Function at 0x180022710
Capabilities:
Access the windows event log
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3d0]
sub rsp, 0x4e0
mov rax, qword [0x18003acf8]
xor rax, rsp
mov qword [rbp + 0x3c8], rax
mov rsi, rdx
mov qword [rbp - 0x38], rdx
mov edi, ecx
mov dword [rbp - 0x68], ecx
movdqa xmm0, xmmword [0x180032790]
movdqa xmmword [rbp + 0x290], xmm0
mov byte [rbp + 0x280], 0
movdqa xmm1, xmm0
movdqa xmmword [rbp + 0x2b0], xmm0
mov byte [rbp + 0x2a0], 0
movdqa xmmword [rbp + 0x2d0], xmm0
mov byte [rbp + 0x2c0], 0
movdqa xmmword [rbp + 0x300], xmm0
mov byte [rbp + 0x2f0], 0
movdqa xmmword [rbp + 0x320], xmm0
mov byte [rbp + 0x310], 0
xor ecx, ecx
mov qword [rbp + 0xd0], rcx
mov word [rbp + 0xd8], cx
movdqu xmmword [rbp + 0xea], xmm0
mov byte [rbp + 0xda], cl
mov qword [rbp + 0xa0], rcx
mov word [rbp + 0xa8], cx
movdqu xmmword [rbp + 0xba], xmm0
mov byte [rbp + 0xaa], cl
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp], rcx
mov qword [rbp + 8], rcx
movdqa xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x140], rcx
mov qword [rbp + 0x148], rcx
mov qword [rbp + 0x150], rcx
mov ecx, 0x30
call fcn.180025458
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x148], rax
xor ecx, ecx
mov qword [rbp + 0x158], rcx
xorps xmm2, xmm2
movsd qword [rbp + 0x160], xmm2
mov qword [rbp + 0x168], rcx
mov dword [rbp + 0x170], 1
mov qword [rbp + 0x178], rcx
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x180], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x190], xmm1
movdqa xmmword [rbp + 0x1a0], xmm0
mov qword [rbp + 0x1b0], rcx
mov qword [rbp + 0x1b8], 0xffffffffffffffff
mov dword [rbp + 0x1c0], ecx
xor eax, eax
movups xmmword [rbp + 0x1c8], xmm0
movups xmmword [rbp + 0x1d8], xmm0
movups xmmword [rbp + 0x1e8], xmm0
movups xmmword [rbp + 0x1f8], xmm0
mov qword [rbp + 0x208], rax
movdqa xmm0, xmmword [0x180032790]
movdqa xmmword [rbp + 0x220], xmm0
mov byte [rbp + 0x210], al
mov word [rbp + 0x230], cx
mov dword [rbp + 0x234], ecx
mov qword [rbp + 0x238], rcx
xorps xmm0, xmm0
movaps xmmword [rbp + 0x240], xmm0
movsd qword [rbp + 0x250], xmm2
mov byte [rbp + 0x258], al
mov qword [rbp + 0x25c], rcx
mov r13d, edi
lea ebx, [rdi - 0x12]
mov dword [rbp - 0x78], ebx
lea r8d, [rcx + 0x65]
cmp edi, ebx
jbe 0x180022b27
lea r12d, [rdi - 0x32]
lea rdx, [0x180000000]
lea r8d, [rcx + 0x6d]
lea r9d, [rcx + 0x64]
mov r10d, 0x6573
lea r11d, [rcx + 0x69]
movzx r14d, byte [rbp - 0x78]
mov r15, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x58]
nop dword [rax]
cmp r12d, 0x2c
ja case.0x18002296d.18
movzx eax, byte [rdx + r12 + 0x23b34]
mov ecx, dword [rdx + rax*4 + 0x23ae8]
add rcx, rdx
jmp rcx
mov word [rbp + 0x336], r8w
mov eax, 0x65
mov word [rbp + 0x337], ax
jmp case.0x18002296d.18
mov word [rbp + 0x338], r9w
jmp case.0x18002296d.18
mov r8d, 1
lea rdx, [0x180032354]
lea rcx, [rbp + 0x2a0]
call fcn.1800189c0
lea rdx, [0x180000000]
mov r8d, 0x6d
lea r9d, [r8 - 9]
mov r10d, 0x6573
lea r11d, [r8 - 4]
jmp case.0x18002296d.18
mov eax, 0x61
mov word [rbp + 0x330], ax
mov dword [rbp + 0x331], 0x797764
jmp case.0x18002296d.18
mov eax, dword [0x18003235c]
mov dword [rbp + 0x391], eax
movzx eax, byte [0x180032360]
mov byte [rbp + 0x395], al
mov eax, dword [0x180032370]
mov dword [rbp + 0x396], eax
movzx eax, byte [0x180032374]
mov byte [rbp + 0x39a], al
jmp case.0x18002296d.18
mov eax, 0x61
mov word [rbp + 0x33a], ax
mov dword [rbp + 0x33b], 0x6f632e
mov word [rbp + 0x33e], r8w
jmp case.0x18002296d.18
movzx eax, word [0x180032381]
mov word [rbp + 0x39b], ax
movzx eax, byte [0x180032383]
mov byte [rbp + 0x39d], al
jmp case.0x18002296d.18
mov dword [rbp + 0x3ae], 0x6e
jmp case.0x18002296d.18
mov r8, rsi
mov edx, 0x54
lea rcx, str.float___OVERLOADABLE___lgamma_r__float_in_____local_int_iptr__
call fcn.1800197e0
jmp 0x1800229ae
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rsi + rbx], 0
jne 0x180022a92
lea rsi, [0x18003ab90]
mov rax, qword [0x18003ab90]
test rax, rax
je 0x180022b08
nop
mov qword [rbp - 0x30], rbx
mov qword [rsp + 0x20], rax
mov r9d, 0x98
lea r8, [rbp - 0x30]
mov rdx, qword [rbp - 0x38]
lea rcx, [rbp + 0x40]
call fcn.18001db20
movsd xmm0, qword [rax]
movsd qword [rbp - 0x58], xmm0
cmp dword [rbp - 0x58], 0
je 0x180022ea2
add rsi, 0x10
mov rax, qword [rsi]
test rax, rax
jne 0x180022ab0
lea rdx, [0x180000000]
lea r8d, [rax + 0x6d]
lea r9d, [rax + 0x64]
mov r10d, 0x6573
lea r11d, [rax + 0x69]
mov rsi, qword [rbp - 0x38]
mov ebx, dword [rbp - 0x78]
dec r13d
dec r12d
cmp r13d, ebx
ja 0x180022950
mov edi, dword [rbp - 0x68]
xor ecx, ecx
lea r8d, [rcx + 0x65]
lea ebx, [rdi + 0xe66]
mov dword [rbp - 0x44], ebx
cmp edi, ebx
jae case.0x180022ced.12
mov r14, qword [rbp - 0x58]
mov r13d, dword [rbp - 0x40]
mov r12, qword [rbp - 0x58]
movzx r15d, byte [rbp - 0x78]
lea rax, [0x180008950]
mov edx, 0x1bb
cmp edi, 0x366
ja 0x1800230b6
je 0x18002309f
cmp edi, 0x1bc
ja 0x180022f2d
je 0x180022f25
mov eax, edi
sub eax, 0x38
je 0x180022eff
sub eax, 0x26
je 0x180022ef6
sub eax, 0x9c
je 0x180022eb0
cmp eax, 0x26
jne 0x180023829
mov word [rbp + 0x2e0], dx
mov edx, 0xb4
lea rcx, [rbp + 0x2c0]
call fcn.180013600
mov dword [rsp + 0x20], 0x105
lea r9, [rbp + 0x2f0]
xor r8d, r8d
lea rdx, [rbp + 0x280]
xor ecx, ecx
call fcn.18000a570
jmp 0x180023827
mov r8d, 5
lea rdx, [0x18003240a]
lea rcx, [rbp + 0x388]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
xor eax, eax
mov word [rbp + 0x3a8], ax
lea rax, [rbp + 0x3a8]
sub rax, 2
nop dword [rax]
lea rax, [rax + 2]
cmp word [rax], 0
jne 0x180022c10
movsd xmm0, qword [0x180032420]
movsd qword [rax], xmm0
jmp 0x1800229ae
mov word [rbp + 0x334], r10w
jmp case.0x18002296d.18
mov word [rbp + 0x339], r11w
jmp case.0x18002296d.18
mov eax, dword [str.GetLocalPort]
mov dword [rbp + 0x388], eax
movzx eax, byte [0x18003242c]
mov byte [rbp + 0x38c], al
mov byte [rbp + 0x38d], 0
mov r8d, 4
lea rdx, [0x180032448]
lea rcx, [rbp + 0x388]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x1800229ae
movzx eax, word [0x18003249d]
mov word [rbp + 0x39e], ax
movzx eax, byte [0x18003249f]
mov byte [rbp + 0x3a0], al
jmp case.0x18002296d.18
mov byte [rbp + 0x3a1], 0
jmp case.0x18002296d.18
lea r8, [0x18003ac08]
mov edx, 0x70
xor ecx, ecx
call fcn.18001ec20
test al, al
jne 0x180022e64
xor r9d, r9d
mov ebx, r9d
cmp ebx, 0xc
ja case.default.0x180022ced
mov eax, ebx
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0x23b64]
add rcx, rdx
jmp rcx
mov r14b, 1
mov r15, r9
jmp case.default.0x180022ced
mov byte [rbp + 0x348], 0
mov r8d, 4
lea rdx, [0x1800324c7]
lea rcx, [rbp + 0x340]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, 0x7364
mov word [rbp + 0x34c], ax
jmp 0x180022e4b
test r14b, r14b
je 0x180022d65
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r9
mov dword [rsp + 0x30], r9d
mov word [rsp + 0x28], r9w
mov qword [rsp + 0x20], r9
xor r9d, r9d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea rdx, [rbp + 0x100]
mov rcx, r15
call sub.IMM32.dll_ImmGetCompositionFontA
jmp 0x180022e4b
mov dword [rbp - 0x70], 1
jmp case.default.0x180022ced
mov rdi, r9
jmp case.default.0x180022ced
mov eax, 0x5763
mov word [rbp + 0x341], ax
mov byte [rbp + 0x343], 0
jmp case.default.0x180022ced
lea rdx, [rbp + 0x340]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov rdi, rax
jmp 0x180022e4b
movzx eax, word [0x180032505]
mov word [rbp + 0x345], ax
movzx eax, byte [0x180032507]
mov byte [rbp + 0x347], al
jmp case.default.0x180022ced
mov byte [rbp + 0x34e], 0
jmp case.default.0x180022ced
mov eax, 0x6e69
mov word [rbp + 0x343], ax
jmp case.default.0x180022ced
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], rax
mov dword [rbp + 0x138], eax
mov ecx, r9d
movzx eax, r14b
test rdi, rdi
cmovne ecx, eax
movzx r14d, cl
jmp case.default.0x180022ced
mov r8d, 1
lea rdx, [0x18003251f]
lea rcx, [rbp + 0x340]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x341], 0
xor r9d, r9d
inc ebx
lea eax, [rbx + 0xc6]
cmp eax, 0xd3
jb 0x180022cd1
mov ebx, dword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
jmp 0x1800229ae
lea rax, [rbp + 0x330]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180022e85
lea rdx, [rbp + 0x330]
lea rcx, [rbp + 0x280]
jmp 0x1800229a9
mov eax, dword [rsi + 8]
mov dword [0x18003ae30], eax
jmp case.0x180022ced.12
mov r8d, 4
lea rdx, [0x1800301b0]
lea rcx, [rbp + 0x3b8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov dword [rbp + 0x3be], 0x6c
mov r8d, 0x84
lea rdx, [rbp + 0x3a8]
lea rcx, [rbp + 0x388]
call fcn.18001acb0
mov qword [rbp + 0x40], rax
jmp 0x180023827
mov byte [rbp - 0x7f], 1
jmp 0x180023829
mov dword [rbp + 0x3b0], r8d
mov r8d, 3
lea rdx, [0x1800311f0]
lea rcx, [rbp + 0x3a8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x180023827
mov dword [rbp - 0x60], ecx
jmp 0x180023829
mov eax, edi
sub eax, 0x1e2
je 0x18002304c
sub eax, 0x9c
je 0x180022fbc
sub eax, 0x26
je 0x180022f73
cmp eax, 0x9c
jne 0x180023829
lea rdx, [rbp - 0x60]
mov rcx, qword [rsi]
call qword [rbp + 0x40]
test eax, eax
jne 0x180023827
mov rax, qword [rsi]
mov qword [rsi + 8], rax
mov byte [rbp - 0x70], 0
jmp case.0x180022ced.12
lea rdx, [rbp - 0x10]
mov ecx, 0x4d
call fcn.18000ed40
lea rax, [rbp + 0xd0]
mov qword [rbp - 0x68], rax
mov rdx, qword [rbp - 8]
cmp rdx, qword [rbp]
je 0x180022faa
lea rax, [rbp + 0xd0]
mov qword [rdx], rax
add qword [rbp - 8], 8
jmp 0x180023827
lea r8, [rbp - 0x68]
lea rcx, [rbp - 0x10]
call fcn.1800011b0
jmp 0x180023827
lea rdx, [rbp - 0x60]
xor ecx, ecx
call qword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x180023841
mov ecx, dword [rbp - 0x60]
shr rcx, 5
mov byte [rbp - 0x78], 0
mov r10, qword [rsi + 8]
mov r8, qword [rsi]
mov rdx, r10
sub rdx, r8
sar rdx, 5
cmp rcx, rdx
jae 0x180023005
shl rcx, 5
add rcx, r8
mov qword [rsi + 8], rcx
jmp 0x180023827
jbe 0x180023827
mov rax, qword [rsi + 0x10]
sub rax, r8
sar rax, 5
cmp rcx, rax
jbe 0x18002302f
lea r8, [rbp - 0x78]
mov rdx, rcx
mov rcx, rsi
call fcn.1800023c0
jmp 0x180023827
sub rcx, rdx
xor r9d, r9d
mov r8, rcx
mov rdx, r10
mov rcx, rsi
call fcn.180018490
mov qword [rsi + 8], rax
jmp 0x180023827
mov word [rbp - 0x78], dx
lea r9, [0x18003ac68]
lea r8, [rbp - 0x78]
mov edx, 0x86
lea rcx, [rbp + 0xd0]
call fcn.180017af0
mov qword [rbp - 0x30], 0xffffffffffffffff
mov eax, 0x1bb
mov word [rbp - 0x78], ax
mov r9d, 0xeb
lea r8, [0x18003ac88]
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0xa0]
call fcn.1800064a0
jmp 0x180023827
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.dbghelp.dll_SymInitialize]
mov dword [rbp - 0x40], eax
jmp 0x180023827
cmp edi, 0x66e
ja 0x180023744
je 0x180023718
mov eax, edi
sub eax, 0x402
je 0x180023841
sub eax, 0x26
je 0x1800236d9
sub eax, 0xc2
je 0x180023682
cmp eax, 0xc2
jne 0x180023829
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ecx
lea r9, [rbp + 0x70]
lea r8, [0x18000fa60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x180023671
mov ebx, 0xcf
cmp ebx, 0x2c9fd
ja 0x1800233d2
je 0x1800233b2
cmp ebx, 0x16566
ja 0x1800232b2
je 0x18002329a
cmp ebx, 0x99a2
ja 0x180023201
je 0x1800231d0
cmp ebx, 0xcf
je 0x1800231b5
cmp ebx, 0x33c0
je 0x18002318e
cmp ebx, 0x66b1
jne 0x18002365c
mov eax, 0x54
mov word [rbp + 0x33a], ax
mov eax, 0x7079
mov word [rbp + 0x33b], ax
jmp 0x18002365c
mov eax, 0x52
mov word [rbp + 0x334], ax
mov eax, 0x65
mov word [rbp + 0x335], ax
mov dword [rbp + 0x336], 0x6e727574
jmp 0x18002365c
mov eax, 0x73
mov word [rbp + 0x330], ax
mov dword [rbp + 0x331], 0x5f7465
jmp 0x18002365c
mov eax, 0x7365
mov word [rbp + 0x33d], ax
mov byte [rbp + 0x33f], 0
mov eax, dword [str.__builtin_msa_fsueq_d]
mov dword [rbp + 0x370], eax
movzx eax, byte [0x180032594]
mov byte [rbp + 0x374], al
jmp 0x18002365c
cmp ebx, 0xcc93
je 0x18002325a
cmp ebx, 0xff84
je 0x180023235
cmp ebx, 0x13275
jne 0x18002365c
mov eax, 0x7265
mov word [rbp + 0x380], ax
mov byte [rbp + 0x382], 0
jmp 0x18002365c
mov eax, dword [0x18003254b]
mov dword [rbp + 0x37b], eax
movzx eax, byte [0x18003254f]
mov byte [rbp + 0x37f], al
mov byte [rbp + 0x380], 0
jmp 0x18002365c
mov byte [rbp + 0x375], 0
mov r8d, 1
lea rdx, [0x180032565]
lea rcx, [rbp + 0x370]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 5
lea rdx, [0x180032576]
lea rcx, [rbp + 0x376]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x18002365c
mov eax, 0x6d69
mov word [rbp + 0x382], ax
mov byte [rbp + 0x384], 0
jmp 0x18002365c
cmp ebx, 0x2312a
ja 0x180023362
je 0x180023322
cmp ebx, 0x19857
je 0x180023314
cmp ebx, 0x1cb48
je 0x180023308
cmp ebx, 0x1fe39
jne 0x18002365c
lea rcx, [rbp + 0x350]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x1800232e6
movzx eax, word [0x18003258c]
mov word [rcx], ax
movzx eax, byte [0x18003258e]
mov byte [rcx + 2], al
jmp 0x18002365c
mov byte [rbp + 0x350], 0
jmp 0x18002365c
mov word [rbp + 0x384], 0x68
jmp 0x18002365c
mov dword [rbp + 0x352], 0x74276e
mov dword [rbp + 0x355], 0x6c6620
lea rcx, [rbp + 0x350]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x180023340
movzx eax, word [0x18003253c]
mov word [rcx], ax
movzx eax, byte [0x18003253e]
mov byte [rcx + 2], al
jmp 0x18002365c
cmp ebx, 0x2641b
je 0x180023392
cmp ebx, 0x2970c
jne 0x18002365c
movzx eax, word [0x180032588]
mov word [rbp + 0x35c], ax
mov word [rbp + 0x35e], 0x70
jmp 0x18002365c
movzx eax, word [0x1800325a8]
mov word [rbp + 0x35a], ax
movzx eax, byte [0x1800325aa]
mov byte [rbp + 0x35c], al
jmp 0x18002365c
movzx eax, word [0x180031000]
mov word [rbp + 0x35f], ax
movzx eax, byte [0x180031002]
mov byte [rbp + 0x361], al
jmp 0x18002365c
cmp ebx, 0x4c767
ja 0x1800234d6
je 0x1800234c0
cmp ebx, 0x395c1
ja 0x180023464
je 0x18002345c
cmp ebx, 0x2fcee
je 0x18002344d
cmp ebx, 0x32fdf
je 0x180023417
cmp ebx, 0x362d0
jne 0x18002365c
mov qword [rbp - 0x58], 0xffffffffffffffff
jmp 0x18002365c
mov dword [rbp + 0x364], 0x642064
mov eax, 0x61
mov word [rbp + 0x367], ax
movzx eax, word [0x1800325ac]
mov word [rbp + 0x368], ax
movzx eax, byte [0x1800325ae]
mov byte [rbp + 0x36a], al
jmp 0x18002365c
mov dword [rbp + 0x361], 0x657373
jmp 0x18002365c
mov r15b, 1
jmp 0x18002365c
cmp ebx, 0x42e94
je 0x1800234b7
cmp ebx, 0x46185
je 0x18002348e
cmp ebx, 0x49476
jne 0x18002365c
xor eax, eax
mov dword [rbp - 0x24], eax
lea r14, [rax - 1]
jmp 0x18002365c
xor eax, eax
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], rax
mov dword [rbp - 0x20], 0x2000000
jmp 0x18002365c
mov byte [rbp - 0x80], 1
jmp 0x18002365c
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
jmp 0x18002365c
cmp ebx, 0x5932b
ja 0x18002361f
je 0x180023578
cmp ebx, 0x4fa58
je 0x180023558
cmp ebx, 0x52d49
je 0x18002353a
cmp ebx, 0x5603a
jne 0x18002365c
mov r8d, r13d
lea rdx, [rbp + 0x80]
mov rcx, r12
call qword [sym.imp.WINMM.dll_mixerGetControlDetailsA]
xor r8d, r8d
mov edx, r8d
movzx ecx, byte [rbp - 0x80]
cmp dword [rbp - 0x48], r8d
cmovne edx, ecx
mov byte [rbp - 0x80], dl
movzx r15d, r15b
test eax, eax
cmovne r15d, r8d
jmp 0x18002365c
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.dbghelp.dll_SymInitialize]
mov dword [rbp - 0x48], eax
xor eax, eax
mov dword [rbp - 0x28], eax
mov r13d, eax
jmp 0x18002365c
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov dword [rbp + 0x80], 0x20
xorps xmm1, xmm1
movups xmmword [rbp + 0x270], xmm1
jmp 0x18002365c
lea rax, [rbp + 0x50]
mov qword [rsp + 0x80], rax
lea rax, [rbp + 0x54]
mov qword [rsp + 0x78], rax
lea rax, [rbp + 0x58]
mov qword [rsp + 0x70], rax
mov eax, dword [rbp - 0x28]
mov dword [rsp + 0x68], eax
lea rax, [rbp + 0x270]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x58], 1
lea rax, [rbp + 0x60]
mov qword [rsp + 0x50], rax
mov eax, dword [rbp - 0x24]
mov dword [rsp + 0x48], eax
xor ecx, ecx
mov dword [rsp + 0x40], ecx
mov eax, dword [rbp - 0x20]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rcx
lea rax, [rbp + 0x100]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x350]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x370]
mov r8, qword [rbp - 0x58]
xor edx, edx
lea rcx, [rbp + 0x330]
call qword [sym.imp.ADVAPI32.dll_AccessCheckByTypeResultListAndAuditAlarmByHandleA]
test r15b, r15b
je 0x18002365c
mov r8d, r13d
lea rdx, [rbp + 0x80]
mov rcx, r12
call qword [sym.imp.WINMM.dll_mixerSetControlDetails]
jmp 0x18002365c
cmp ebx, 0x5c61c
je 0x180023635
cmp ebx, 0x5f90d
je case.0x180022ced.12
jmp 0x18002365c
cmp byte [rbp - 0x80], 0
je 0x180023655
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.dbghelp.dll_SymEnumerateModules64]
mov dword [rbp - 0x48], eax
mov rcx, r14
call qword [sym.imp.dbghelp.dll_SymCleanup]
mov dword [rbp - 0x70], 1
add ebx, 0x32f1
cmp ebx, 0x62b2f
jbe 0x180023123
mov ebx, dword [rbp - 0x44]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [rbp - 0x68]
jmp 0x180023827
mov eax, dword [0x18003acb0]
mov dword [rbp - 0x68], eax
mov dword [rsp + 0x20], 0xeb
lea r9, [rbp - 0x68]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x10]
call fcn.18000d2d0
lea rax, [rbp - 0x10]
mov qword [rbp + 0x340], rax
mov eax, dword [0x18003acb0]
mov dword [rbp + 0x348], eax
mov eax, dword [0x18003acb4]
mov dword [rbp + 0x34c], eax
movaps xmm0, xmmword [rbp + 0x340]
movdqa xmmword [rbp + 0x70], xmm0
jmp 0x180023827
lea rax, [rbp + 0xa0]
mov qword [rbp - 0x68], rax
mov rax, qword [rbp - 8]
cmp rax, qword [rbp]
je 0x180023702
lea rcx, [rbp + 0xa0]
mov qword [rax], rcx
add qword [rbp - 8], 8
jmp 0x180023827
lea r8, [rbp - 0x68]
mov rdx, qword [rbp - 8]
lea rcx, [rbp - 0x10]
call fcn.1800011b0
jmp 0x180023827
mov qword [rbp - 0x68], rax
xor r9d, r9d
lea r8, [rbp - 0x68]
lea edx, [r9 + 0x48]
xor ecx, ecx
call fcn.180009480
xor eax, eax
mov ecx, eax
movzx eax, byte [rbp - 0x7f]
cmp dword [rbp - 0x40], ecx
cmovne ecx, eax
mov byte [rbp - 0x7f], cl
jmp 0x180023827
cmp edi, 0x730
je 0x18002380b
cmp edi, 0x7f2
je 0x1800237f0
cmp edi, 0x8b4
je 0x180023775
cmp edi, 0x976
je case.0x180022ced.12
jmp 0x180023829
cmp byte [rbp - 0x7f], 0
je 0x1800237eb
mov ebx, 0x85
mov rsi, qword [rbp - 0x30]
cmp ebx, 0x85
je 0x1800237b9
cmp ebx, 0x145
je 0x1800237a7
cmp ebx, 0x205
jne 0x1800237d4
mov rcx, rsi
call qword [sym.imp.dbghelp.dll_SymCleanup]
jmp 0x1800237d4
lea rdx, [rbp + 0x80]
mov rcx, rsi
call qword [sym.imp.dbghelp.dll_SymGetSymPrev64]
jmp 0x1800237d4
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
mov dword [rbp + 0x80], 0x20
add ebx, 0xc0
cmp ebx, 0x2c5
jb 0x180023784
mov rsi, qword [rbp - 0x38]
mov ebx, dword [rbp - 0x44]
xor ecx, ecx
mov dword [rbp - 0x70], ecx
jmp 0x180023829
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x140]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0x6e]
call fcn.180020d10
jmp 0x180023827
lea r9, [rbp + 0x140]
lea r8, [rbp - 0x10]
lea rdx, [0x18003ac00]
mov ecx, 0x1d
call fcn.1800090b0
xor ecx, ecx
add edi, 0xc2
mov dword [rbp - 0x68], edi
cmp edi, ebx
jae case.0x180022ced.12
mov r8d, 0x65
jmp 0x180022b49
mov rax, qword [rsi + 8]
cmp qword [rsi], rax
setne byte [rbp - 0x70]
lea rcx, [rbp + 0x1b8]
call fcn.180003230
mov rbx, qword [rbp + 0x1a0]
test rbx, rbx
je 0x1800238e0
mov rdi, qword [rbp + 0x1a8]
cmp rbx, rdi
je 0x18002388c
mov rcx, rbx
call fcn.180018420
add rbx, 0x20
cmp rbx, rdi
jne 0x180023874
mov rbx, qword [rbp + 0x1a0]
mov rdx, qword [rbp + 0x1b0]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x1800238c2
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800238c2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.180025494
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x1a0], xmm0
xor esi, esi
mov qword [rbp + 0x1b0], rsi
jmp 0x1800238e2
xor esi, esi
mov rdx, qword [rbp + 0x188]
test rdx, rdx
je 0x18002391a
mov r8, qword [rbp + 0x198]
sub r8, rdx
sar r8, 4
lea rcx, [rbp + 0x188]
call fcn.1800196a0
mov qword [rbp + 0x188], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x190], xmm0
lea rcx, [rbp + 0x148]
call fcn.180003160
nop
mov rbx, qword [rbp + 8]
test rbx, rbx
je 0x1800239bb
mov rdi, qword [rbp + 0x10]
cmp rbx, rdi
je 0x180023955
nop dword [rax]
mov rcx, rbx
call fcn.180002a70
add rbx, 0x28
cmp rbx, rdi
jne 0x180023940
mov rbx, qword [rbp + 8]
mov rcx, qword [rbp + 0x18]
sub rcx, rbx
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rax, rbx
cmp rdx, 0x1000
jb 0x1800239a7
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800239a7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.180025494
mov qword [rbp + 8], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x10], xmm0
mov rdx, qword [rbp - 0x10]
test rdx, rdx
je 0x1800239e4
mov r8, qword [rbp]
sub r8, rdx
sar r8, 3
lea rcx, [rbp - 0x10]
call fcn.180019650
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp], rsi
mov rdx, qword [rbp + 0xc2]
cmp rdx, 0x10
jb 0x180023a28
inc rdx
mov rcx, qword [rbp + 0xaa]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180023a23
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180023a23
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180025494
movdqa xmm0, xmmword [0x180032790]
movdqu xmmword [rbp + 0xba], xmm0
mov byte [rbp + 0xaa], 0
mov rdx, qword [rbp + 0xf2]
cmp rdx, 0x10
jb 0x180023a83
inc rdx
mov rcx, qword [rbp + 0xda]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180023a7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180023a7e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180025494
movdqa xmm0, xmmword [0x180032790]
movdqu xmmword [rbp + 0xea], xmm0
mov byte [rbp + 0xda], 0
lea rcx, [rbp + 0x2f0]
call fcn.180002dd0
nop
lea rcx, [rbp + 0x280]
call fcn.180002e80
mov eax, dword [rbp - 0x70]
mov rcx, qword [rbp + 0x3c8]
xor rcx, rsp
call fcn.1800259a0
lea r11, [rsp + 0x4e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret