0x6c], xmm1
movd xmm0, edx
cvtdq2ps xmm0, xmm0
movss dword [rbp - 0x40], xmm0
movss dword [rbp - 0x3c], xmm1
movss dword [rsp + 0x20], xmm12
lea r8, [rbp - 0x70]
lea rdx, [rbp - 0x40]
mov rcx, r10
call fcn.14001e000
mov rax, qword [0x14005f3f0]
lea r10, [rax + 0x1cc8]
movss xmm0, dword [0x14005f600]
movss xmm1, dword [0x14005f604]
movss xmm2, dword [0x14005f608]
movss dword [rbp + 0x58], xmm0
movss dword [rbp + 0x5c], xmm1
movss dword [rbp + 0x60], xmm2
movss xmm0, dword [rax + 0x1550]
addss xmm0, xmm0
movss dword [rbp + 0x64], xmm0
lea rcx, [rbp + 0x58]
call fcn.140002c20
mov r9d, eax
mov eax, dword [0x14005f4a0]
cdq
sub eax, edx
sar eax, 1
movd xmm1, eax
cvtdq2ps xmm1, xmm1
mov edx, dword [0x14005f4a4]
test edx, edx
jns 0x140030f7e
inc edx
sar edx, 1
lea eax, [rdx + 0xa]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rbp - 0x38], xmm0
movss dword [rbp - 0x34], xmm1
movd xmm0, edx
cvtdq2ps xmm0, xmm0
movss dword [rbp - 0x30], xmm0
movss dword [rbp - 0x2c], xmm1
movss dword [rsp + 0x20], xmm12
lea r8, [rbp - 0x38]
lea rdx, [rbp - 0x30]
mov rcx, r10
call fcn.14001e000
mov rax, qword [0x14005f3f0]
lea r10, [rax + 0x1cc8]
movss xmm0, dword [0x14005f600]
movss xmm1, dword [0x14005f604]
movss xmm2, dword [0x14005f608]
movss dword [rbp + 0x68], xmm0
movss dword [rbp + 0x6c], xmm1
movss dword [rbp + 0x70], xmm2
movss xmm0, dword [rax + 0x1550]
addss xmm0, xmm0
movss dword [rbp + 0x74], xmm0
lea rcx, [rbp + 0x68]
call fcn.140002c20
mov r9d, eax
mov r8d, dword [0x14005f4a0]
test r8d, r8d
jns 0x14003101d
inc r8d
sar r8d, 1
lea ecx, [r8 - 0xa]
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
mov eax, dword [0x14005f4a4]
cdq
sub eax, edx
sar eax, 1
movd xmm1, eax
cvtdq2ps xmm1, xmm1
movss dword [rbp - 0x28], xmm1
movss dword [rbp - 0x24], xmm0
movd xmm0, r8d
cvtdq2ps xmm0, xmm0
movss dword [rbp - 0x20], xmm1
movss dword [rbp - 0x1c], xmm0
movss dword [rsp + 0x20], xmm12
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x20]
mov rcx, r10
call fcn.14001e000
mov rax, qword [0x14005f3f0]
lea r10, [rax + 0x1cc8]
movss xmm0, dword [0x14005f600]
movss xmm1, dword [0x14005f604]
movss xmm2, dword [0x14005f608]
movss dword [rbp + 0x78], xmm0
movss dword [rbp + 0x7c], xmm1
movss dword [rbp + 0x80], xmm2
movss xmm0, dword [rax + 0x1550]
addss xmm0, xmm0
movss dword [rbp + 0x84], xmm0
lea rcx, [rbp + 0x78]
call fcn.140002c20
mov r9d, eax
mov r8d, dword [0x14005f4a0]
test r8d, r8d
jns 0x1400310d7
inc r8d
sar r8d, 1
lea ecx, [r8 + 0xa]
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
mov eax, dword [0x14005f4a4]
cdq
sub eax, edx
sar eax, 1
movd xmm1, eax
cvtdq2ps xmm1, xmm1
movss dword [rbp - 0x18], xmm1
movss dword [rbp - 0x14], xmm0
movd xmm0, r8d
cvtdq2ps xmm0, xmm0
movss dword [rbp - 0x10], xmm1
movss dword [rbp - 0xc], xmm0
movss dword [rsp + 0x20], xmm12
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x10]
mov rcx, r10
call fcn.14001e000
movsd xmm6, qword [rbp + 0xb0]
cmp byte [0x14005f487], 0
je 0x140031250
movss xmm0, dword [0x14005f5e8]
movss dword [rbp + 0x88], xmm0
movss xmm1, dword [0x14005f5ec]
movss dword [rbp + 0x8c], xmm1
movss xmm0, dword [0x14005f5f0]
movss dword [rbp + 0x90], xmm0
mov dword [rbp + 0x94], 0x3f800000
lea rcx, [rbp + 0x88]
call fcn.140002c20
mov dword [rsp + 0x48], eax
cvttss2si r15d, xmm9
cvttss2si edi, xmm7
cvttsd2si esi, xmm8
movaps xmm0, xmm7
mulss xmm0, xmm15
cvtps2pd xmm1, xmm0
movaps xmm2, xmm6
subsd xmm2, xmm1
cvttsd2si ebx, xmm2
mov dword [rsp + 0x28], 2
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, r15d
mov r8d, edi
mov edx, esi
mov ecx, ebx
call fcn.14002ee10
movaps xmm0, xmmword [0x140058480]
movups xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call fcn.140002c20
mov r10, qword [0x14005f3f0]
lea ecx, [rdi + rbx]
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
movss dword [rbp - 8], xmm0
lea edx, [rsi + r15]
movd xmm1, edx
cvtdq2ps xmm1, xmm1
movss dword [rbp - 4], xmm1
movd xmm0, ebx
cvtdq2ps xmm0, xmm0
movss dword [rbp], xmm0
movd xmm1, esi
cvtdq2ps xmm1, xmm1
movss dword [rbp + 4], xmm1
mov dword [rsp + 0x28], 0
xorps xmm0, xmm0
movss dword [rsp + 0x20], xmm0
mov r9d, eax
lea r8, [rbp - 8]
lea rdx, [rbp]
lea rcx, [r10 + 0x1cc8]
call fcn.14001e270
mov edi, dword [rsp + 0x4c]
jmp 0x140031255
cvttss2si r15d, xmm9
cmp byte [0x14005e053], 0
je 0x1400312c0
movss xmm0, dword [0x14005f5e8]
movss dword [rbp - 0x80], xmm0
movss dword [rbp - 0x7c], xmm0
movss dword [rbp - 0x78], xmm0
mov dword [rbp - 0x74], 0x3f800000
lea rcx, [rbp - 0x80]
call fcn.140002c20
mov dword [rsp + 0x48], eax
cvttss2si r8d, xmm7
cvttsd2si edx, xmm8
mulss xmm7, xmm15
cvtps2pd xmm0, xmm7
movaps xmm1, xmm6
subsd xmm1, xmm0
cvttsd2si ecx, xmm1
mov dword [rsp + 0x28], 1
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, r15d
call fcn.14002ee10
cmp byte [0x14005f4e4], 0
je 0x1400312fa
cvttsd2si r9d, xmm8
cvttsd2si r8d, xmm6
mov eax, dword [0x14005f4a0]
cdq
sub eax, edx
sar eax, 1
mov r10d, eax
mov eax, dword [0x14005f4a4]
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
lea edx, [r10 - 0x21c]
call fcn.14002ed20
xor r15d, r15d
mov eax, dword [0x14005f4a4]
cdq
sub eax, edx
sar eax, 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd xmm2, qword [rbp + 0x30]
subsd xmm2, xmm0
mov eax, dword [0x14005f4a0]
cdq
sub eax, edx
sar eax, 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd xmm1, qword [rbp + 0x38]
subsd xmm1, xmm0
mulsd xmm1, xmm1
mulsd xmm2, xmm2
addsd xmm1, xmm2
cvtpd2ps xmm3, xmm1
xorps xmm0, xmm0
ucomiss xmm0, xmm3
ja 0x140031356
xorps xmm7, xmm7
sqrtss xmm7, xmm3
jmp 0x140031361
movaps xmm0, xmm3
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movaps xmm7, xmm0
lea rdx, [r13 + 0x358]
call fcn.140033210
movaps xmm6, xmm0
lea rdx, [r13 + 0x360]
call fcn.140033210
addss xmm0, dword [0x1400581c4]
comiss xmm0, xmm6
setae al
test al, al
je 0x1400313af
movss xmm0, dword [0x14005e058]
comiss xmm0, xmm7
jbe 0x1400313af
comiss xmm13, xmm7
jbe 0x1400313af
movaps xmm13, xmm7
mov rbx, r14
mov qword [rsp + 0x40], rbx
jmp 0x1400313b4
mov rbx, qword [rsp + 0x40]
inc r12d
cmp r12d, edi
mov rcx, qword [rbp - 0x50]
jb 0x140030ba0
mov esi, 3
cmp byte [0x14005e051], 0
je 0x140031740
test rbx, rbx
je 0x140031740
lea rdi, [rbx + 0x310]
mov rdx, rdi
call fcn.1400330b0
mov rbx, rax
test rax, rax
je 0x140031740
lea rdx, [rax + 0x358]
call fcn.140033210
movaps xmm6, xmm0
lea rdx, [rbx + 0x360]
call fcn.140033210
addss xmm0, dword [0x1400581c4]
comiss xmm0, xmm6
setae cl
test cl, cl
je 0x140031740
mov r8d, 0x6a
mov rdx, rbx
lea rcx, [rbp - 0x68]
call fcn.14002e240
mov r8, qword [0x14005f4d8]
add r8, 0x128
mov rcx, qword [0x14005f4f0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm7, xmm7
movsd qword [rsp + 0x70], xmm7
mov eax, dword [rcx + 8]
mov dword [rbp + 0xd4], r15d
mov dword [rbp + 0xd0], eax
mov qword [rbp + 0xd8], r8
lea rax, [rsp + 0x60]
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xe8], 0x18
mov dword [rsp + 0x4c], r15d
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x20
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
lea r8, [rbp + 0xd0]
mov edx, 0x21a68c90
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
movsd xmm0, qword [rbp - 0x60]
subsd xmm0, qword [rsp + 0x68]
cvtpd2ps xmm0, xmm0
movaps xmm1, xmm14
call sub.api_ms_win_crt_math_l1_1_0.dll_powf
movaps xmm6, xmm0
movsd xmm0, qword [rbp - 0x68]
subsd xmm0, qword [rsp + 0x60]
cvtpd2ps xmm0, xmm0
movaps xmm1, xmm14
call sub.api_ms_win_crt_math_l1_1_0.dll_powf
addss xmm6, xmm0
movsd xmm1, qword [rbp - 0x58]
subsd xmm1, qword [rsp + 0x70]
cvtpd2ps xmm0, xmm1
movaps xmm1, xmm14
call sub.api_ms_win_crt_math_l1_1_0.dll_powf
addss xmm6, xmm0
xorps xmm1, xmm1
ucomiss xmm1, xmm6
ja 0x140031538
xorps xmm0, xmm0
sqrtss xmm0, xmm6
jmp 0x140031540
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
divss xmm0, dword [0x1400582f0]
movss xmm1, dword [0x140058334]
comiss xmm1, xmm0
jbe 0x140031740
comiss xmm0, xmm14
jbe 0x140031740
cmp byte [0x14005e051], 0
je 0x140031740
lea r12, [rbp + 0x1e8]
movabs r13, 0xff00ff00ff00ff00
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], r12
mov rbx, qword [r12]
xor rbx, r13
mov qword [rbp - 0x68], rbx
mov qword [r12], r15
mov ecx, r15d
lea r15, [0x140033370]
lea r14, [0x140000000]
mov rax, qword [0x1400600e0]
test rax, rax
je 0x1400315de
cmp rax, r15
je 0x1400315cb
inc ecx
mov rax, qword [r14 + rcx*8 + 0x600e0]
test rax, rax
jne 0x1400315b5
jmp 0x1400315de
mov eax, ecx
mov r9, qword [r14 + rax*8 + 0x5fdb0]
test r9, r9
jne 0x1400316bf
mov edx, 0x1f4
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r9, rax
test rax, rax
je 0x14003169e
mov rax, r15
mov rcx, r9
nop word [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rsi, 1
jne 0x140031610
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov eax, dword [rax + 0x70]
mov dword [rcx + 0x70], eax
mov rax, qword [0x14005fa70]
mov qword [r14 + rax*8 + 0x600e0], r15
mov qword [r14 + rax*8 + 0x5fdb0], r9
inc rax
mov qword [0x14005fa70], rax
lea rdx, [0x14005f580]
mov rcx, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call r9
nop
xor rbx, r13
mov qword [r12], rbx
test ax, ax
jns 0x140031740
mov rdx, rdi
call fcn.1400330b0
mov r8d, dword [0x14005f584]
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.14002e240
movups xmm0, xmmword [rbp + 0x30]
movaps xmmword [rbp + 0xb0], xmm0
movsd xmm1, qword [rbp + 0x40]
movsd qword [rbp + 0xc0], xmm1
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x30]
call fcn.14002e9b0
movsd xmm0, qword [rbp + 0x38]
ucomisd xmm0, xmm7
jp 0x14003172d
je 0x140031740
cvtpd2ps xmm1, xmm0
movsd xmm0, qword [rbp + 0x30]
cvtpd2ps xmm0, xmm0
call fcn.140030250
nop
lea rcx, [rbp + 0x98]
call fcn.140032e50
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.1400333d0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
movaps xmm15, xmmword [r11 - 0xa0]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14002d880
int3
call fcn.1400333a0
int3