Function at 0x7ff71cd9bb0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x380
mov rax, qword [0x7ff71cee2b0]
xor rax, rsp
mov qword [rsp + 0x370], rax
mov r14, qword [rdx + 0xc]
xor eax, eax
mov ebp, r9d
mov dword [rsp + 0x38], r9d
mov r15, r8
mov r13, rdx
mov edi, ecx
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x68], rdx
cmp r14, rax
jne 0x7ff71cd9c15
mov eax, 0x107
jmp 0x7ff71cda2ab
lea rax, str.system.ini
lea r9, [rsp + 0x70]
lea r8, [0x7ff71cf0e58]
mov qword [rsp + 0x28], rax
lea rcx, str.MCI32
mov rdx, r14
mov dword [rsp + 0x20], 0xff
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ecx, ecx
lea rbx, [0x7ff71cee2c0]
lea rsi, [0x7ff71ce9570]
cmp eax, ecx
jne 0x7ff71cd9e3e
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r14
repne scasw ax, word [rdi]
not rcx
lea edi, [rcx + rcx + 2]
lea rbp, [rcx - 1]
mov ecx, edi
call fcn.7ff71cdf53c
mov r12, rax
mov qword [rsp + 0x40], rax
xor eax, eax
cmp r12, rax
jne 0x7ff71cd9cc7
mov rcx, qword [0x7ff71cee2c0]
lea rbx, [0x7ff71cee2c0]
cmp rcx, rbx
je 0x7ff71cd9cbd
bt dword [rcx + 0x1c], 0x16
jae 0x7ff71cd9cbd
cmp byte [rcx + 0x19], 1
jb 0x7ff71cd9cbd
lea edx, [rax + 0x18]
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff71ce9570]
call fcn.7ff71cc12c0
mov eax, 0x108
jmp 0x7ff71cda2ab
movsxd rdx, edi
mov r8, r14
mov rcx, r12
call fcn.7ff71cc2090
test eax, eax
js 0x7ff71cd9cbd
mov edi, 1
movsxd rbp, ebp
lea eax, [rdi + 0x30]
lea r9, [rsp + 0x70]
lea r8, [0x7ff71cf0e58]
mov word [r12 + rbp*2], ax
lea rax, str.system.ini
lea rcx, str.MCI32
mov qword [rsp + 0x28], rax
mov rdx, r12
mov dword [rsp + 0x20], 0xff
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jne 0x7ff71cd9dfa
inc edi
cmp edi, 9
jle 0x7ff71cd9ce1
mov rcx, qword [0x7ff71cee2d8]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 0xa0
call fcn.7ff71cdf53c
mov r12, rax
mov qword [rsp + 0x40], rax
xor eax, eax
cmp r12, rax
jne 0x7ff71cd9d87
mov rcx, qword [0x7ff71cee2c0]
lea rbx, [0x7ff71cee2c0]
cmp rcx, rbx
je 0x7ff71cd9cbd
bt dword [rcx + 0x1c], 0x16
jae 0x7ff71cd9cbd
cmp byte [rcx + 0x19], 1
jb 0x7ff71cd9cbd
lea edx, [rax + 0x1a]
jmp 0x7ff71cd9cad
lea r9, [rsp + 0x70]
mov r8d, 0x50
mov rdx, r12
mov rcx, r14
mov dword [rsp + 0x20], 0xff
call fcn.7ff71cd9908
xor ecx, ecx
mov edi, eax
cmp eax, ecx
je 0x7ff71cd9e33
mov rcx, qword [0x7ff71cee2c0]
lea rbx, [0x7ff71cee2c0]
cmp rcx, rbx
je 0x7ff71cda28b
bt dword [rcx + 0x1c], 0x16
jae 0x7ff71cda28b
cmp byte [rcx + 0x19], 1
jb 0x7ff71cda28b
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff71ce9570]
mov edx, 0x1b
mov r9, r14
call fcn.7ff71cc16f0
jmp 0x7ff71cda28b
mov rcx, qword [0x7ff71cee2c0]
cmp rcx, rbx
je 0x7ff71cd9e31
bt dword [rcx + 0x1c], 0x16
jae 0x7ff71cd9e31
cmp byte [rcx + 0x19], 2
jb 0x7ff71cd9e31
mov rcx, qword [rcx + 0x10]
lea rax, [rsp + 0x70]
mov edx, 0x19
mov r9, r12
mov r8, rsi
mov qword [rsp + 0x20], rax
call fcn.7ff71cc5f88
xor ecx, ecx
mov edi, dword [rsp + 0x34]
mov ebp, dword [rsp + 0x38]
mov r14, r12
mov eax, 0x20
lea r8, [rsp + 0x70]
cmp word [rsp + 0x70], ax
je 0x7ff71cd9e65
cmp word [r8], cx
je 0x7ff71cd9e5f
add r8, 2
cmp word [r8], ax
jne 0x7ff71cd9e4f
cmp word [r8], ax
jne 0x7ff71cd9e6d
mov word [r8], cx
add r8, 2
lea r9, [rsp + 0x270]
lea rcx, [rsp + 0x70]
mov rdx, r14
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.KERNEL32.dll_GetProfileStringW]
mov rcx, qword [0x7ff71cee2c0]
cmp rcx, rbx
je 0x7ff71cd9ecf
bt dword [rcx + 0x1c], 0x16
jae 0x7ff71cd9ecf
cmp byte [rcx + 0x19], 3
jb 0x7ff71cd9ecf
mov rcx, qword [rcx + 0x10]
lea rax, [rsp + 0x270]
mov edx, 0x1c
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov r9, r14
mov r8, rsi
mov qword [rsp + 0x20], rax
call fcn.7ff71cd8acc
test edi, 0xa00
je 0x7ff71cd9edd
mov rdx, qword [r13 + 0x14]
jmp 0x7ff71cd9ee1
mov rdx, qword [r13 + 0xc]
bt edi, 0xa
jae 0x7ff71cd9f44
xor eax, eax
cmp ebp, eax
jne 0x7ff71cd9f40
mov rdx, qword [r15 + 0x10]
mov rcx, qword [r13 + 0x1c]
call fcn.7ff71cd8e64
xor ecx, ecx
cmp eax, ecx
je 0x7ff71cd9f40
mov edi, 0x121
mov rcx, qword [0x7ff71cee2c0]
cmp rcx, rbx
je 0x7ff71cda28b
bt dword [rcx + 0x1c], 0x16
jae 0x7ff71cda28b
cmp byte [rcx + 0x19], 1
jb 0x7ff71cda28b
mov rcx, qword [rcx + 0x10]
mov edx, 0x1d
mov r8, rsi
call fcn.7ff71cc12c0
jmp 0x7ff71cda28b
mov rdx, qword [r13 + 0x1c]
lea r8, [rsp + 0x38]
mov ecx, edi
call fcn.7ff71cd9638
xor ecx, ecx
mov r12d, eax
cmp eax, ecx
jne 0x7ff71cd9f8d
mov rcx, qword [0x7ff71cee2c0]
cmp rcx, rbx
je 0x7ff71cd9f83
bt dword [rcx + 0x1c], 0x16
jae 0x7ff71cd9f83
cmp byte [rcx + 0x19], 1
jb 0x7ff71cd9f83
mov rcx, qword [rcx + 0x10]
mov edx, 0x1e
mov r8, rsi
call fcn.7ff71cc12c0
mov edi, 0x10a
jmp 0x7ff71cda28b
mov rax, qword [r15 + 0x10]
mov rbp, qword [rsp + 0x38]
cmp rax, rcx
je 0x7ff71cd9fa1
mov qword [rbp + 0x58], rax
jmp 0x7ff71cd9faf
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
mov edx, eax
mov qword [rbp + 0x58], rdx
mov rax, qword [rbp + 0x50]
cmp qword [rbp + 0x58], rax
je 0x7ff71cd9fbe
bts dword [rbp + 0x68], 0x11
or dword [rsp + 0x54], 0xffffffff
lea rax, [rsp + 0x270]
mov dword [rsp + 0x58], ecx
lea rcx, [rsp + 0x70]
lea r8, [rsp + 0x48]
lea rdx, str.MCI32
mov qword [rsp + 0x4c], rax
mov dword [rsp + 0x48], r12d
call sym.WINMM.dll_OpenDriver
mov rdi, rax
xor eax, eax
cmp rdi, rax
jne 0x7ff71cda02e
mov rcx, qword [0x7ff71cee2c0]
cmp rcx, rbx
je 0x7ff71cda021
bt dword [rcx + 0x1c], 0x16
jae 0x7ff71cda021
cmp byte [rcx + 0x19], 1
jb 0x7ff71cda021
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x1f]
mov r8, rsi
call fcn.7ff71cc12c0
mov rcx, rbp
call fcn.7ff71cdaa5c
jmp 0x7ff71cd9f83
mov rcx, rdi
mov dword [r13 + 8], r12d
call sym.WINMM.dll_DrvGetModuleHandle
mov edx, dword [0x7ff71cf0e28]
mov qword [rbp + 0x60], rdi
mov qword [rbp + 0x48], rax
mov eax, dword [rsp + 0x54]
xor ecx, ecx
mov dword [rbp + 0x40], eax
mov eax, dword [rsp + 0x58]
mov dword [rbp + 0x38], eax
mov r8d, dword [rsp + 0x58]
mov eax, ecx
cmp edx, ecx
jbe 0x7ff71cda079
lea rcx, [0x7ff71cf0e90]
cmp dword [rcx], r8d
je 0x7ff71cda0a1
inc eax
add rcx, 0x28
cmp eax, edx
jb 0x7ff71cda06a
cmp r8d, 0x201
jb 0x7ff71cda09e
cmp r8d, 0x20b
ja 0x7ff71cda09e
movzx edx, word [rsp + 0x58]
mov rcx, qword [0x7ff71cee2c8]
call sym.WINMM.dll_mciLoadCommandResource
jmp 0x7ff71cda0a1
or eax, 0xffffffff
mov dword [rbp + 0x3c], eax
cmp eax, 0xffffffff
jne 0x7ff71cda0ee
mov r8d, dword [rsp + 0x58]
mov rdx, qword [r13 + 0xc]
mov rcx, qword [0x7ff71cee2c8]
call sym.WINMM.dll_mciLoadCommandResource
mov dword [rbp + 0x3c], eax
mov rcx, qword [0x7ff71cee2c0]
cmp rcx, rbx
je 0x7ff71cda0ee
bt dword [rcx + 0x1c], 0x16
jae 0x7ff71cda0ee
cmp byte [rcx + 0x19], 3
jb 0x7ff71cda0ee
mov rcx, qword [rcx + 0x10]
mov edx, 0x20
mov r9d, eax
mov r8, rsi
call fcn.7ff71cc3dd4
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r14
repne scasw ax, word [rdi]
not rcx
lea rdi, [rcx + rcx]
mov ecx, edi
call fcn.7ff71cdf53c
xor ecx, ecx
mov qword [rbp + 8], rax
cmp rax, rcx
jne 0x7ff71cda157
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, r12d
call fcn.7ff71cdac34
mov rcx, qword [0x7ff71cee2c0]
cmp rcx, rbx
je 0x7ff71cda14d
bt dword [rcx + 0x1c], 0x16
jae 0x7ff71cda14d
cmp byte [rcx + 0x19], 1
jb 0x7ff71cda14d
mov edx, 0x21
mov rcx, qword [rcx + 0x10]
mov r8, rsi
call fcn.7ff71cc12c0
mov edi, 0x108
jmp 0x7ff71cda28b
mov r8, r14
mov rdx, rdi
mov rcx, rax
call fcn.7ff71cc4024
xor ecx, ecx
cmp eax, ecx
jge 0x7ff71cda19b
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, r12d
call fcn.7ff71cdac34
mov rcx, qword [0x7ff71cee2c0]
cmp rcx, rbx
je 0x7ff71cda14d
bt dword [rcx + 0x1c], 0x16
jae 0x7ff71cda14d
cmp byte [rcx + 0x19], 1
jb 0x7ff71cda14d
mov edx, 0x22
jmp 0x7ff71cda141
cmp qword [r15], rcx
je 0x7ff71cda213
mov r8d, dword [rbp + 0x3c]
mov edx, dword [rbp + 0x40]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x30]
mov rcx, r15
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
call fcn.7ff71cd979c
mov edi, eax
xor eax, eax
cmp edi, eax
je 0x7ff71cda208
mov rcx, qword [0x7ff71cee2c0]
cmp rcx, rbx
je 0x7ff71cda1f3
bt dword [rcx + 0x1c], 0x16
jae 0x7ff71cda1f3
cmp byte [rcx + 0x19], 1
jb 0x7ff71cda1f3
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x23]
mov r8, rsi
call fcn.7ff71cc12c0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, r12d
call fcn.7ff71cdac34
jmp 0x7ff71cda28b
mov eax, dword [rsp + 0x30]
mov r13, qword [rsp + 0x60]
jmp 0x7ff71cda233
cmp dword [r15 + 0x18], ecx
je 0x7ff71cda22f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, r12d
call fcn.7ff71cdac34
mov edi, dword [r15 + 0x18]
jmp 0x7ff71cda28b
mov eax, dword [rsp + 0x34]
mov r8d, eax
mov r9, r13
mov edx, 0x801
mov ecx, r12d
call sym.WINMM.dll_mciSendCommandW
xor r8d, r8d
mov ecx, r12d
movzx edi, ax
xor eax, eax
cmp edi, eax
je 0x7ff71cda261
xor r9d, r9d
xor edx, edx
call fcn.7ff71cdac34
jmp 0x7ff71cda26b
mov edx, 3
call fcn.7ff71cdb068
cmp qword [rsp + 0x68], r13
je 0x7ff71cda28b
xor eax, eax
cmp r13, rax
je 0x7ff71cda28b
mov rcx, qword [0x7ff71cee2d8]
mov r8, r13
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0x40]
xor ecx, ecx
cmp rax, rcx
je 0x7ff71cda2a9
mov rcx, qword [0x7ff71cee2d8]
mov r8, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.7ff71cc11f0
mov rbx, qword [rsp + 0x3d8]
add rsp, 0x380
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret