Function at 0x1800583a0
Capabilities:
Create thread
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2a0]
sub rsp, 0x3a0
mov rax, qword [0x18007cf38]
xor rax, rsp
mov qword [rbp + 0x298], rax
mov rsi, r9
mov qword [rsp + 0x70], r8
mov qword [rbp - 0x80], rdx
mov ebx, ecx
mov dword [rsp + 0x68], ecx
mov r14, qword [rbp + 0x300]
xor ecx, ecx
mov qword [rbp + 0x80], rcx
mov word [rbp + 0x88], cx
movdqa xmm0, xmmword [0x18006dbb0]
movdqu xmmword [rbp + 0x9a], xmm0
mov byte [rbp + 0x8a], cl
mov qword [rbp + 0x50], rcx
mov word [rbp + 0x58], cx
movdqu xmmword [rbp + 0x6a], xmm0
mov byte [rbp + 0x5a], cl
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], rcx
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp], rcx
mov qword [rbp + 8], rcx
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0xb0], rcx
mov qword [rbp + 0xb8], rcx
mov qword [rbp + 0xc0], rcx
mov ecx, 0x30
call fcn.180065064
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0xb8], rax
xor r11d, r11d
mov qword [rbp + 0xc8], r11
xorps xmm2, xmm2
movsd qword [rbp + 0xd0], xmm2
mov qword [rbp + 0xd8], r11
mov edx, 1
mov dword [rbp + 0xe0], edx
mov qword [rbp + 0xe8], r11
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xf0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x100], xmm1
movdqa xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], r11
mov qword [rbp + 0x128], 0xffffffffffffffff
mov dword [rbp + 0x130], r11d
xor eax, eax
movups xmmword [rbp + 0x138], xmm0
movups xmmword [rbp + 0x148], xmm0
movups xmmword [rbp + 0x158], xmm0
movups xmmword [rbp + 0x168], xmm0
mov qword [rbp + 0x178], rax
movdqa xmm0, xmmword [0x18006dbb0]
movdqa xmmword [rbp + 0x190], xmm0
mov byte [rbp + 0x180], al
mov word [rbp + 0x1a0], r11w
mov dword [rbp + 0x1a4], r11d
mov qword [rbp + 0x1a8], r11
xorps xmm0, xmm0
movaps xmmword [rbp + 0x1b0], xmm0
movsd qword [rbp + 0x1c0], xmm2
mov byte [rbp + 0x1c8], al
mov qword [rbp + 0x1cc], r11
mov edi, ebx
imul r13d, ebx, 0x4b0
lea eax, [rdx + 0x6b]
mov r15, qword [rsp + 0x70]
mov r12, qword [rsp + 0x70]
cmp ebx, r13d
mov ebx, dword [rsp + 0x60]
ja 0x1800589b4
lea r8, str.float.pb
mov ecx, 0x6774
nop dword [rax + rax]
cmp edi, 0x51a2
ja 0x180058727
je 0x180058708
cmp edi, 0x102
ja 0x180058635
je 0x180058628
mov eax, edi
sub eax, 0x89
je 0x180058615
sub eax, 0x17
je 0x1800585e4
cmp eax, 0x41
jne 0x180058961
mov qword [rsp + 0x20], r8
lea r9, [rbp - 0x48]
xor r8d, r8d
mov edx, SHTestTokenMembership
xor ecx, ecx
call fcn.180042e90
cmp qword [rbp - 0x48], 0
jne 0x1800585fc
mov esi, 1
jmp 0x1800588b7
mov r9d, 0xf
mov r8, qword [rsi + 8]
lea rdx, [0x180037360]
xor ecx, ecx
call fcn.180053eb0
mov edx, 1
mov ecx, 0x6774
lea r8, str.float.pb
xor r11d, r11d
jmp 0x180058961
mov word [rbp + 0x248], cx
mov byte [rbp + 0x24a], 0
jmp 0x180058961
mov word [rbp + 0x278], r11w
jmp 0x180058961
cmp edi, 0x116
je 0x1800586c4
cmp edi, 0x32a0
je 0x180058681
cmp edi, 0x4731
jne 0x180058961
mov r9d, SHSetFolderPathW
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180019fd0
mov r15, rax
mov r8d, 0x9e
lea rdx, [rbp - 0x48]
mov rcx, rax
call fcn.18003cf90
jmp 0x1800585fc
mov r9, qword [rsi + 8]
xor r8d, r8d
xor edx, edx
mov ecx, 0x145
call fcn.1800377d0
mov r9d, 0xf
mov r8, qword [rsi + 0x10]
lea rdx, [0x1800377b0]
xor ecx, ecx
call fcn.180053eb0
mov r9, qword [rsi + 0x10]
xor r8d, r8d
xor edx, edx
mov ecx, 0x145
call fcn.1800377d0
jmp 0x1800585fc
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], r11
mov r9, rsi
xor edx, edx
xor ecx, ecx
mov r8d, 0xbd
call fcn.18000c880
test eax, eax
je 0x1800589ad
xor r11d, r11d
mov dword [rsi + 0x154], r11d
mov edx, 1
mov ecx, 0x6774
lea r8, str.float.pb
jmp 0x180058961
mov r8d, 2
lea rdx, [0x18006a25a]
lea rcx, [rbp + 0x278]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x1800585fc
cmp edi, 0xaed6
ja 0x180058850
je case.0x180058a15.10
cmp edi, 0x57f6
je 0x18005879a
cmp edi, 0x8d81
je 0x180058778
cmp edi, 0xa242
jne 0x180058961
movsd xmm0, qword [0x18006a30c]
movsd qword [rbp + 0x27c], xmm0
movzx eax, word [0x18006a314]
mov word [rbp + 0x284], ax
jmp 0x180058961
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r8d, 0x7c
mov rdx, r15
xor ecx, ecx
call fcn.1800139d0
mov r12, rax
jmp 0x1800585fc
xor r9d, r9d
mov r8, rsi
lea edx, [r9 + 0x54]
lea rcx, [rbp + 0x1e0]
call fcn.180060df0
test eax, eax
je 0x1800589ad
lea rbx, [rsi + 0x120]
lea rcx, [rsi + 0x110]
mov rax, qword [rcx]
cmp qword [rbx], rax
jne 0x1800587f4
lea r9, [rsi + 0x108]
lea rdx, [rsi + reloc.SHLWAPI.dll_SHRegGetIntW]
mov qword [rsp + 0x20], rbx
mov r8d, 0x104
call fcn.18002bde0
test eax, eax
je 0x18005897c
mov rax, qword [rbx]
movaps xmm0, xmmword [rbp + 0x1e0]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [rbp + 0x1f0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [rbp + 0x200]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [rbp + 0x210]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [rbp + 0x220]
movups xmmword [rax + 0x40], xmm0
add qword [rbx], 0x50
mov edx, 1
mov ebx, edx
mov dword [rsp + 0x60], edx
mov ecx, 0x6774
lea r8, str.float.pb
xor r11d, r11d
jmp 0x180058961
cmp edi, 0xf2e2
je 0x180058959
cmp edi, 0x14382
je 0x18005892f
cmp edi, 0x19422
jne 0x180058961
mov r9d, 0x1a
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x278]
call fcn.18004f820
mov rdx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x180058899
mov rdx, qword [r14]
mov r8d, dword [r14 + 0x10]
mov rcx, rsi
call rax
cmp eax, dword [r14 + 0x10]
je 0x1800585fc
mov byte [rsp + 0x60], 0
mov ebx, dword [rsp + 0x60]
mov esi, ebx
lea rcx, [rbp + 0x128]
call fcn.18000a5f0
mov rbx, qword [rbp + 0x110]
test rbx, rbx
je 0x18005934f
mov rdi, qword [rbp + reloc.SHLWAPI.dll_SHRegGetIntW]
cmp rbx, rdi
je 0x1800588f8
nop
mov rcx, rbx
call fcn.180021550
add rbx, 0x20
cmp rbx, rdi
jne 0x1800588e0
mov rbx, qword [rbp + 0x110]
mov r8, qword [rbp + 0x120]
sub r8, rbx
sar r8, 5
mov rdx, rbx
lea rcx, [rbp + 0x110]
call fcn.180031b50
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x110], xmm0
xor r14d, r14d
mov qword [rbp + 0x120], r14
jmp 0x180059352
mov r8d, 5
lea rdx, [0x18006a336]
lea rcx, [rbp + 0x286]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor r11d, r11d
mov word [rbp + 0x290], r11w
jmp 0x1800586f2
mov word [rbp + 0x286], r11w
mov eax, dword [rsp + 0x68]
lea eax, [rax + rax*4]
shl eax, 4
add edi, eax
cmp edi, r13d
ja 0x1800589b4
mov eax, 0x6c
jmp 0x180058580
mov r14d, 1
mov dword [rsi], r14d
xor ebx, ebx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
mov r9d, 0xbe
xor r8d, r8d
lea rdx, [rbp + 0x1e0]
xor ecx, ecx
call fcn.1800640d0
jmp case.0x180058a15.10
xor esi, esi
jmp 0x1800588b7
mov r13d, dword [rsp + 0x68]
lea r14d, [r13 - 0xf]
lea rcx, [0x180000000]
cmp r13d, r14d
jbe 0x180058c78
lea edi, [r13 - 0x81]
mov r9d, 0x5659
mov r8d, 0x6d37
mov r10d, 0x3675
mov r13, qword [rsp + 0x70]
nop dword [rax + rax]
cmp edi, 0x81
ja case.default.0x180058a15
movzx eax, byte [rcx + rdi + 0x59550]
mov ecx, dword [rcx + rax*4 + 0x59514]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov byte [rbp + 0x24c], 0
jmp case.0x180058a15.14
mov qword [rsp + 0x20], r11
mov r9d, 0xf6
mov r8, r12
xor edx, edx
xor ecx, ecx
call fcn.180031260
mov qword [rsp + 0x20], 0
mov r9, r15
xor r8d, r8d
xor edx, edx
mov ecx, 0xa0
call fcn.1800583a0
xor r11d, r11d
mov ebx, r11d
mov dword [rsp + 0x60], ebx
mov r8d, 0x6d37
mov r9d, 0x5659
mov r10d, 0x3675
jmp case.0x180058a15.14
mov word [rbp + 0x253], r9w
movzx eax, word [0x18006a377]
mov word [rbp + 0x255], ax
movzx eax, byte [0x18006a379]
mov byte [rbp + 0x257], al
jmp case.0x180058a15.14
mov rax, qword [rbp - 0x80]
mov rax, qword [rax]
mov qword [rsp + 0x70], rax
mov r9, r13
mov r8d, 0xbc
mov rdx, rsi
lea rcx, [rsp + 0x70]
call fcn.18004bfe0
mov dword [rsp + 0x20], SHSetFolderPathW
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call fcn.180010180
mov byte [rsp + 0x60], 1
mov ebx, dword [rsp + 0x60]
mov r8d, 0x6d37
mov r9d, 0x5659
mov r10d, 0x3675
xor r11d, r11d
jmp case.0x180058a15.14
movzx eax, word [0x18006a38e]
mov word [rbp + 0x258], ax
movzx eax, byte [0x18006a390]
mov byte [rbp + 0x25a], al
mov byte [rbp + 0x25b], 0
jmp case.0x180058a15.14
xor r9d, r9d
lea r8, [rbp - 0x48]
mov edx, 0x96
mov rcx, r12
call fcn.18003f8e0
mov eax, dword [rbp - 0x40]
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x28], 0x92
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rbp - 0x48]
xor edx, edx
xor ecx, ecx
call fcn.180031550
mov r8d, 0x119
mov rdx, r15
lea rcx, [rbp - 0x48]
call fcn.18000fc20
jmp 0x180058ae1
mov word [rbp + 0x24a], r8w
jmp case.0x180058a15.14
mov word [rbp + 0x25b], r10w
mov byte [rbp + 0x25d], 0
mov r8, rdx
lea rdx, [0x18006a3d5]
lea rcx, [rbp + 0x25d]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x180058ae1
mov byte [rbp + 0x25e], 0
jmp case.0x180058a15.14
mov r8, rdx
lea rdx, [0x18006a423]
lea rcx, [rbp + 0x248]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x180058ae1
mov r9d, 0xf
mov r8, qword [rsi]
lea rdx, [0x180037e60]
xor ecx, ecx
call fcn.180053eb0
mov r9, qword [rsi]
xor r8d, r8d
xor edx, edx
mov ecx, 0x145
call fcn.1800377d0
mov r9, rsi
xor r8d, r8d
mov edx, 0xc6
xor ecx, ecx
call fcn.1800266d0
jmp 0x180058ae1
movzx eax, word [0x18006a436]
mov word [rbp + 0x24c], ax
movzx eax, byte [0x18006a438]
mov byte [rbp + 0x24e], al
jmp case.0x180058a15.14
movzx eax, word [0x18006a446]
mov word [rbp + 0x24f], ax
movzx eax, byte [0x18006a448]
mov byte [rbp + 0x251], al
mov byte [rbp + 0x252], 0
lea rcx, [0x180000000]
dec edi
lea eax, [rdi + 0x81]
cmp eax, r14d
jbe 0x180058c73
mov edx, 1
jmp 0x1800589f0
mov r13d, dword [rsp + 0x68]
lea ecx, [r13 + 0xbe0]
mov dword [rsp + 0x60], ecx
cmp r13d, ecx
jae case.0x180058a15.10
mov rsi, qword [rbp - 0x50]
movzx r15d, byte [rsp + 0x64]
mov r12d, dword [rbp - 0x80]
mov r14d, 1
mov r8d, 0x4374
mov r10d, 0x7473
mov r9d, 0x75
lea edx, [r9 - 5]
mov eax, 0x6544
mov edi, 0x1bb
cmp r13d, 0x679
ja 0x180059204
je 0x1800590b7
cmp r13d, 0x381
ja 0x180058fde
je 0x180058f87
cmp r13d, 0x89
je 0x180058da5
cmp r13d, 0x147
je 0x180058d69
cmp r13d, 0x205
je 0x180058d34
cmp r13d, 0x2c3
jne 0x18005933a
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], r11
lea r9, [rbp - 0x30]
xor edx, edx
xor ecx, ecx
mov r8d, 0xcf
call fcn.18000c880
jmp 0x180059333
mov dword [rbp - 0x54], r11d
mov word [rsp + 0x68], di
mov qword [rsp + 0x20], r11
lea r9, [0x18007cac8]
mov r8d, SHSetInstanceExplorer
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x50]
call fcn.18003b070
mov dword [rbp - 0x58], 0xa
jmp 0x180059333
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov dword [rbp - 0x80], 0
mov word [rsp + 0x68], di
lea r9, [rbp + 0x80]
lea r8, [rsp + 0x68]
lea rdx, [0x18007caa8]
mov ecx, 0xfb
call fcn.1800206c0
jmp 0x180059333
mov dword [rsp + 0x20], StrCmpCW
xor r9d, r9d
lea r8, [0x18007ca48]
xor edx, edx
xor ecx, ecx
call fcn.180039780
test al, al
jne 0x180058f7c
mov edi, 0xd
nop dword [rax]
cmp edi, 0xd
ja case.default.0x180058dec
mov eax, edi
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0x595d4]
add rcx, rdx
jmp rcx
mov eax, 0x6c
mov word [rbp + 0x23f], ax
mov eax, 0x65
mov word [rbp + 0x240], ax
lea r8d, [rax - 0x63]
lea rdx, [0x18006a45c]
lea rcx, [rbp + 0x260]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp case.default.0x180058dec
mov byte [rsp + 0x64], r14b
jmp case.default.0x180058dec
mov eax, 0x74
mov word [rbp + 0x234], ax
mov word [rbp + 0x235], ax
jmp case.default.0x180058dec
lea rcx, [rbp + 0x20]
call qword [sym.imp.SHELL32.dll_SHGetInstanceExplorer]
mov dword [rsp + 0x78], eax
lea rdx, [rbp + 0x260]
lea rcx, [rbp + 0x230]
call qword [sym.imp.SHLWAPI.dll_StrTrimA]
jmp case.default.0x180058dec
mov r8d, 3
lea rdx, [0x18006a482]
lea rcx, [rbp + 0x26f]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x272], 0
mov r8, r14
lea rdx, [0x18006a493]
lea rcx, [rbp + 0x260]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp case.default.0x180058dec
mov dword [rbp + 0x230], 0x726854
mov eax, 0x6f
mov word [rbp + 0x233], ax
jmp case.default.0x180058dec
mov byte [rbp + 0x26f], 0
jmp case.default.0x180058dec
mov dword [rbp + 0x23b], 0x62617961
jmp case.default.0x180058dec
mov dword [rbp + 0x26b], 0x6f646e61
jmp case.default.0x180058dec
xor ecx, ecx
movzx eax, byte [rsp + 0x64]
cmp dword [rsp + 0x78], ecx
cmove ecx, eax
mov byte [rsp + 0x64], cl
cmp cl, 0
je case.default.0x180058dec
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.SHELL32.dll_SHSetInstanceExplorer]
jmp case.default.0x180058dec
mov word [rbp + 0x273], 0x64
jmp case.default.0x180058dec
mov dword [rbp + 0x236], 0x6544656c
mov eax, 0x6c
mov word [rbp + 0x23a], ax
jmp case.default.0x180058dec
mov byte [rbp + 0x262], 0
mov r8d, 4
lea rdx, [0x18006a592]
lea rcx, [rbp + 0x260]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, dword [0x18006a603]
mov dword [rbp + 0x266], eax
movzx eax, byte [0x18006a607]
mov byte [rbp + 0x26a], al
dec edi
lea eax, [rdi + 0x5a]
cmp eax, 0x59
ja 0x180058dd0
xor r11d, r11d
mov esi, r11d
jmp 0x180059336
lea rax, [rbp + 0x80]
mov qword [rbp - 0x60], rax
mov rax, qword [rbp - 0x28]
cmp rax, qword [rbp - 0x20]
je 0x180058fba
lea rdx, [rbp + 0x80]
mov qword [rax], rdx
add qword [rbp - 0x28], 8
mov dword [rbp - 0x60], 0xa
xor r11d, r11d
jmp 0x18005933a
lea r8, [rbp - 0x60]
mov rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.180008570
mov ecx, dword [rsp + 0x60]
mov dword [rbp - 0x60], 0xa
xor r11d, r11d
jmp 0x18005933a
cmp r13d, 0x43f
je 0x180059056
cmp r13d, 0x4fd
je 0x180059006
cmp r13d, 0x5bb
jne 0x18005933a
mov dword [rbp - 0x68], r11d
jmp 0x18005933a
mov dword [rbp - 0x64], r11d
lea rax, [rbp - 0x30]
mov qword [rbp + 0x30], rax
mov eax, dword [0x18007caf0]
mov dword [rbp + 0x38], eax
mov eax, dword [0x18007caf4]
mov dword [rbp + 0x3c], eax
movaps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x40], xmm0
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], r11d
lea r9, [rbp + 0x40]
lea r8, [0x1800159b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x70], rax
jmp 0x180059333
lea rax, [rbp + 0x50]
mov qword [rsp + 0x68], rax
mov rax, qword [rbp - 0x28]
cmp rax, qword [rbp - 0x20]
je 0x180059077
lea rcx, [rbp + 0x50]
mov qword [rax], rcx
add qword [rbp - 0x28], 8
jmp 0x180059089
lea r8, [rsp + 0x68]
mov rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.180008570
mov qword [rbp - 0x50], 0
mov eax, dword [0x18007caf0]
mov dword [rsp + 0x68], eax
mov r9d, 0xd2
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x30]
call fcn.180011030
jmp 0x180059333
cmp qword [rsp + 0x70], 0
jne 0x18005933a
mov edi, 0x3f
nop dword [rax + rax]
cmp edi, 0x1da
ja 0x180059161
je 0x180059147
cmp edi, 0x3f
je 0x18005913b
cmp edi, 0xc8
je 0x180059118
cmp edi, 0x151
jne 0x1800591e7
mov ecx, 0x6c
mov word [rbp + 0x238], cx
mov word [rbp + 0x239], r9w
mov word [rbp + 0x23a], r10w
jmp 0x1800591e7
mov dword [rbp + 0x232], 0x756166
mov ecx, 0x6c
mov word [rbp + 0x235], cx
mov word [rbp + 0x236], r8w
jmp 0x1800591e7
mov word [rbp + 0x230], ax
jmp 0x1800591e7
mov dword [rbp + 0x23c], 0x614d7265
mov word [rbp + 0x240], dx
movzx r15d, r14b
jmp 0x1800591e7
cmp edi, 0x263
je 0x1800591b3
cmp edi, 0x375
je 0x180059181
cmp edi, 0x3fe
jne 0x1800591e7
mov rsi, r14
jmp 0x1800588b7
mov ecx, r11d
movzx eax, r15b
cmp dword [rbp - 0x78], 0
cmove ecx, eax
movzx r15d, cl
test cl, cl
je 0x1800591a0
mov ecx, r12d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
lea rdx, [rbp + 0x230]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
jmp 0x1800591cc
mov qword [rbp + 0x28], 0xffffffff80000001
mov ecx, 0x64
mov r12d, ecx
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov dword [rbp - 0x78], eax
mov r10d, 0x7473
mov r9d, 0x75
mov r8d, 0x4374
lea edx, [r9 - 5]
mov eax, 0x6544
add edi, 0x89
cmp edi, 0x487
mov r11d, 0
jb 0x1800590d0
jmp 0x180059336
cmp r13d, 0x971
ja 0x1800592b6
je 0x1800592ad
cmp r13d, 0x737
je 0x180059278
cmp r13d, 0x7f5
je 0x18005924f
cmp r13d, 0x8b3
jne 0x18005933a
mov r8d, 0x27
lea rdx, [rbp + 0xb0]
xor ecx, ecx
call fcn.18000bde0
jmp 0x180059333
mov dword [rbp - 0x70], 0xa
lea r9, [rbp - 0x30]
mov r8d, 0x62
lea rdx, [rbp + 0xb0]
lea rcx, [0x18007ca40]
call fcn.18000b8b0
jmp 0x180059333
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp - 0x6c], 0xa
lea rax, [0x18000d690]
mov qword [rsp + 0x68], rax
mov r8d, 0x41
lea rdx, [rsp + 0x68]
xor ecx, ecx
call fcn.18004a400
jmp 0x180059333
mov dword [rbp - 0x74], r11d
jmp 0x18005933a
cmp r13d, 0xa2f
je 0x180059326
cmp r13d, 0xaed
je 0x1800592d7
cmp r13d, 0xbab
je case.0x180058a15.10
jmp 0x18005933a
mov eax, dword [rbp - 0x74]
mov dword [rsp + 0x50], eax
mov eax, dword [rbp - 0x70]
mov dword [rsp + 0x48], eax
mov eax, dword [rbp - 0x6c]
mov dword [rsp + 0x40], eax
mov eax, dword [rbp - 0x68]
mov dword [rsp + 0x38], eax
mov eax, dword [rbp - 0x64]
mov dword [rsp + 0x30], eax
mov rax, qword [rbp - 0x50]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp - 0x60]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp - 0x58]
mov r8d, dword [rbp - 0x54]
mov edx, dword [rbp - 0x80]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_GdiTransparentBlt]
xor r11d, r11d
mov ebx, r11d
jmp 0x180059336
lea rcx, [rbp + 0x248]
call qword [sym.imp.SHLWAPI.dll_PathIsUNCServerA]
xor r11d, r11d
mov ecx, dword [rsp + 0x60]
add r13d, 0xbe
cmp r13d, ecx
jae case.0x180058a15.10
jmp 0x180058ca0
xor r14d, r14d
mov rdx, qword [rbp + 0xf8]
test rdx, rdx
je 0x18005938a
mov r8, qword [rbp + 0x108]
sub r8, rdx
sar r8, 4
lea rcx, [rbp + 0xf8]
call fcn.180031ab0
mov qword [rbp + 0xf8], r14
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x100], xmm0
lea rcx, [rbp + 0xb8]
call fcn.18000a520
nop
mov rbx, qword [rbp - 0x18]
test rbx, rbx
je 0x18005942b
mov rdi, qword [rbp - 0x10]
cmp rbx, rdi
je 0x1800593c5
nop dword [rax]
mov rcx, rbx
call fcn.180009e30
add rbx, 0x28
cmp rbx, rdi
jne 0x1800593b0
mov rbx, qword [rbp - 0x18]
mov rcx, qword [rbp - 8]
sub rcx, rbx
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rax, rbx
cmp rdx, 0x1000
jb 0x180059417
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180059417
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1800650a0
mov qword [rbp - 0x18], r14
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
mov rdx, qword [rbp - 0x30]
test rdx, rdx
je 0x180059454
mov r8, qword [rbp - 0x20]
sub r8, rdx
sar r8, 3
lea rcx, [rbp - 0x30]
call fcn.180031a60
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r14
mov rdx, qword [rbp + 0x72]
cmp rdx, 0x10
jb 0x180059492
inc rdx
mov rcx, qword [rbp + 0x5a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005948d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18005948d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800650a0
movdqa xmm0, xmmword [0x18006dbb0]
movdqu xmmword [rbp + 0x6a], xmm0
mov byte [rbp + 0x5a], 0
mov rdx, qword [rbp + 0xa2]
cmp rdx, 0x10
jb 0x1800594e7
inc rdx
mov rcx, qword [rbp + 0x8a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800594e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800594e2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800650a0
mov eax, esi
mov rcx, qword [rbp + 0x298]
xor rcx, rsp
call fcn.180065820
mov rbx, qword [rsp + 0x3e0]
add rsp, 0x3a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret