Function at 0x18001d5c0
Capabilities:
Create thread
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x508]
sub rsp, 0x5d0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
mov rax, qword [0x1800529c8]
xor rax, rsp
mov qword [rbp + 0x4a0], rax
mov qword [rbp - 0x10], r8
mov qword [rbp - 0x30], rdx
mov esi, ecx
mov dword [rsp + 0x68], ecx
movdqa xmm0, xmmword [0x180046950]
movdqa xmmword [rbp + 0x1e0], xmm0
mov byte [rbp + 0x1d0], 0
movdqa xmm1, xmm0
movdqa xmmword [rbp + 0x200], xmm0
mov byte [rbp + 0x1f0], 0
movdqa xmmword [rbp + 0x220], xmm0
mov byte [rbp + 0x210], 0
movdqa xmmword [rbp + 0x250], xmm0
mov byte [rbp + 0x240], 0
movdqa xmmword [rbp + 0x270], xmm0
mov byte [rbp + 0x260], 0
xor r14d, r14d
mov qword [rbp + 0x70], r14
mov word [rbp + 0x78], r14w
movdqu xmmword [rbp + 0x8a], xmm0
mov byte [rbp + 0x7a], r14b
mov qword [rbp + 0x40], r14
mov word [rbp + 0x48], r14w
movdqu xmmword [rbp + 0x5a], xmm0
mov byte [rbp + 0x4a], r14b
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], r14
movdqa xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], r14
mov qword [rbp + 0xa0], r14
mov qword [rbp + 0xa8], r14
mov qword [rbp + 0xb0], r14
lea ecx, [r14 + 0x30]
call fcn.18003b998
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0xa8], rax
xor r8d, r8d
mov qword [rbp + 0xb8], r8
xorps xmm2, xmm2
movsd qword [rbp + 0xc0], xmm2
mov qword [rbp + 0xc8], r8
mov r9d, 1
mov dword [rbp + 0xd0], r9d
mov qword [rbp + 0xd8], r8
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xe0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xf0], xmm1
movdqa xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], r8
mov qword [rbp + 0x118], 0xffffffffffffffff
mov dword [rbp + 0x120], r8d
xor eax, eax
movups xmmword [rbp + 0x128], xmm0
movups xmmword [rbp + 0x138], xmm0
movups xmmword [rbp + 0x148], xmm0
movups xmmword [rbp + 0x158], xmm0
mov qword [rbp + 0x168], rax
movdqa xmm0, xmmword [0x180046950]
movdqa xmmword [rbp + 0x180], xmm0
mov byte [rbp + 0x170], al
mov word [rbp + 0x190], r8w
mov dword [rbp + 0x194], r8d
mov qword [rbp + 0x198], r8
xorps xmm0, xmm0
movaps xmmword [rbp + 0x1a0], xmm0
movsd qword [rbp + 0x1b0], xmm2
mov byte [rbp + 0x1b8], al
mov qword [rbp + 0x1bc], r8
mov dword [rsp + 0x44], esi
lea eax, [rsi - 0xb]
mov dword [rsp + 0x40], eax
mov ecx, 0x1bb
movzx ebx, byte [rsp + 0x30]
mov byte [rsp + 0x38], bl
cmp esi, eax
jbe 0x18001dc12
lea edi, [rsi - 0x6c]
mov dword [rsp + 0x5c], edi
xorps xmm6, xmm6
movsd xmm7, qword [0x1800468e0]
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x3c], eax
mov r15d, dword [rsp + 0x48]
movzx r14d, byte [rsp + 0x30]
mov esi, dword [rsp + 0x48]
mov r12d, dword [rsp + 0x48]
mov r13, qword [rsp + 0x50]
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x40]
lea rdx, [0x180000000]
cmp edi, 0x17
ja case.default.0x18001d834
mov ecx, dword [rdx + rdi*4 + 0x1e1a8]
add rcx, rdx
jmp rcx
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rsp + 0x50], rax
xor r8d, r8d
lea r9d, [r8 + 1]
jmp case.0x18001d834.2
mov byte [rbp + 0x280], 0
mov r8d, 5
lea rdx, [0x18004488e]
lea rcx, [rbp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 2
lea rdx, [0x1800448b6]
lea rcx, [rbp + 0x285]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
xor r8d, r8d
lea r9d, [r8 + 1]
jmp case.0x18001d834.2
lea rax, [rbp + 0x280]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18001d8b0
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x1d0]
call fcn.180015b40
mov r8d, 1
lea rdx, [0x18003f9fc]
lea rcx, [rbp + 0x1f0]
call fcn.180015b40
mov eax, 0x1bb
mov word [rbp + 0x230], ax
xor r8d, r8d
lea r9d, [r8 + 1]
jmp case.0x18001d834.2
mov r8d, 3
lea rdx, [0x180044938]
lea rcx, [rbp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov word [rbp + 0x28a], 0x6d6f
xor r8d, r8d
lea r9d, [r8 + 1]
jmp case.0x18001d834.2
lea r8, [rbp + 0x1d0]
lea rdx, [rbp + 0x240]
mov ecx, 0x5a
call fcn.18001d130
mov edx, 0x32
mov dword [rsp + 0x3c], edx
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x40]
xor r8d, r8d
lea r9d, [rdx - 0x31]
jmp 0x18001db5b
mov byte [rbp + 0x28c], 0
mov edx, 0x134
lea rcx, [0x1800528d8]
call fcn.180009540
test al, al
jne 0x18001dacf
xor r8d, r8d
mov edi, r8d
nop dword [rax + rax]
cmp edi, 6
ja case.default.0x18001d9ac
mov eax, edi
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0x1e208]
add rcx, rdx
jmp rcx
mov r15d, 0x36
mov qword [rbp - 0x18], r8
jmp case.default.0x18001d9ac
mov r14b, 1
mov qword [rsp + 0x70], r8
jmp case.default.0x18001d9ac
mov ecx, r8d
movzx eax, r14b
test esi, esi
cmove ecx, eax
movzx r14d, cl
mov ecx, r8d
movzx eax, byte [rsp + 0x30]
cmp dword [rsp + 0x48], 0
cmove ecx, eax
mov byte [rsp + 0x30], cl
cmp cl, 0
je 0x18001da0c
lea r9, [rbp + 0x290]
mov r8d, r12d
mov rdx, r13
mov ecx, r15d
call qword [sym.imp.SHELL32.dll_SHSetFolderPathW]
xor r8d, r8d
test r14b, r14b
je 0x18001daba
mov ebx, 0x10d
nop word [rax + rax]
mov eax, ebx
sub eax, 0x10a
je 0x18001da55
sub eax, 1
je 0x18001da4f
sub eax, 1
je 0x18001da3e
cmp eax, 1
jne 0x18001da63
mov qword [rbp - 0x20], r8
jmp 0x18001da63
lea r8, [rbp - 0x20]
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
mov esi, eax
jmp 0x18001da63
mov rcx, qword [rbp - 0x18]
jmp 0x18001da59
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x18001da63
call sub.RPCRT4.dll_MesHandleFree
dec ebx
cmp ebx, 0x109
mov r8d, 0
ja 0x18001da20
jmp 0x18001daba
mov r13, r8
mov r12d, r8d
jmp case.default.0x18001d9ac
mov byte [rsp + 0x30], 1
jmp case.default.0x18001d9ac
lea r9, [rbp - 0x18]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov esi, eax
lea rax, [rbp + 0x290]
mov qword [rsp + 0x20], rax
mov r9d, r12d
mov r8, r13
mov edx, r15d
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [rsp + 0x48], eax
xor r8d, r8d
inc edi
lea ecx, [rdi + 0x17]
cmp ecx, 0x1e
jb 0x18001d990
mov edi, dword [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov bl, 1
mov byte [rsp + 0x38], bl
xor r8d, r8d
lea r9d, [r8 + 1]
jmp case.0x18001d834.2
mov dword [rsp + 0x58], 0x32
mov edx, 0x4f
lea rcx, [rbp + 0x210]
call fcn.18000fc90
xor r8d, r8d
lea r9d, [r8 + 1]
jmp case.0x18001d834.2
mov rax, qword [rbp - 0x10]
movss xmm0, dword [rax]
mov rax, qword [rbp - 0x30]
subss xmm0, dword [rax]
comiss xmm6, xmm0
jbe 0x18001db2a
xorps xmm0, xmmword [0x180046a30]
cvtss2sd xmm0, xmm0
mov eax, r8d
comisd xmm7, xmm0
seta al
test eax, eax
je 0x18001dbf0
mov word [rsp + 0x60], r9w
jmp case.0x18001d834.2
mov byte [rbp + 0x287], 0
mov ecx, dword [rsp + 0x40]
mov eax, dword [rsp + 0x44]
mov edx, dword [rsp + 0x3c]
dec eax
mov dword [rsp + 0x44], eax
dec edi
mov dword [rsp + 0x5c], edi
cmp eax, ecx
ja 0x18001d81a
mov esi, dword [rsp + 0x68]
mov r10d, dword [rsp + 0x58]
mov ecx, 0x1bb
mov edi, esi
imul r12d, esi, 0x391
cmp esi, r12d
ja case.0x18001d834.22
mov r15, qword [rsp + 0x50]
mov r13, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x50]
cmp edi, 0xc300
ja 0x18001dd3e
je 0x18001dcb1
cmp edi, 0x78
je 0x18001dc90
cmp edi, 0x2760
je 0x18001dc89
cmp edi, 0x4e48
je 0x18001dc63
cmp edi, 0x7530
je 0x18001dc29
cmp edi, 0x9c18
jne 0x18001dc3a
mov dword [rsp + 0x5c], 0x10
jmp 0x18001dc3a
mov word [rsp + 0x60], r8w
jmp case.0x18001d834.22
mov rdx, qword [rbp - 0x30]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
jmp 0x18001dea9
mov edx, dword [rsp + 0x48]
mov dword [rsp + 0x3c], edx
mov r10d, dword [rsp + 0x48]
mov dword [rsp + 0x58], r10d
jmp 0x18001db7d
mov edx, 0xc5
lea rcx, [rbp - 0x80]
call fcn.18000c9b0
xor r8d, r8d
imul eax, dword [rsp + 0x68], 0x53
add edi, eax
cmp edi, r12d
ja case.0x18001d834.22
mov r10d, dword [rsp + 0x58]
mov edx, dword [rsp + 0x3c]
mov ecx, 0x1bb
mov r9d, 1
jmp 0x18001dba3
mov word [rsp + 0x30], cx
mov qword [rsp + 0x20], r8
lea r9, [0x180052958]
lea r8, [rbp + 0x40]
lea rdx, [rsp + 0x30]
mov ecx, 0x89
call fcn.180037470
jmp 0x18001dc37
mov dword [rsp + 0x40], r9d
jmp 0x18001dc3a
mov word [rsp + 0x30], cx
lea r9, [rsp + 0x30]
lea r8, [0x180052938]
lea rdx, [rbp + 0x70]
mov ecx, 0x33
call fcn.180013e70
jmp 0x18001dc37
lea rax, [rbp + 0x70]
mov qword [rsp + 0x50], rax
mov rdx, qword [rbp - 0x78]
cmp rdx, qword [rbp - 0x70]
je 0x18001dcd9
lea rax, [rbp + 0x70]
mov qword [rdx], rax
mov rdx, qword [rbp - 0x78]
add rdx, 8
mov qword [rbp - 0x78], rdx
jmp 0x18001dceb
lea r8, [rsp + 0x50]
lea rcx, [rbp - 0x80]
call fcn.1800011a0
mov rdx, qword [rbp - 0x78]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x50], rax
cmp rdx, qword [rbp - 0x70]
je 0x18001dd08
lea rax, [rbp + 0x40]
mov qword [rdx], rax
add qword [rbp - 0x78], 8
jmp 0x18001dd16
lea r8, [rsp + 0x50]
lea rcx, [rbp - 0x80]
call fcn.1800011a0
mov eax, dword [0x180052980]
mov dword [rsp + 0x48], eax
lea r8, [rsp + 0x48]
lea rdx, [rbp - 0x80]
mov ecx, 0xb0
call fcn.18000a0d0
xor r8d, r8d
mov r14d, r8d
jmp 0x18001dc3a
cmp edi, 0xe9e8
je 0x18001de22
cmp edi, 0x110d0
je 0x18001ddda
cmp edi, 0x137b8
je 0x18001dd91
cmp edi, 0x15ea0
je 0x18001dd77
cmp edi, 0x18588
je case.0x18001d834.22
jmp 0x18001dc3a
test bl, bl
je 0x18001dd87
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteObject]
xor r8d, r8d
mov dword [rsp + 0x60], r8d
jmp 0x18001dc3a
mov r9d, 0x55
lea r8, [rbp + 0xa0]
lea rdx, [0x1800528d0]
lea rcx, [rbp - 0x80]
call fcn.180004e40
lea rdx, [rbp + 0xa0]
mov ecx, 0xf5
call fcn.180005140
xor r8d, r8d
mov ecx, r8d
movzx eax, bl
test r15, r15
cmovne ecx, eax
movzx ebx, cl
mov byte [rsp + 0x38], cl
jmp 0x18001dc3a
mov qword [rsp + 0x20], r14
mov r9d, dword [rsp + 0x5c]
mov r8d, dword [rsp + 0x40]
mov ecx, r10d
call qword [sym.imp.GDI32.dll_CreateBitmap]
mov r15, rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [0x180006be0]
mov qword [rsp + 0x50], rax
xor r9d, r9d
lea r8d, [r9 + 4]
lea rdx, [rsp + 0x50]
xor ecx, ecx
call fcn.180003dc0
jmp 0x18001dc37
lea rax, [rbp - 0x80]
mov qword [rbp - 0x30], rax
mov eax, dword [0x180052980]
mov dword [rbp - 0x28], eax
mov eax, dword [0x180052984]
mov dword [rbp - 0x24], eax
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp], xmm0
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], r8d
lea r9, [rbp]
lea r8, [0x18000e030]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r13, rax
test rax, rax
jne 0x18001dc37
mov ebx, 0x60
mov ecx, ebx
sub ecx, 0x60
je 0x18001df61
sub ecx, 0x20
je 0x18001df54
sub ecx, 0x20
je 0x18001df3b
cmp ecx, 0x20
jne 0x18001df70
mov eax, 1
mov dword [rsp + 0x60], eax
mov rbx, qword [rsp + 0x60]
lea rcx, [rbp + 0x118]
call fcn.180003220
mov rdi, qword [rbp + 0x100]
test rdi, rdi
je 0x18001df8c
mov rsi, qword [rbp + 0x108]
cmp rdi, rsi
je 0x18001dee9
mov rcx, rdi
call fcn.1800147f0
add rdi, 0x20
cmp rdi, rsi
jne 0x18001ded1
mov rdi, qword [rbp + 0x100]
mov rdx, qword [rbp + 0x110]
sub rdx, rdi
and rdx, 0xffffffffffffffe0
mov rax, rdi
cmp rdx, 0x1000
jb 0x18001df1c
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001dfca
mov rcx, rdi
call fcn.18003b9d4
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x100], xmm0
xor r14d, r14d
mov qword [rbp + 0x110], r14
jmp 0x18001df8f
lea r9, [rsp + 0x70]
mov r8, rsi
lea rdx, [rbp + 0x10]
mov ecx, 1
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclA]
jmp 0x18001df70
xor r8d, r8d
mov qword [rsp + 0x70], r8
mov esi, r8d
jmp 0x18001df73
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
xor r8d, r8d
add ebx, 0x20
cmp ebx, 0xe0
jb 0x18001de75
movzx ebx, byte [rsp + 0x38]
jmp 0x18001dc3a
xor r14d, r14d
mov rcx, qword [rbp + 0xe8]
test rcx, rcx
je 0x18001dfe8
mov rdx, qword [rbp + 0xf8]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001dfd1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001dfd1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003b9d4
mov qword [rbp + 0xe8], r14
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xf0], xmm0
lea rcx, [rbp + 0xa8]
call fcn.180003150
nop
mov rdi, qword [rbp - 0x68]
test rdi, rdi
je 0x18001e08b
mov rsi, qword [rbp - 0x60]
cmp rdi, rsi
je 0x18001e025
nop dword [rax + rax]
mov rcx, rdi
call fcn.180002a60
add rdi, 0x28
cmp rdi, rsi
jne 0x18001e010
mov rdi, qword [rbp - 0x68]
mov rcx, qword [rbp - 0x58]
sub rcx, rdi
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rax, rdi
cmp rdx, 0x1000
jb 0x18001e077
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001e077
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.18003b9d4
mov qword [rbp - 0x68], r14
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x60], xmm0
mov rdx, qword [rbp - 0x80]
test rdx, rdx
je 0x18001e0b4
mov r8, qword [rbp - 0x70]
sub r8, rdx
sar r8, 3
lea rcx, [rbp - 0x80]
call fcn.18001bd60
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r14
mov rdx, qword [rbp + 0x62]
cmp rdx, 0x10
jb 0x18001e0f2
inc rdx
mov rcx, qword [rbp + 0x4a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001e0ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001e0ed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003b9d4
movdqa xmm0, xmmword [0x180046950]
movdqu xmmword [rbp + 0x5a], xmm0
mov byte [rbp + 0x4a], 0
mov rdx, qword [rbp + 0x92]
cmp rdx, 0x10
jb 0x18001e144
inc rdx
mov rcx, qword [rbp + 0x7a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001e13f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001e13f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003b9d4
movdqa xmm0, xmmword [0x180046950]
movdqu xmmword [rbp + 0x8a], xmm0
mov byte [rbp + 0x7a], 0
lea rcx, [rbp + 0x240]
call fcn.180002dc0
nop
lea rcx, [rbp + 0x1d0]
call fcn.180002e70
mov rax, rbx
mov rcx, qword [rbp + 0x4a0]
xor rcx, rsp
call fcn.18003bee0
lea r11, [rsp + 0x5d0]
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret