Function at 0x180043de0
Capabilities:
Create thread
Set global application hook

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe70]
sub rsp, 0xf70
mov rax, qword [rbp - 0x78]
lea edi, [rdx + 0xc6]
mov r13, qword [rbp - 0x78]
lea r11, [0x180000000]
mov r12, qword [rbp - 0x78]
mov r14, r9
mov r15, qword [rbp - 0x78]
xor r9d, r9d
mov r10, r8
mov rsi, rcx
cmp edx, edi
jae 0x180044057
mov rcx, qword [rbp - 0x78]
lea ebx, [rdx - 0x31]
mov esi, dword [rbp + 0xeb8]
movabs rdx, 0x73776f646e6957
mov qword [rbp - 0x68], rcx
mov qword [rbp - 0x58], rax
nop dword [rax]
cmp ebx, 0xe3
ja case.0x180043e80.0
movzx eax, byte [r11 + rbx + 0x4474c]
mov ecx, dword [r11 + rax*4 + 0x44720]
add rcx, r11
jmp rcx
mov qword [rbp - 0x58], r9
mov r13, r9
jmp case.0x180043e80.0
mov rax, qword [rbp + 0xeb0]
lea r8, [0x1800461b0]
mov qword [rsp + 0x28], r9
xor edx, edx
mov dword [rsp + 0x20], r9d
xor ecx, ecx
mov qword [0x1800b60f8], rax
mov r9, rax
mov qword [rax + 0x80], r10
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1800b6100], rax
mov r10, qword [rbp + 0xec0]
lea r11, [0x180000000]
movabs rdx, 0x73776f646e6957
xor r9d, r9d
jmp case.0x180043e80.0
mov rax, qword [rbp + 0xeb0]
lea r8, [rsp + 0x78]
xor r9d, r9d
mov dword [rsp + 0x78], 0x200
mov rdx, r10
mov dword [rsp + 0x20], 0x157
lea rcx, [rbp + 0xa80]
mov eax, dword [rax]
mov dword [rbp + 0xdfc], eax
call fcn.1800108e0
jmp 0x180043ec8
mov ecx, 0xffffffd1
lea rdx, [rbp + 0x880]
call qword [0x1800ce8f0]
xor eax, eax
mov dword [rsp + 0x78], 0x200
xor r9d, r9d
mov word [0x1800ce8f8], ax
lea r8, [rsp + 0x78]
mov dword [rsp + 0x20], 0x157
lea rdx, [rbp + 0xa80]
mov rcx, r14
call fcn.1800108e0
jmp 0x180043ec8
mov r12, r9
mov r15, r9
mov esi, 0x50
jmp case.0x180043e80.0
mov eax, dword [0x1800983e0]
lea r9, [rbp + 0xd0]
mov dword [rbp + 0x30], eax
lea r8, [rbp + 0x120]
movzx eax, word [0x1800983e4]
lea rcx, [rbp + 0x80]
mov word [rbp + 0x34], ax
movzx eax, byte [0x1800983e6]
mov qword [rbp + 0x80], rdx
lea rdx, [rbp + 0x30]
mov byte [rbp + 0x36], al
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetProfileStringW]
movabs rax, 0x73656369766544
mov qword [rbp + 0x80], rax
jmp 0x180043ec8
mov qword [rbp - 0x68], r9
jmp case.0x180043e80.0
mov dword [rbp + 0xddc], 9
add ebx, 0x12
lea eax, [rbx + 0x31]
cmp eax, edi
jb 0x180043e60
mov rsi, qword [rbp + 0xeb0]
mov r14, qword [rbp - 0x58]
mov edx, dword [rbp + 0xeb8]
mov rbx, qword [rbp - 0x68]
lea r8d, [rdx + 0xb]
mov dword [rsp + 0x68], r8d
cmp edx, r8d
jae case.0x180044040.9
lea edi, [rdx - 0x31]
mov dword [rsp + 0x60], edi
nop
cmp edi, 0xaa
ja case.0x180044040.11
movzx eax, byte [r11 + rdi + 0x44860]
mov ecx, dword [r11 + rax*4 + 0x44830]
add rcx, r11
jmp rcx
cmp qword [0x1800b6100], 0
setne byte [rbp - 0x68]
mov rax, qword [rbp - 0x68]
jmp 0x180044703
mov r14, qword [rbp - 0x78]
mov qword [rbp - 0x68], rax
jmp 0x180044001
mov rcx, qword [rsi]
mov edx, 0x121
call fcn.180020d40
lea rcx, str.Konfigurace_souboru__s
call fcn.18006ac90
jmp 0x18004467c
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x490]
call fcn.180072154
xor r9d, r9d
mov byte [rbp - 0x20], 0
mov r13d, r9d
mov r12, rax
mov r15, rax
jmp 0x18004467f
mov dword [rsp + 0x28], 0x50
lea rdx, [rbp + 0x170]
mov dword [rsp + 0x20], r9d
xor ecx, ecx
xor r9d, r9d
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_LoadImageW]
test rax, rax
je 0x1800440da
mov rcx, rax
mov qword [rbp - 0x48], rax
mov eax, 1
jmp 0x1800440de
mov rcx, qword [rbp - 0x48]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp + 0xec0]
cmp dword [rax], 0
je 0x18004412d
call fcn.180059f30
mov dword [rbp - 0x70], eax
mov eax, 2
lea r8, [rbp - 0x70]
mov word [rsp + 0x60], ax
lea rcx, [rsp + 0x70]
mov rax, qword [rsi]
mov r9d, 0xd9
mov qword [rsp + 0x70], rax
xor edx, edx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.180028370
jmp 0x18004467c
mov dword [rbp - 0x70], ecx
jmp 0x1800440f6
mov rax, qword [rbp - 0x50]
mov qword [rsp + 0x40], r9
mov dword [rbp - 0x70], eax
mov rax, qword [rsi]
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r9
lea r9, [rbp - 0x70]
mov dword [rsp + 0x20], 0x28
xor r8d, r8d
lea rcx, [rbp - 0x38]
xor edx, edx
call fcn.180036ed0
jmp 0x18004467c
cmp dword [r10], 0
je 0x18004419f
mov rax, qword [rbp - 0x78]
lea rcx, [rbp - 0x58]
xor r9d, r9d
mov dword [rbp - 0x58], eax
xor edx, edx
mov r8d, 0xd0
call fcn.18005a820
mov rsi, rax
jmp 0x1800441a3
mov rsi, qword [rbp - 0x78]
test rsi, rsi
jne 0x1800441d9
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8d, 0xcd
call fcn.18002ef20
xor r9d, r9d
mov qword [rsp + 0x70], rax
mov r8d, 0x109
lea rdx, [rsp + 0x70]
xor ecx, ecx
call fcn.18002ca50
movsxd rsi, eax
jmp 0x1800441ea
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1800446b0
cmp qword [0x1800be6b0], 0
jne 0x1800442e4
mov edi, 0x11f
nop dword [rax]
mov eax, edi
sub eax, 0x11f
je 0x1800442d1
sub eax, 2
je 0x1800442c5
sub eax, 2
je 0x180044240
cmp eax, 2
jne 0x1800442d1
cmp qword [0x1800ce7a0], 0
je 0x1800446b0
mov eax, 1
mov qword [rbp - 0x40], rax
jmp 0x1800442d1
mov ecx, dword [rsp + 0x78]
lea r8, [0x180095018]
mov rax, qword [rbp - 0x60]
or ecx, 0x40
cmp qword [rbp - 0x68], 0
cmovne ecx, dword [rsp + 0x78]
xor edx, edx
mov qword [rsp + 0x58], rdx
mov r9d, ecx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], edx
lea rdx, str.Graphics_Filters
mov dword [rsp + 0x78], ecx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [0x1800be6b0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
lea rdx, [0x18000f720]
mov r9d, eax
lea ecx, [r8 + 3]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x1800ce7a0], rax
jmp 0x1800442d1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp - 0x60], rax
add edi, 2
cmp edi, 0x127
jb 0x180044200
mov edi, dword [rsp + 0x60]
mov rax, qword [rbp - 0x40]
mov rsi, qword [rbp + 0xeb0]
mov dword [rbp - 0x70], eax
lea rax, [rsp + 0x70]
mov rcx, qword [rsi]
mov qword [rsp + 0x70], rcx
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
jmp 0x18004415a
test r12, r12
je 0x18004453c
cmp byte [rbp - 0x20], 0
lea rcx, [rbp - 0x20]
jne 0x180044347
sub rcx, r12
movzx eax, byte [r12]
mov byte [rcx + r12], al
lea r12, [r12 + 1]
test al, al
jne 0x180044330
inc r13
jmp 0x180044390
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180044350
movzx eax, word [0x180095758]
mov word [rcx], ax
lea rcx, [rbp - 0x20]
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180044370
xor edx, edx
nop dword [rax]
movzx eax, byte [r12 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x180044380
lea rdx, [rbp - 0x80]
xor ecx, ecx
call fcn.180072154
mov r12, rax
test rax, rax
jne 0x180044521
mov edi, 0xb8
nop dword [rax]
cmp edi, 0xb8
je 0x1800444bb
cmp edi, 0x7c58
jne 0x18004450d
mov rcx, rsi
lea rax, [rbp + 0x270]
mov edx, 2
nop word [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x1800443e0
mov ecx, dword [rcx]
mov dword [rax], ecx
lea rcx, [rbp - 0x20]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x180044442
mov qword [rbp - 0x70], rax
lea r9, [rbp - 0x20]
lea rax, [rbp + 0x270]
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x70]
lea rax, [rsp + 0x70]
mov edx, 0xa5
lea rcx, [rbp + 0x380]
mov qword [rsp + 0x20], rax
call fcn.18003b5b0
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [r15 + rax], 0
jne 0x180044490
inc r15
add r15, rax
cmp byte [r15], 0
je 0x18004450d
lea rdx, [rbp - 0x80]
mov byte [rbp - 0x20], 0
mov rcx, r15
call fcn.180072154
mov r12, rax
jmp 0x18004450d
lea rax, [rbp - 0x20]
lea rdx, [rbp + 0xd0]
sub rdx, rax
nop dword [rax]
movzx ebx, byte [rax]
movzx ecx, byte [rax + rdx]
sub ebx, ecx
jne 0x1800444e2
inc rax
test ecx, ecx
jne 0x1800444d0
xor eax, eax
mov dword [rbp - 0x70], r13d
mov r9d, 0xb6
mov qword [rsp + 0x20], rax
mov r8, rsi
lea rdx, [rbp - 0x70]
xor ecx, ecx
call fcn.180034b90
test ebx, ebx
mov rax, r13
cmovne rax, r14
mov r14, rax
add edi, 0x7ba0
cmp edi, 0xf740
jbe 0x1800443b0
jmp 0x180044524
mov r15, rax
test r12, r12
jne 0x180044323
mov edx, dword [rbp + 0xeb8]
mov edi, dword [rsp + 0x60]
mov r8d, dword [rsp + 0x68]
mov rbx, r14
xor r9d, r9d
jmp case.0x180044040.11
mov eax, 1
lea r8, [rsp + 0x60]
mov word [rsp + 0x60], ax
lea rdx, [rsp + 0x70]
mov rax, qword [rsi]
lea rcx, [rbp + 0x170]
mov r9d, 0x53
mov qword [rsp + 0x70], rax
call fcn.18002dab0
lea r8, [rsp + 0x60]
mov ecx, 0x42
lea rdx, [rsp + 0x70]
mov byte [rbp + rax + 0x170], 0
mov eax, 2
mov word [rsp + 0x60], ax
mov rax, qword [rsi]
mov qword [rsp + 0x70], rax
call fcn.180018420
xor r9d, r9d
mov qword [rbp - 0x48], r9
jmp 0x18004467f
mov r8d, 0x3e8
lea rdx, [rbp + 0x490]
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetProfileSectionW]
movzx eax, word [0x18009842c]
lea r15, [rbp + 0x490]
mov word [rbp - 0x80], ax
movzx eax, byte [0x18009842e]
mov byte [rbp - 0x7e], al
jmp 0x18004467c
mov qword [rbp - 0x40], r9
mov dword [rsp + 0x78], 0x80000001
jmp case.0x180044040.11
lea rax, str.D3DRS_FOGEND
mov r8d, 0x62
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call fcn.180054b40
cmp eax, 0x40046
jb 0x1800446bc
mov eax, 1
lea r8, [rsp + 0x60]
mov word [rsp + 0x60], ax
lea rdx, [rsp + 0x70]
mov rax, qword [rsi]
mov ecx, 0x42
mov qword [rsp + 0x70], rax
call fcn.180018420
cdqe
lea r8, [rsp + 0x60]
mov qword [rbp - 0x68], rax
lea rdx, [rsp + 0x70]
mov eax, 2
mov ecx, 0x42
mov word [rsp + 0x60], ax
mov rax, qword [rsi]
mov qword [rsp + 0x70], rax
call fcn.180018420
cdqe
mov qword [rbp - 0x78], rax
xor r9d, r9d
mov edx, dword [rbp + 0xeb8]
mov r8d, dword [rsp + 0x68]
inc edx
inc edi
mov dword [rbp + 0xeb8], edx
mov dword [rsp + 0x60], edi
cmp edx, r8d
jae case.0x180044040.9
mov r10, qword [rbp + 0xec0]
lea r11, [0x180000000]
jmp 0x180044020
mov rax, qword [rbp + 0xeb0]
mov rax, qword [rax]
jmp 0x1800446bf
mov rax, qword [rsi]
xor ecx, ecx
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x40], rcx
lea rax, [rbp - 0x60]
mov qword [rsp + 0x38], rcx
lea r9, [rbp + 0xeb8]
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov qword [rsp + 0x28], rcx
xor edx, edx
mov dword [rbp + 0xeb8], ecx
lea rcx, [rbp - 0x38]
mov dword [rsp + 0x20], 0x28
call fcn.180036ed0
mov rax, rbx
mov rbx, qword [rsp + 0xfc8]
add rsp, 0xf70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret