Function at 0x18005d220
Capabilities:
Execute command
Hash data with crc32
Self delete

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov r10, qword [0x1803a3798]
lea rdx, [0x1801b5a3d]
movaps xmmword [rsp + 0xc0], xmm7
lea r11, [0x1801ad630]
mov dword [rbp + 0x67], 0x43a00000
mov r8b, 0x43
mov dword [rbp + 0x6b], 0x43ee8000
mov rax, qword [r10 + 0x3ea0]
mov byte [rax + 0x98], 1
mov rax, qword [r10 + 0x3ea0]
movss xmm1, dword [rax + 0x18]
movss xmm0, dword [rax + 0x1c]
subss xmm1, dword [rax + 0x64]
subss xmm0, dword [rax + 0x68]
mov byte [rax + 0x121], 1
addss xmm1, dword [0x1801b9590]
addss xmm0, dword [0x1801b94ec]
movss dword [rax + 0xe0], xmm1
movss dword [rax + 0xe4], xmm0
mov rax, qword [r10 + 0x3ea0]
mov byte [rax + 0x98], 1
mov rax, qword [r10 + 0x3ea0]
movsxd rcx, dword [rax + 0xd0]
mov rax, qword [rax + 0xd8]
mov r9d, dword [rax + rcx*4 - 4]
not r9d
mov ebx, r9d
nop dword [rax]
cmp r8b, 0x23
jne 0x18005d2f3
cmp byte [rdx], r8b
jne 0x18005d2f3
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r11 + rcx*4]
test r8b, r8b
jne 0x18005d2e0
not ebx
cmp dword [r10 + 0x3ed4], ebx
jne 0x18005d32e
lea r8, str.Config
mov edx, 0xb
mov ecx, ebx
call fcn.180080a70
lea r8, [rbp + 0x67]
mov edx, ebx
lea rcx, str.Config
call fcn.1800585c0
mov rcx, qword [0x1803a3798]
movss xmm7, dword [0x1801b96b8]
mov rax, qword [rcx + 0x3ea0]
mov byte [rax + 0x98], 1
mov rax, qword [rcx + 0x3ea0]
cmp byte [rax + 0x9b], 0
jne 0x18005d381
movaps xmm1, xmm7
mov qword [rbp + 0x67], 0
lea rcx, [rbp + 0x67]
call fcn.1800796c0
mov qword [rsp + 0x118], rsi
lea rdx, [rbp + 0x67]
mov qword [rsp + 0x120], r12
mov qword [rsp + 0x128], r13
mov qword [rsp + 0xe8], r14
mov qword [rsp + 0xe0], r15
mov dword [rbp + 0x67], 0x435f0000
mov dword [rbp + 0x6b], 0x42c80000
call fcn.180073390
mov eax, dword [0x1801b7110]
lea rdx, [rbp - 0x49]
xorps xmm0, xmm0
mov dword [rbp - 0x21], eax
movzx eax, word [0x1801b7114]
lea rcx, [rbp - 0x29]
movdqu xmmword [rbp - 0x49], xmm0
xor edi, edi
mov qword [rbp - 0x19], 0xe
movsd xmm0, qword [str.C:_BaffClient_]
movsd qword [rbp - 0x29], xmm0
mov qword [rbp - 0x39], rdi
mov word [rbp - 0x1b], di
mov qword [rbp - 0x11], 0xf
mov word [rbp - 0x1d], ax
call fcn.180049b40
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x18005d44b
mov rcx, qword [rbp - 0x29]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005d446
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005d663
call fcn.1801148dc
lea rdx, [rbp - 0x69]
call fcn.180049f80
mov r15, qword [rbp - 0x69]
lea r12, [0x1803a1450]
mov r13, qword [rbp - 0x61]
mov rsi, r15
cmp r15, r13
je 0x18005d5d9
cmp qword [rsi + 0x18], 0x10
xorps xmm0, xmm0
mov qword [rbp - 0x19], rdi
mov ecx, 0x16
mov qword [rbp - 0x11], rdi
movabs rax, 0x7fffffffffffffff
mov rdi, qword [rsi + 0x10]
mov r14, rsi
movups xmmword [rbp - 0x29], xmm0
jb 0x18005d49e
mov r14, qword [rsi]
cmp rdi, rax
ja 0x18005de5e
cmp rdi, 0x10
jae 0x18005d4c4
mov ebx, 0xf
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x11], rbx
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x29], xmm0
jmp 0x18005d511
mov rbx, rdi
mov qword [rbp - 0x11], 0xf
or rbx, 0xf
cmp rbx, rax
jbe 0x18005d4dd
mov rbx, rax
jmp 0x18005d4e5
cmp rbx, 0x16
cmovb rbx, rcx
lea rdx, [rbx + 1]
call fcn.180007260
lea r8, [rdi + 1]
mov qword [rbp - 0x29], rax
mov rdx, r14
mov qword [rbp - 0x19], rdi
mov rcx, rax
mov qword [rbp - 0x11], rbx
call sub.VCRUNTIME140.dll_memcpy
mov rbx, qword [rbp - 0x11]
mov rdi, qword [rbp - 0x19]
cmp qword [0x1803a1468], 0x10
lea rcx, [rbp - 0x29]
mov r14, qword [rbp - 0x29]
mov rdx, r12
cmovae rdx, qword [0x1803a1450]
cmp rbx, 0x10
mov qword [rbp + 0x67], 0
cmovae rcx, r14
cmp rdi, qword [0x1803a1460]
jne 0x18005d555
mov r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x18005d555
mov dl, 1
jmp 0x18005d557
xor edx, edx
cmp rbx, 0x10
lea rcx, [rbp - 0x29]
lea r9, [rbp + 0x67]
cmovae rcx, r14
xor r8d, r8d
call fcn.18009cfb0
test al, al
je 0x18005d58d
cmp qword [rbp - 0x11], 0x10
lea rdx, [rbp - 0x29]
mov r8, qword [rbp - 0x19]
mov rcx, r12
cmovae rdx, qword [rbp - 0x29]
call fcn.180062250
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x18005d5c4
mov rcx, qword [rbp - 0x29]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005d5bf
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005d5d2
call fcn.1801148dc
add rsi, 0x20
xor edi, edi
cmp rsi, r13
jmp 0x18005d469
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test r15, r15
je 0x18005d61d
mov rdx, r13
mov rcx, r15
call fcn.180064df0
mov rdx, qword [rbp - 0x59]
mov rax, r15
sub rdx, r15
and rdx, 0xffffffffffffffe0
cmp rdx, 0x1000
jb 0x18005d615
mov r15, qword [r15 - 8]
add rdx, 0x27
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005d663
mov rcx, r15
call fcn.1801148dc
call fcn.180073430
mov rbx, qword [rbp - 0x49]
test rbx, rbx
je 0x18005d672
mov rdx, qword [rbp - 0x41]
mov rcx, rbx
call fcn.180064df0
mov rdx, qword [rbp - 0x39]
mov rax, rbx
sub rdx, rbx
and rdx, 0xffffffffffffffe0
cmp rdx, 0x1000
jb 0x18005d66a
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18005d66a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1801148dc
cmp byte [0x1803a48ab], 0
lea rsi, [0x1801b7130]
movaps xmmword [rsp + 0xd0], xmm6
lea rbx, str.Apply
movss xmm6, dword [0x1801b8e80]
lea rdx, [rbp + 0x67]
mov qword [rbp + 0x67], 0
jne 0x18005d6d7
cmp byte [0x1803a31ee], 0
lea rax, [0x1801b7118]
lea rcx, str.Save
cmovne rcx, rax
call fcn.18008dd70
test al, al
je 0x18005d7db
mov byte [0x1803a48ab], 1
jmp 0x18005d7db
cmp byte [0x1803a31ee], 0
mov rcx, rbx
cmovne rcx, rsi
call fcn.18008dd70
test al, al
je 0x18005d7db
mov rdx, r12
lea rcx, [rbp - 9]
call fcn.180061ce0
mov rcx, rax
call fcn.18001e920
mov eax, dword [str.Saved]
lea r9, [rbp - 0x49]
movdqa xmm1, xmmword [0x1801b97f0]
lea r8, [rbp - 0x69]
movd xmm3, dword [0x1803a2480]
lea rdx, [rbp - 0x29]
movd xmm4, dword [0x1803a2484]
lea rcx, [rbp - 9]
movd xmm5, dword [0x1803a2488]
xorps xmm0, xmm0
movaps xmm2, xmmword [0x1801b9ce0]
movups xmmword [rbp - 0x29], xmm0
mov dword [rbp - 0x29], eax
movzx eax, byte [0x1801b5a38]
movups xmmword [rbp - 9], xmm0
mov dword [rbp - 0x5d], 0x3f800000
movups xmm0, xmmword [rbp - 0x69]
mov byte [rbp - 0x25], al
mov eax, dword [str.Config]
cvtdq2ps xmm3, xmm3
mov dword [rbp - 9], eax
movzx eax, word [0x1801b5a40]
mov byte [rbp - 0x24], 0
mov word [rbp - 5], ax
cvtdq2ps xmm4, xmm4
mov byte [rbp - 3], 0
mulss xmm3, xmm6
cvtdq2ps xmm5, xmm5
movss xmm0, xmm3
mulss xmm4, xmm6
shufps xmm0, xmm0, 0xe1
mulss xmm5, xmm6
movss xmm0, xmm4
movdqa xmmword [rbp - 0x49], xmm2
shufps xmm0, xmm0, 0xc6
movss xmm0, xmm5
shufps xmm0, xmm0, 0xc9
movdqu xmmword [rbp - 0x19], xmm1
movdqa xmm1, xmmword [0x1801b9800]
movups xmmword [rbp - 0x69], xmm0
movdqa xmmword [rbp - 0x69], xmm0
movdqu xmmword [rbp + 7], xmm1
call fcn.180027c70
mov byte [0x1803a48ab], 0
mov rax, qword [0x1803a3798]
mov rcx, qword [rax + 0x3ea0]
cmp byte [rcx + 0x9b], 0
jne 0x18005d83d
movss xmm1, dword [rax + 0x382c]
movss xmm0, dword [rcx + 0xec]
addss xmm1, dword [rcx + 0xe8]
movss dword [rcx + 0xe0], xmm1
movss dword [rcx + 0xe4], xmm0
movsd xmm0, qword [rcx + 0x110]
mov eax, dword [rcx + 0x11c]
movsd qword [rcx + 0x108], xmm0
mov dword [rcx + 0x118], eax
mov byte [rcx + 0x120], 1
cmp byte [0x1803a48ac], 0
lea rdx, [rbp + 0x67]
mov qword [rbp + 0x67], 0
jne 0x18005d884
cmp byte [0x1803a31ee], 0
lea rax, [0x1801b7148]
lea rcx, str.Load
cmovne rcx, rax
call fcn.18008dd70
test al, al
je 0x18005d981
mov byte [0x1803a48ac], 1
jmp 0x18005d981
cmp byte [0x1803a31ee], 0
mov rcx, rbx
cmovne rcx, rsi
call fcn.18008dd70
test al, al
je 0x18005d981
mov rdx, r12
lea rcx, [rbp - 9]
call fcn.180061ce0
mov rcx, rax
call fcn.180024270
mov eax, dword [str.Loaded]
lea r9, [rbp - 0x49]
movdqa xmm1, xmmword [0x1801b9800]
lea r8, [rbp - 0x69]
movd xmm3, dword [0x1803a2480]
lea rdx, [rbp - 9]
movd xmm4, dword [0x1803a2484]
lea rcx, [rbp - 0x29]
movd xmm5, dword [0x1803a2488]
xorps xmm0, xmm0
movaps xmm2, xmmword [0x1801b9ce0]
movups xmmword [rbp - 9], xmm0
mov dword [rbp - 9], eax
movzx eax, word [0x1801b5a50]
movups xmmword [rbp - 0x29], xmm0
mov dword [rbp - 0x5d], 0x3f800000
movups xmm0, xmmword [rbp - 0x69]
mov word [rbp - 5], ax
mov eax, dword [str.Config]
cvtdq2ps xmm3, xmm3
mov dword [rbp - 0x29], eax
movzx eax, word [0x1801b5a40]
mov byte [rbp - 3], 0
mov word [rbp - 0x25], ax
cvtdq2ps xmm4, xmm4
mov byte [rbp - 0x23], 0
mulss xmm3, xmm6
cvtdq2ps xmm5, xmm5
movss xmm0, xmm3
mulss xmm4, xmm6
shufps xmm0, xmm0, 0xe1
mulss xmm5, xmm6
movss xmm0, xmm4
movdqa xmmword [rbp - 0x49], xmm2
shufps xmm0, xmm0, 0xc6
movss xmm0, xmm5
shufps xmm0, xmm0, 0xc9
movups xmmword [rbp - 0x69], xmm0
movdqa xmmword [rbp - 0x69], xmm0
movdqu xmmword [rbp + 7], xmm1
movdqu xmmword [rbp - 0x19], xmm1
call fcn.180027c70
mov byte [0x1803a48ac], 0
mov rcx, qword [0x1803a3798]
mov rax, qword [rcx + 0x3ea0]
mov byte [rax + 0x98], 1
mov rax, qword [rcx + 0x3ea0]
cmp byte [rax + 0x9b], 0
jne 0x18005d9ba
movaps xmm1, xmm7
mov qword [rbp + 0x67], 0
lea rcx, [rbp + 0x67]
call fcn.1800796c0
cmp byte [0x1803a36b0], 0
lea rdx, [rbp + 0x67]
mov qword [rbp + 0x67], 0
jne 0x18005da01
cmp byte [0x1803a31ee], 0
lea rax, [0x1801b7160]
lea rcx, str.Delete
cmovne rcx, rax
call fcn.18008dd70
test al, al
je 0x18005db19
mov byte [0x1803a36b0], 1
jmp 0x18005db19
cmp byte [0x1803a31ee], 0
cmovne rbx, rsi
mov rcx, rbx
call fcn.18008dd70
test al, al
je 0x18005db19
cmp qword [0x1803a1468], 0x10
cmovae r12, qword [0x1803a1450]
mov rdx, r12
call fcn.18004a980
mov rax, qword [str.Removed]
lea r9, [rbp - 0x49]
movdqa xmm0, xmmword [0x1801b9790]
lea r8, [rbp - 0x69]
movd xmm3, dword [0x1803a2480]
lea rdx, [rbp - 0x29]
movd xmm4, dword [0x1803a2484]
lea rcx, [rbp - 9]
movd xmm5, dword [0x1803a2488]
movaps xmm2, xmmword [0x1801b9ce0]
movdqa xmm1, xmmword [0x1801b9800]
movdqu xmmword [rbp - 0x21], xmm0
mov dword [rbp - 0x29], eax
movzx eax, word [0x1801b5a5c]
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
mov word [rbp - 0x25], ax
movzx eax, byte [0x1801b5a5e]
mov dword [rbp - 0x5d], 0x3f800000
movups xmm0, xmmword [rbp - 0x69]
mov byte [rbp - 0x23], al
mov eax, dword [str.Config]
cvtdq2ps xmm3, xmm3
mov dword [rbp - 9], eax
movzx eax, word [0x1801b5a40]
mov qword [rbp - 0x11], 0xf
mov byte [rbp - 0x22], 0
cvtdq2ps xmm4, xmm4
mov word [rbp - 5], ax
mov byte [rbp - 3], 0
mulss xmm3, xmm6
cvtdq2ps xmm5, xmm5
movss xmm0, xmm3
mulss xmm4, xmm6
shufps xmm0, xmm0, 0xe1
mulss xmm5, xmm6
movss xmm0, xmm4
movdqa xmmword [rbp - 0x49], xmm2
shufps xmm0, xmm0, 0xc6
movss xmm0, xmm5
shufps xmm0, xmm0, 0xc9
movups xmmword [rbp - 0x69], xmm0
movdqa xmmword [rbp - 0x69], xmm0
movdqu xmmword [rbp + 7], xmm1
call fcn.180027c70
mov byte [0x1803a36b0], 0
mov rax, qword [0x1803a3798]
mov rcx, qword [rax + 0x3ea0]
cmp byte [rcx + 0x9b], 0
jne 0x18005db7b
movss xmm1, dword [rax + 0x382c]
movss xmm0, dword [rcx + 0xec]
addss xmm1, dword [rcx + 0xe8]
movss dword [rcx + 0xe0], xmm1
movss dword [rcx + 0xe4], xmm0
movsd xmm0, qword [rcx + 0x110]
mov eax, dword [rcx + 0x11c]
movsd qword [rcx + 0x108], xmm0
mov dword [rcx + 0x118], eax
mov byte [rcx + 0x120], 1
cmp byte [0x1803a31ee], 0
lea rax, [0x1801b7178]
lea rcx, str.Create
mov qword [rbp + 0x67], 0
cmovne rcx, rax
lea rdx, [rbp + 0x67]
call fcn.18008dd70
test al, al
je 0x18005dbb2
mov byte [0x1803a31ef], 1
jmp 0x18005dbbf
cmp byte [0x1803a31ef], 0
je 0x18005dd44
mov qword [rsp + 0x38], rdi
lea rax, [rbp + 0x67]
mov qword [rsp + 0x30], rdi
lea rbx, [0x180278e10]
mov dword [rsp + 0x28], edi
lea rcx, [0x1801b1ee7]
mov r8, rbx
mov qword [rsp + 0x20], rax
mov r9d, pe_nt_image_headers64
mov qword [rbp + 0x67], 0
xor edx, edx
call fcn.180094b40
cmp byte [0x1803a31ee], 0
lea rcx, str.Accept
lea rdx, [rbp + 0x67]
mov qword [rbp + 0x67], 0
cmovne rcx, rsi
call fcn.18008dd70
test al, al
je 0x18005dd44
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 9], xmm0
mov r8, 0xffffffffffffffff
movdqu xmmword [rbp + 7], xmm1
nop dword [rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x18005dc40
mov rdx, rbx
lea rcx, [rbp - 9]
call fcn.180007050
lea rcx, [rbp - 9]
call fcn.180021580
mov rax, qword [str.Created]
lea r9, [rbp - 0x49]
movdqa xmm0, xmmword [0x1801b9790]
lea r8, [rbp - 0x69]
movd xmm3, dword [0x1803a2480]
lea rdx, [rbp - 0x29]
movd xmm4, dword [0x1803a2484]
lea rcx, [rbp - 9]
movd xmm5, dword [0x1803a2488]
movaps xmm2, xmmword [0x1801b9ce0]
movdqa xmm1, xmmword [0x1801b9800]
movdqu xmmword [rbp - 0x21], xmm0
mov dword [rbp - 0x29], eax
movzx eax, word [0x1801b5a74]
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
mov word [rbp - 0x25], ax
movzx eax, byte [0x1801b5a76]
mov dword [rbp - 0x5d], 0x3f800000
movups xmm0, xmmword [rbp - 0x69]
mov byte [rbp - 0x23], al
mov eax, dword [str.Config]
cvtdq2ps xmm3, xmm3
mov dword [rbp - 9], eax
movzx eax, word [0x1801b5a40]
mov qword [rbp - 0x11], 0xf
mov byte [rbp - 0x22], 0
cvtdq2ps xmm4, xmm4
mov word [rbp - 5], ax
mov byte [rbp - 3], 0
mulss xmm3, xmm6
cvtdq2ps xmm5, xmm5
movss xmm0, xmm3
mulss xmm4, xmm6
shufps xmm0, xmm0, 0xe1
mulss xmm5, xmm6
movss xmm0, xmm4
movdqa xmmword [rbp - 0x49], xmm2
shufps xmm0, xmm0, 0xc6
movss xmm0, xmm5
shufps xmm0, xmm0, 0xc9
movups xmmword [rbp - 0x69], xmm0
movdqa xmmword [rbp - 0x69], xmm0
movdqu xmmword [rbp + 7], xmm1
call fcn.180027c70
mov byte [0x1803a31ef], 0
cmp byte [0x1803a31ee], 0
lea rax, [0x1801b7188]
lea rcx, str.Open_Folder
mov qword [rbp + 0x67], 0
cmovne rcx, rax
lea rdx, [rbp + 0x67]
call fcn.18008dd70
movaps xmm6, xmmword [rsp + 0xd0]
test al, al
je 0x18005dd87
lea rcx, str.start_C:BaffClient
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rbp + 0x67]
mov qword [rbp + 0x67], 0
lea rcx, str.baffclient_zagryjen
call fcn.18008dd70
test al, al
je 0x18005ddb6
xor edx, edx
lea rcx, str.RIFF
lea r8d, [rdx + 5]
call qword [sym.imp.WINMM.dll_PlaySoundA]
cmp byte [0x1803a31ee], 0
lea rax, [0x1801b71d8]
lea rcx, str.Unload_Cheat
mov qword [rbp + 0x67], 0
cmovne rcx, rax
lea rdx, [rbp + 0x67]
call fcn.18008dd70
test al, al
je 0x18005de1f
mov ecx, 0x12c
mov byte [0x1803a362d], 0
mov byte [0x1803a3629], 0
mov dword [0x180278f20], 0
mov dword [0x180278dec], 0x3f800000
mov byte [0x1803a3604], 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [0x1803a3565], 1
mov r15, qword [rsp + 0xe0]
mov r14, qword [rsp + 0xe8]
mov r13, qword [rsp + 0x128]
mov r12, qword [rsp + 0x120]
mov rsi, qword [rsp + 0x118]
movaps xmm7, xmmword [rsp + 0xc0]
add rsp, 0xf0
pop rdi
pop rbx
pop rbp
jmp fcn.180073430
call fcn.180006bc0
int3