Function at 0x18004bb10
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x560]
sub rsp, 0x660
mov rax, qword [0x180071748]
xor rax, rsp
mov qword [rbp + 0x550], rax
mov rsi, r9
mov rdi, rcx
movdqa xmm0, xmmword [0x18006c7d0]
movdqa xmmword [rbp + 0x1f0], xmm0
mov byte [rbp + 0x1e0], 0
movdqa xmm1, xmm0
movdqa xmmword [rbp + 0x210], xmm0
mov byte [rbp + 0x200], 0
movdqa xmmword [rbp + 0x230], xmm0
mov byte [rbp + 0x220], 0
movdqa xmmword [rbp + 0x260], xmm0
mov byte [rbp + 0x250], 0
movdqa xmmword [rbp + 0x280], xmm0
mov byte [rbp + 0x270], 0
xor ecx, ecx
mov qword [rbp + 0x80], rcx
mov word [rbp + 0x88], cx
movdqu xmmword [rbp + 0x9a], xmm0
mov byte [rbp + 0x8a], cl
mov qword [rbp + 0x50], rcx
mov word [rbp + 0x58], cx
movdqu xmmword [rbp + 0x6a], xmm0
mov byte [rbp + 0x5a], cl
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], rcx
movdqa xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rcx
mov qword [rbp], rcx
mov qword [rbp + 0xb0], rcx
mov qword [rbp + 0xb8], rcx
mov qword [rbp + 0xc0], rcx
mov ecx, 0x30
call fcn.1800648c4
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0xb8], rax
xor r11d, r11d
mov qword [rbp + 0xc8], r11
xorps xmm2, xmm2
movsd qword [rbp + 0xd0], xmm2
mov qword [rbp + 0xd8], r11
mov dword [rbp + 0xe0], 1
mov qword [rbp + 0xe8], r11
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xf0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x100], xmm1
movdqa xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], r11
mov qword [rbp + 0x128], 0xffffffffffffffff
mov dword [rbp + 0x130], r11d
xor eax, eax
movups xmmword [rbp + 0x138], xmm0
movups xmmword [rbp + 0x148], xmm0
movups xmmword [rbp + 0x158], xmm0
movups xmmword [rbp + 0x168], xmm0
mov qword [rbp + 0x178], rax
movdqa xmm0, xmmword [0x18006c7d0]
movdqa xmmword [rbp + 0x190], xmm0
mov byte [rbp + 0x180], al
mov word [rbp + 0x1a0], r11w
mov dword [rbp + 0x1a4], r11d
mov qword [rbp + 0x1a8], r11
xorps xmm0, xmm0
movaps xmmword [rbp + 0x1b0], xmm0
movsd qword [rbp + 0x1c0], xmm2
mov byte [rbp + 0x1c8], al
mov qword [rbp + 0x1cc], r11
mov r13d, dword [rbp + 0x5c0]
lea r15d, [r13 + 0xd]
lea r8, [0x180000000]
cmp r13d, r15d
jae 0x18004bf93
lea r14d, [r13 - 0xbe]
mov r12d, dword [rsp + 0x70]
mov edx, 0x43
cmp r14d, 0x49
ja case.0x18004bd41.13
movzx eax, byte [r8 + r14 + 0x4cbec]
mov ecx, dword [r8 + rax*4 + 0x4cbb4]
add rcx, r8
jmp rcx
cmp qword [rsi + 0x38], 0
je 0x18004be36
mov ecx, r12d
call qword [sym.imp.RPCRT4.dll_I_RpcMapWin32Status]
cmp qword [rsi + 0x20], 0
setne byte [rsp + 0x60]
jmp case.0x18004bd41.13
mov byte [rbp + 0x298], 0
jmp case.0x18004bd41.13
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], 0x120
mov r9, rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180059fe0
cmp eax, 2
jne case.0x18004bd41.13
mov dword [rsp + 0x68], 1
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9, rsi
xor edx, edx
xor ecx, ecx
mov r8d, 0xd6
call fcn.180038b70
jmp case.0x18004bd41.13
mov byte [rsp + 0x60], 1
jmp case.0x18004bd41.13
mov eax, dword [0x18006ac1a]
mov dword [rbp + 0x298], eax
movzx eax, byte [0x18006ac1e]
mov byte [rbp + 0x29c], al
mov byte [rbp + 0x29d], 0
jmp case.0x18004bd41.13
mov r8d, 4
lea rdx, str.webexceptionTimeOut
lea rcx, [rbp + 0x290]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp case.0x18004bd41.13
lea rax, [rsi + 8]
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], rax
mov r9d, 0xe2
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180015910
test al, al
jne case.0x18004bd41.13
mov byte [rsp + 0x60], 0
mov ebx, dword [rsp + 0x60]
jmp case.0x18004c0f3.17
mov dword [rbp + 0x294], 0x6f6f7472
jmp case.0x18004bd41.13
mov qword [rdi], r11
mov rbx, qword [rsi + 8]
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
jne 0x18004bef9
nop word [rax + rax]
lea rax, [rbx + 0x20]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x44]
mov rcx, rsi
call fcn.180057a80
mov qword [rsp + 0x78], rax
movsd xmm0, qword [rsp + 0x78]
addsd xmm0, qword [rdi]
movsd qword [rdi], xmm0
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x18004beca
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x18004bec5
cmp rbx, qword [rax + 0x10]
jne 0x18004bec5
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x18004beb2
mov rbx, rax
jmp 0x18004beef
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x18004beef
nop word [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x18004bee0
cmp byte [rbx + 0x19], 0
je 0x18004be70
mov rcx, qword [rsi + 0x10]
xorps xmm1, xmm1
test rcx, rcx
js 0x18004bf18
cvtsi2sd xmm1, rcx
movsd xmm0, qword [rdi]
divsd xmm0, xmm1
movsd qword [rdi], xmm0
jmp case.0x18004bd41.13
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm1, rax
addsd xmm1, xmm1
movsd xmm0, qword [rdi]
divsd xmm0, xmm1
movsd qword [rdi], xmm0
jmp case.0x18004bd41.13
cmp qword [rsi + 0x28], 0
je 0x18004be36
mov r12d, r11d
cmp qword [rsi + 0x30], 0
je 0x18004be36
jmp case.0x18004bd41.13
mov word [rbp + 0x2a0], dx
mov dword [rbp + 0x2a1], 0x696e556f
inc r14d
lea eax, [r14 + 0xbe]
xor r11d, r11d
cmp eax, r15d
jae 0x18004bf93
lea r8, [0x180000000]
jmp 0x18004bd1e
mov rax, qword [rsi]
mov ebx, dword [rax + 0x220]
jmp case.0x18004c0f3.17
mov esi, r13d
imul r12d, r13d, 0x5f1
mov ebx, dword [rsp + 0x60]
mov rax, qword [rsp + 0x78]
mov qword [rbp - 0x48], rax
cmp r13d, r12d
ja 0x18004c47b
mov edx, 0x65
lea r9d, [rdx + 9]
lea r10d, [rdx + 0xf]
lea r8d, [rdx + 0x15]
mov r13, qword [rbp - 0x80]
mov r15, qword [rbp - 0x80]
movzx r14d, byte [rsp + 0x68]
mov eax, esi
mov ecx, 0x69
cmp esi, 0xeeac
ja 0x18004c378
je 0x18004c365
cmp esi, 0x647c
ja 0x18004c05e
je 0x18004c040
mov eax, esi
sub eax, 0xda
je 0x18004c024
sub eax, 0x1c
je case.0x18004c0f3.17
cmp eax, 0xe
mov eax, dword [rbp + 0x5c0]
jne 0x18004c462
mov word [rbp + 0x29d], 0x6f66
jmp 0x18004c462
mov word [rbp + 0x2a5], r9w
mov word [rbp + 0x2a6], cx
mov word [rbp + 0x2a7], r10w
jmp 0x18004c45c
mov word [rbp + 0x2a8], cx
mov dword [rbp + 0x2a9], 0x696c61
mov word [rbp + 0x2ac], r8w
jmp 0x18004c462
cmp esi, 0x77d8
je 0x18004c098
cmp esi, 0xc81e
jne 0x18004c462
mov word [rbp + 0x2ad], dx
mov r8d, 2
lea rdx, [0x180069f18]
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp 0x18004c44a
mov byte [rbp + 0x29f], 0
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], 0x117
xor r9d, r9d
lea r8, [0x180071458]
xor edx, edx
xor ecx, ecx
call fcn.180041710
test al, al
jne 0x18004c44a
xor r11d, r11d
mov edi, r11d
cmp edi, 0x11
ja case.0x18004c0f3.13
mov eax, edi
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0x4cc38]
add rcx, rdx
jmp rcx
movabs rax, 0x20006e00750070
mov qword [rbp + 0x2ee], rax
mov word [rbp + 0x2f6], r11w
jmp case.0x18004c0f3.13
mov r8d, 2
lea rdx, [0x180069f18]
lea rcx, [rbp + 0x2da]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov r8d, 4
lea rdx, [0x18006ac50]
lea rcx, [rbp + 0x2dc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor r11d, r11d
jmp case.0x18004c0f3.13
mov dword [rbp + 0x2ce], 0x65
movabs rax, 0x6f00720046
mov qword [rbp + 0x2d0], rax
mov r8d, 3
lea rdx, [0x18006ac58]
lea rcx, [rbp + 0x2d6]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor r11d, r11d
jmp case.0x18004c0f3.13
mov r8d, 2
lea rdx, [0x18006ac72]
lea rcx, [rbp + 0x2e8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8d, 3
lea rdx, [0x18006acb0]
lea rcx, [rbp + 0x2e8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov eax, 0x61
mov word [rbp + 0x314], ax
xor r11d, r11d
jmp case.0x18004c0f3.13
mov eax, 0xdc
mov word [rbp + 0x384], ax
mov dword [rsp + 0x60], r11d
jmp case.0x18004c0f3.13
mov r8d, 1
lea rdx, [0x18006ace4]
lea rcx, [rbp + 0x2e8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8d, 1
lea rdx, [0x18006ad62]
lea rcx, [rbp + 0x2e8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
xor r11d, r11d
jmp case.0x18004c0f3.13
mov edx, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.SHELL32.dll_DragAcceptFiles]
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xor r11d, r11d
jmp case.0x18004c0f3.13
mov dword [rbp + 0x2f6], 0x610042
mov word [rbp + 0x2fa], r11w
mov r8d, 5
lea rdx, [0x18006adba]
lea rcx, [rbp + 0x2e8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
xor r11d, r11d
jmp case.0x18004c0f3.13
lea r9, [rbp + 0x340]
xor r8d, r8d
lea rdx, [rbp + 0x2e8]
lea rcx, [rbp + 0x2c8]
call qword [sym.imp.GDI32.dll_CreateDCW]
mov r15, rax
test rax, rax
jne 0x18004c147
xor r14b, r14b
xor r11d, r11d
jmp case.0x18004c0f3.13
mov r14b, 1
mov qword [rsp + 0x78], r11
jmp case.0x18004c0f3.13
mov qword [rbp + 0x10], r11
xor edx, edx
mov r8d, 0xdc
lea rcx, [rbp + 0x340]
call sub.VCRUNTIME140.dll_memset
xor r11d, r11d
jmp case.0x18004c0f3.13
test r14b, r14b
je 0x18004c2e5
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteDC]
lea rdx, [rbp + 0x40]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.GDI32.dll_RectInRegion]
mov ebx, 1
xor r11d, r11d
jmp case.0x18004c0f3.13
mov eax, dword [0x18006add8]
mov dword [rbp + 0x2c8], eax
mov dword [rbp + 0x2cc], 0x70
jmp case.0x18004c0f3.13
mov dword [rbp + 0x304], 0x41
jmp case.0x18004c0f3.13
mov eax, dword [0x18006ade8]
mov dword [rbp + 0x2e8], eax
movzx eax, word [0x18006adec]
mov word [rbp + 0x2ec], ax
mov word [rbp + 0x2ee], r11w
jmp case.0x18004c0f3.13
mov word [rbp + 0x316], r11w
inc edi
lea eax, [rdi + 0x105]
cmp eax, 0x117
jb 0x18004c0d7
jmp 0x18004c44a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
jmp 0x18004c44a
cmp esi, 0x1f304
ja 0x18004c413
je 0x18004c3f7
cmp esi, 0x12bc0
je 0x18004c3ba
cmp esi, 0x16580
je 0x18004c3b1
cmp esi, 0x18f62
jne 0x18004c462
mov dword [rbp + 0x2bc], 0x64
jmp 0x18004c462
mov qword [rbp - 0x48], r11
jmp 0x18004c462
mov r8d, 4
lea rdx, [0x18006ac48]
lea rcx, [rbp + 0x2b2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov r8d, 0xa
lea rdx, [rbp + 0x2b8]
lea ecx, [r8 - 8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ltow]
mov dword [rbp + 0x2ba], 0x2e
jmp 0x18004c44a
mov eax, dword [0x1800694c8]
mov dword [rbp + 0x2be], eax
movzx eax, word [0x1800694cc]
mov word [rbp + 0x2c2], ax
jmp 0x18004c45c
cmp esi, 0x256a6
je 0x18004c428
cmp esi, 0x2ba48
jne 0x18004c462
call r13
jmp 0x18004c44a
mov qword [rsp + 0x20], r11
xor r9d, r9d
lea r8, [rbp + 0x2a0]
lea edx, [r9 + 0x25]
lea rcx, [rbp + 0x2b0]
call fcn.18002be80
mov r13, rax
mov r10d, 0x74
lea r9d, [r10 - 6]
lea r8d, [r10 + 6]
lea edx, [r10 - 0xf]
mov eax, dword [rbp + 0x5c0]
imul ecx, eax, 0x75
add esi, ecx
cmp esi, r12d
ja 0x18004c474
xor r11d, r11d
jmp 0x18004bfd4
mov r13d, dword [rbp + 0x5c0]
lea edi, [r13 - 0xe]
mov dword [rsp + 0x60], edi
cmp r13d, edi
jbe case.0x18004c0f3.17
lea edi, [r13 - 0xf7]
mov dword [rsp + 0x68], edi
lea r9, [0x180071450]
mov edx, 0x1bb
lea r8, [0x180009b80]
mov r15, qword [rbp - 0x80]
mov r12d, dword [rsp + 0x70]
mov r13d, dword [rsp + 0x70]
movzx esi, byte [rsp + 0x68]
mov r14, qword [rbp - 0x80]
mov eax, dword [rsp + 0x60]
mov ecx, dword [rbp + 0x5c0]
nop dword [rax + rax]
cmp edi, 0xd
ja case.default.0x18004c4eb
lea r10, [0x180000000]
mov ecx, dword [r10 + rdi*4 + 0x4cc80]
add rcx, r10
jmp rcx
mov eax, 0x90
cmp eax, 0x90
je 0x18004c93f
add eax, 0xbd0
cmp eax, 0xbd0
jbe 0x18004c4f2
mov qword [rsp + 0x20], r9
lea r9, [rbp - 0x40]
xor r8d, r8d
lea rdx, [rbp + 0xb0]
lea ecx, [r8 + 0x67]
call fcn.180019700
mov qword [rsp + 0x28], 0
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, 0xa1
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180015910
mov eax, dword [rbp - 0x60]
mov dword [rsp + 0x50], eax
mov eax, dword [rbp - 0x6c]
mov dword [rsp + 0x48], eax
mov eax, dword [rbp - 0x78]
mov dword [rsp + 0x40], eax
mov eax, dword [rbp - 0x4c]
mov dword [rsp + 0x38], eax
mov eax, dword [rbp - 0x54]
mov dword [rsp + 0x30], eax
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp - 0x50]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp - 0x68]
mov r8d, dword [rsp + 0x70]
mov edx, dword [rbp - 0x58]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.GDI32.dll_GdiTransparentBlt]
mov edx, 0x1bb
lea r8, [0x180009b80]
lea r9, [0x180071450]
jmp 0x18004c91e
mov dword [rbp - 0x78], 0xa
xor r11d, r11d
mov qword [rbp + 0x18], r11
cmp qword [rsp + 0x78], r11
jne 0x18004c91e
mov edi, 0x30
nop dword [rax + rax]
cmp edi, 0x85b0
ja 0x18004c657
je 0x18004c63e
cmp edi, 0x30
je 0x18004c639
cmp edi, 0x2190
je 0x18004c629
cmp edi, 0x42f0
je 0x18004c61d
cmp edi, 0x6450
jne 0x18004c6b2
mov qword [rbp + 0x20], r11
mov r9d, 0x78
mov r8d, dword [rbp - 0x74]
mov edx, r13d
mov ecx, r12d
call qword [sym.imp.GDI32.dll_CreateEllipticRgn]
mov r14, rax
jmp 0x18004c6af
mov dword [rbp - 0x74], 0x64
jmp 0x18004c6b2
mov r15, r11
mov r12d, 0xa
lea r13d, [r12 + 0xa]
jmp 0x18004c6b2
mov sil, 1
jmp 0x18004c6b2
mov dword [rbp - 0x70], 0x104
mov ecx, r11d
movzx eax, sil
test r14, r14
cmovne ecx, eax
movzx esi, cl
jmp 0x18004c6b2
cmp edi, 0xa710
je 0x18004c67c
cmp edi, 0xc870
je 0x18004c675
cmp edi, 0xe9d0
je case.0x18004c0f3.17
jmp 0x18004c6b2
mov ebx, 1
jmp 0x18004c6b2
mov eax, dword [rbp - 0x70]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x340]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x20]
lea r8, [rbp + 0x10]
xor edx, edx
mov rcx, r15
call sub.SHELL32.dll_SHGetUnreadMailCountW
test sil, sil
je 0x18004c6af
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteObject]
xor r11d, r11d
add edi, 0x2160
cmp edi, 0x10b00
jbe 0x18004c5d0
mov edi, dword [rsp + 0x68]
jmp 0x18004c595
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp - 0x6c], 0xa
jmp 0x18004c595
mov r8d, 0x106
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x250]
call fcn.1800187d0
mov dword [rbp - 0x68], 0xa
mov eax, 0x1bb
mov word [rsp + 0x68], ax
mov dword [rsp + 0x20], 0x50
xor r9d, r9d
lea r8, [0x1800714b8]
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x68]
call fcn.18004cd20
jmp 0x18004c595
mov qword [rbp - 0x60], r8
mov edx, ILRemoveLastID
lea rcx, [rbp - 0x60]
call fcn.1800052d0
mov dword [rbp - 0x60], 0
jmp 0x18004c595
lea rax, [rbp + 0x80]
mov qword [rsp + 0x68], rax
mov rdx, qword [rbp - 0x38]
cmp rdx, qword [rbp - 0x30]
je 0x18004c782
lea rax, [rbp + 0x80]
mov qword [rdx], rax
mov rdx, qword [rbp - 0x38]
add rdx, 8
mov qword [rbp - 0x38], rdx
jmp 0x18004c794
lea r8, [rsp + 0x68]
lea rcx, [rbp - 0x40]
call fcn.180001cf0
mov rdx, qword [rbp - 0x38]
lea rax, [rbp + 0x50]
mov qword [rsp + 0x68], rax
cmp rdx, qword [rbp - 0x30]
je 0x18004c7b1
lea rax, [rbp + 0x50]
mov qword [rdx], rax
add qword [rbp - 0x38], 8
jmp 0x18004c7bf
lea r8, [rsp + 0x68]
lea rcx, [rbp - 0x40]
call fcn.180001cf0
mov eax, dword [0x180071500]
mov dword [rsp + 0x68], eax
mov r9d, 0x59
lea r8, [rsp + 0x68]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x2e8]
call fcn.180023620
jmp 0x18004c595
lea rax, [rbp + 0x290]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18004c800
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0x1e0]
call fcn.180032690
mov dword [rbp - 0x58], 0
mov r8d, 1
lea rdx, [0x180069e24]
lea rcx, [rbp + 0x200]
call fcn.180032690
jmp 0x18004c595
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
mov r9d, 0x81
lea r8, [rbp - 0x40]
xor edx, edx
xor ecx, ecx
call fcn.1800347f0
mov dword [rbp - 0x54], 0
jmp 0x18004c595
mov word [rsp + 0x68], dx
mov r9d, 0x129
lea r8, [rbp + 0x50]
lea rdx, [rsp + 0x68]
lea rcx, [0x1800714d8]
call fcn.18005b9c0
mov qword [rbp + 0x28], 0
jmp 0x18004c595
mov qword [rbp - 0x80], 0
lea rdx, [rbp + 0x220]
mov ecx, 0xb3
call fcn.18000cc40
jmp 0x18004c595
mov dword [rbp - 0x50], 0xa
jmp 0x18004c91e
xor ecx, ecx
mov dword [rbp - 0x4c], ecx
lea rax, [rbp - 0x40]
mov qword [rbp + 0x40], rax
mov eax, dword [0x180071500]
mov dword [rbp + 0x48], eax
mov eax, dword [0x180071504]
mov dword [rbp + 0x4c], eax
movaps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x30], xmm0
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ecx
lea r9, [rbp + 0x30]
lea r8, [0x180013e10]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x78], rax
jmp 0x18004c595
mov word [rbp + 0x240], dx
mov dword [rsp + 0x70], 0
mov eax, dword [rsp + 0x60]
mov ecx, dword [rbp + 0x5c0]
dec ecx
mov dword [rbp + 0x5c0], ecx
dec edi
mov dword [rsp + 0x68], edi
cmp ecx, eax
jbe case.0x18004c0f3.17
jmp 0x18004c4d0
lea rdx, [rbp + 0x18]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.SHELL32.dll_DragQueryPoint]
xor ebx, ebx
lea rcx, [rbp + 0x128]
call fcn.180003d70
mov rdi, qword [rbp + 0x110]
test rdi, rdi
je 0x18004c9bf
mov rsi, qword [rbp + 0x118]
cmp rdi, rsi
je 0x18004c98b
mov rcx, rdi
call fcn.180031ac0
add rdi, 0x20
cmp rdi, rsi
jne 0x18004c973
mov rdi, qword [rbp + 0x110]
mov r8, qword [rbp + 0x120]
sub r8, rdi
sar r8, 5
mov rdx, rdi
lea rcx, [rbp + 0x110]
call fcn.18003e9b0
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x110], xmm0
xor r14d, r14d
mov qword [rbp + 0x120], r14
jmp 0x18004c9c2
xor r14d, r14d
mov rdx, qword [rbp + 0xf8]
test rdx, rdx
je 0x18004c9fa
mov r8, qword [rbp + 0x108]
sub r8, rdx
sar r8, 4
lea rcx, [rbp + 0xf8]
call fcn.18003e910
mov qword [rbp + 0xf8], r14
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x100], xmm0
lea rcx, [rbp + 0xb8]
call fcn.180003ca0
nop
mov rdi, qword [rbp - 0x28]
test rdi, rdi
je 0x18004ca9b
mov rsi, qword [rbp - 0x20]
cmp rdi, rsi
je 0x18004ca35
nop dword [rax]
mov rcx, rdi
call fcn.1800035b0
add rdi, 0x28
cmp rdi, rsi
jne 0x18004ca20
mov rdi, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x18]
sub rcx, rdi
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rax, rdi
cmp rdx, 0x1000
jb 0x18004ca87
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18004ca87
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.180064900
mov qword [rbp - 0x28], r14
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x20], xmm0
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x18004cac4
mov r8, qword [rbp - 0x30]
sub r8, rdx
sar r8, 3
lea rcx, [rbp - 0x40]
call fcn.18003e8c0
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r14
mov rdx, qword [rbp + 0x72]
cmp rdx, 0x10
jb 0x18004cb02
inc rdx
mov rcx, qword [rbp + 0x5a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004cafd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18004cafd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180064900
movdqa xmm0, xmmword [0x18006c7d0]
movdqu xmmword [rbp + 0x6a], xmm0
mov byte [rbp + 0x5a], 0
mov rdx, qword [rbp + 0xa2]
cmp rdx, 0x10
jb 0x18004cb57
inc rdx
mov rcx, qword [rbp + 0x8a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004cb52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18004cb52
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180064900
movdqa xmm0, xmmword [0x18006c7d0]
movdqu xmmword [rbp + 0x9a], xmm0
mov byte [rbp + 0x8a], 0
lea rcx, [rbp + 0x250]
call fcn.180003910
nop
lea rcx, [rbp + 0x1e0]
call fcn.1800039c0
mov eax, ebx
mov rcx, qword [rbp + 0x550]
xor rcx, rsp
call fcn.180064e10
mov rbx, qword [rsp + 0x6a8]
add rsp, 0x660
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret