Function at 0x180016ee0
Capabilities:
Create mailslot
Create service
Delete service
Get common file path
Start service

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x570]
sub rsp, 0x670
mov rax, qword [0x1800a2078]
xor rax, rsp
mov qword [rbp + 0x560], rax
mov r13, qword [rbp + 0x5d0]
mov r12, r8
mov r15, qword [rbp + 0x5d8]
xor r8d, r8d
imul edi, r9d, 0x95a
mov rsi, rcx
mov dword [rbp - 0x80], r9d
mov ebx, r9d
mov qword [rbp - 0x68], rdx
cmp r9d, edi
ja 0x18001720b
imul r14d, r9d, 0xab
nop dword [rax]
cmp ebx, 0x1dfde
ja 0x18001712f
je 0x180017122
cmp ebx, 0xa094
ja 0x180017040
je 0x18001701a
mov eax, ebx
sub eax, 0xde
je 0x180016fea
sub eax, 0x11
je 0x180016fd3
cmp eax, 0x9439
jne 0x1800171fc
mov eax, dword [rdx + 4]
lea r8, [rbp + 0x2d5]
mov edx, 0xe3
mov dword [rbp - 0x78], eax
lea rcx, [rbp - 0x78]
call fcn.180083980
mov rcx, qword [rbp - 0x68]
lea r8, [rbp + 0x2d9]
mov edx, 0xe3
mov eax, dword [rcx + 8]
lea rcx, [rbp - 0x78]
mov dword [rbp - 0x78], eax
call fcn.180083980
mov rdx, qword [rbp - 0x68]
xor r8d, r8d
jmp 0x1800171fc
mov word [rbp + 0x2b0], r8w
lea rdx, [0x18008cb54]
mov r8d, 2
jmp 0x180017027
mov eax, dword [r15]
lea r8, [rbp + 0x2d0]
mov edx, 0xe3
mov dword [rbp - 0x78], eax
lea rcx, [rbp - 0x78]
call fcn.180083980
mov rdx, qword [rbp - 0x68]
xor r8d, r8d
movzx eax, byte [rdx]
mov byte [rbp + 0x2d4], al
jmp 0x1800171fc
mov r8d, 3
lea rdx, [0x18008c9a8]
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov rdx, qword [rbp - 0x68]
xor r8d, r8d
jmp 0x1800171fc
cmp ebx, 0x12972
je 0x1800170b6
cmp ebx, 0x14039
je 0x180017097
cmp ebx, 0x1bdbc
jne 0x1800171fc
mov eax, dword [r12]
lea r9, [rbp + 0x2d0]
mov dword [rbp - 0x78], eax
lea rcx, [rbp - 0x70]
lea rax, [rbp - 0x78]
mov dword [rbp - 0x70], 0x4e
mov r8, r13
mov qword [rsp + 0x20], rax
mov edx, 0xf2
call fcn.18007f280
mov rdx, qword [rbp - 0x68]
xor r8d, r8d
jmp 0x1800171fc
mov eax, dword [0x18008ca52]
mov dword [rbp + 0x2ba], eax
movzx eax, word [0x18008ca56]
mov word [rbp + 0x2be], ax
jmp 0x1800171fc
cmp byte [rsi], 0
movups xmm0, xmmword [rdx + 0xc]
movups xmm1, xmmword [rdx + 0x1c]
movups xmmword [rbp + 0x2dd], xmm0
movups xmmword [rbp + 0x2ed], xmm1
je 0x180017100
movups xmm0, xmmword [rdx + 0x4c]
movzx eax, byte [rdx + 0x6c]
movups xmm1, xmmword [rdx + 0x5c]
mov byte [rbp + 0x31d], al
movups xmmword [rbp + 0x2fd], xmm0
movups xmmword [rbp + 0x30d], xmm1
jmp 0x1800171fc
movups xmm0, xmmword [rdx + 0x2c]
mov byte [rbp + 0x2fd], 0
movups xmm1, xmmword [rdx + 0x3c]
movups xmmword [rbp + 0x2fe], xmm0
movups xmmword [rbp + 0x30e], xmm1
jmp 0x1800171fc
mov word [rbp + 0x2c0], r8w
jmp 0x1800171fc
cmp ebx, 0x45e72
ja 0x1800171dc
je 0x1800171c9
cmp ebx, 0x27f83
je 0x18001719e
cmp ebx, 0x31f28
je 0x180017173
cmp ebx, 0x3becd
jne 0x1800171fc
mov dword [rbp + 0x260], 0x53415357
mov byte [rbp + 0x264], 0
jmp 0x1800171fc
mov r8d, 1
lea rdx, [0x18008cab2]
lea rcx, [rbp + 0x2ca]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov rdx, qword [rbp - 0x68]
xor r8d, r8d
mov word [rbp + 0x2cc], r8w
jmp 0x1800171fc
mov r8d, 5
lea rdx, [0x18008c9f2]
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov rdx, qword [rbp - 0x68]
xor r8d, r8d
mov word [rbp + 0x2ca], r8w
jmp 0x1800171fc
mov dword [rbp + 0x264], 0x74726174
mov byte [rbp + 0x268], 0
jmp 0x1800171fc
cmp ebx, 0x4fe17
je 0x1800171f5
cmp ebx, 0x59dbc
jne 0x1800171fc
mov byte [rbp + 0x269], 0x70
jmp 0x1800171fc
mov byte [rbp + 0x268], 0x75
add ebx, r14d
cmp ebx, edi
jbe 0x180016f50
mov r9d, dword [rbp - 0x80]
movzx ebx, byte [rsp + 0x72]
mov eax, r9d
imul ecx, r9d, 0xd0
mov dword [rsp + 0x78], eax
mov dword [rbp - 0x28], ecx
cmp r9d, ecx
ja 0x180017d38
mov r14, qword [rbp - 0x58]
mov r15, qword [rbp - 0x50]
movzx r13d, byte [rsp + 0x71]
mov r12d, dword [rbp - 0x78]
mov byte [rsp + 0x76], bl
lea rdi, [0x180000000]
cmp eax, 0x5a8f
ja 0x1800175a2
je 0x18001736a
cmp eax, 0x2dbf
ja 0x1800172f9
je 0x1800172d6
cmp eax, 0xef
je 0x1800172bc
cmp eax, 0xfdf
je 0x18001728d
cmp eax, 0x1ecf
jne 0x180017d1b
mov byte [rsp + 0x7c], 1
mov byte [rsp + 0x70], 1
jmp 0x180017d1b
lea rax, [rbp + 0x320]
sub rax, 2
nop dword [rax + rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x1800172a0
movsd xmm0, qword [0x18008cb60]
movsd qword [rax], xmm0
jmp 0x180017d17
movups xmm0, xmmword [str.ws2_32.]
mov byte [rbp + 0x26a], 0
movups xmmword [rbp + 0x320], xmm0
jmp 0x180017d1b
movups xmm0, xmmword [str.flas_.events:TimerEvent]
movsd xmm1, qword [0x18008cb78]
movups xmmword [rbp + 0x338], xmm0
movsd qword [rbp + 0x348], xmm1
jmp 0x180017d1b
cmp eax, 0x3caf
je 0x180017320
cmp eax, 0x4b9f
jne 0x180017d1b
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.WINMM.dll_mciGetDeviceIDW]
mov dword [rbp - 0x70], eax
jmp 0x180017d13
xor r9d, r9d
lea r8, [rbp + 0x260]
mov edx, reloc.SHELL32.dll_SHSetInstanceExplorer
lea rcx, [rbp + 0x320]
call fcn.18000fe10
xorps xmm0, xmm0
mov qword [rbp], rax
xor eax, eax
mov dword [rbp + 0x90], eax
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
jmp 0x180017d13
mov ecx, 0x202
mov dword [rbp - 0x48], r8d
lea rdx, [rbp + 0xa0]
call qword [rbp]
test eax, eax
je 0x180017d13
xor edx, edx
mov esi, edx
nop dword [rax]
cmp esi, 0x14
ja case.default.0x1800173a5
mov eax, esi
mov ecx, dword [rdi + rax*4 + 0x17d68]
add rcx, rdi
jmp rcx
mov eax, 0x73
mov dword [rbp + 0x296], 0x6e0069
mov word [rbp + 0x29a], ax
jmp case.default.0x1800173a5
mov eax, 0x6f
mov word [rbp + 0x284], ax
jmp case.default.0x1800173a5
mov edx, 0x104
mov byte [rsp + 0x73], 1
lea rcx, [rbp + 0x350]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp case.default.0x1800173a5
mov dword [rbp + 0x2a6], 0x74
jmp case.default.0x1800173a5
cmp byte [rsp + 0x73], 0
je case.default.0x1800173a5
mov edi, 0x106
nop
mov eax, edi
sub eax, 0x105
je 0x180017447
cmp eax, 1
jne 0x180017452
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 8]
xor edx, edx
lea r8, [rbp - 4]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
test eax, eax
je 0x180017450
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
jmp 0x180017450
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
dec edi
cmp edi, 0x104
ja 0x180017410
lea rdi, [0x180000000]
jmp case.default.0x1800173a5
mov eax, 0x61
mov word [rbp + 0x27a], ax
jmp case.default.0x1800173a5
mov eax, 0x41
mov dword [rbp + 0x286], 0x5c0074
mov word [rbp + 0x28a], ax
jmp case.default.0x1800173a5
mov eax, 0x69
mov word [rbp + 0x2a4], ax
jmp case.default.0x1800173a5
mov eax, 0x69
mov word [rbp + 0x27c], ax
jmp case.default.0x1800173a5
mov eax, 0x62
mov dword [rbp + 0x290], 0x750079
mov word [rbp + 0x294], ax
jmp case.default.0x1800173a5
xor r9d, r9d
lea rcx, [rbp + 0x270]
xor edx, edx
mov r8d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_CreateMailslotW]
mov r15, rax
mov qword [rbp - 0x50], rax
jmp case.default.0x1800173a5
mov eax, 0x5c
mov word [rbp + 0x272], ax
jmp case.default.0x1800173a5
mov eax, 0x6c
mov dword [rbp + 0x27e], 0x73006c
mov word [rbp + 0x282], ax
jmp case.default.0x1800173a5
mov dword [rbp + 0x29c], 0x2d006b
jmp case.default.0x1800173a5
mov eax, 0x5c
mov word [rbp + 0x270], ax
jmp case.default.0x1800173a5
movzx eax, byte [rsp + 0x73]
cmp r15, 0xffffffffffffffff
mov ecx, edx
cmovne ecx, eax
mov byte [rsp + 0x73], cl
jmp case.default.0x1800173a5
mov dword [rbp + 0x2a0], 0x65005a
jmp case.default.0x1800173a5
mov eax, 0x6b
mov word [rbp + 0x28c], ax
jmp case.default.0x1800173a5
mov eax, 0x6d
mov dword [rbp + 0x274], 0x5c002e
mov word [rbp + 0x278], ax
jmp case.default.0x1800173a5
mov eax, 0x74
mov word [rbp + 0x28e], ax
inc esi
mov edx, 0
lea eax, [rsi + 0x18]
cmp eax, 0x2d
jb 0x180017390
jmp 0x180017d13
cmp eax, 0x964f
ja 0x180017ab8
je 0x180017b08
cmp eax, 0x697f
je 0x180017aa0
cmp eax, 0x786f
je 0x1800176e7
cmp eax, 0x875f
jne 0x180017d1b
cmp qword [rbp - 0x10], 0
jne 0x180017d1b
mov r15, qword [rbp + 8]
mov esi, 0xb5
mov r14d, dword [rbp - 0x1c]
nop dword [rax]
mov eax, esi
sub eax, 0xb2
je 0x1800176c0
sub eax, 1
je 0x180017627
sub eax, 1
je 0x180017619
cmp eax, 1
jne 0x1800176c5
movzx r13d, al
jmp 0x1800176c5
call qword [sym.imp.WINMM.dll_midiOutGetNumDevs]
mov r14d, eax
jmp 0x1800176c5
test r14d, r14d
movzx eax, r13b
mov ecx, r8d
cmovne ecx, eax
movzx r13d, cl
test cl, cl
je 0x1800176c5
mov edi, 0x128
mov eax, edi
sub eax, 0x128
je 0x1800176a5
sub eax, 1
je 0x180017690
sub eax, 1
je 0x18001767d
cmp eax, 1
jne 0x1800176ac
test r13b, r13b
je 0x1800176ac
mov r8d, 0x104
lea rdx, [rbp + 0x350]
mov ecx, r12d
call qword [sym.imp.WINMM.dll_midiOutGetErrorTextW]
xor r8d, r8d
jmp 0x1800176ac
movzx eax, r13b
test r12d, r12d
mov ecx, r8d
cmovne ecx, eax
movzx r13d, cl
jmp 0x1800176ac
lea rdx, [rbp - 0x24]
mov rcx, r15
call qword [sym.imp.WINMM.dll_midiOutGetID]
mov r12d, eax
xor r8d, r8d
jmp 0x1800176ac
mov r15, r8
mov dword [rbp - 0x24], r8d
inc edi
cmp edi, 0x12c
jb 0x180017645
mov qword [rbp + 8], r15
mov dword [rbp - 0x78], r12d
jmp 0x1800176c5
mov byte [rsp + 0x7c], 0
dec esi
mov r8d, 0
cmp esi, 0xb1
ja 0x1800175f0
mov dword [rbp - 0x1c], r14d
mov byte [rsp + 0x71], r13b
jmp 0x180017d0b
mov r8d, dword [rbp - 0x48]
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x338]
call qword [sym.imp.WINMM.dll_mmioOpenA]
mov rcx, qword [rbp - 0x68]
mov r9d, 0xd5
mov qword [rbp - 0x10], rax
xor r8d, r8d
xor eax, eax
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.180018b40
test al, al
jne 0x180017d13
xor edx, edx
mov esi, edx
cmp esi, 0x1d
ja case.0x18001773c.25
mov eax, esi
mov ecx, dword [rdi + rax*4 + 0x17dbc]
add rcx, rdi
jmp rcx
mov eax, 0x74
mov word [rbp + 0x24a], ax
jmp case.0x18001773c.25
mov eax, 0x27
mov word [rbp + 0x274], ax
mov eax, 0x20
mov word [rbp + 0x275], ax
jmp case.0x18001773c.25
mov eax, 0x2072
mov word [rbp + 0x242], ax
jmp case.0x18001773c.25
mov eax, 0x76
mov word [rbp + 0x240], ax
jmp case.0x18001773c.25
mov eax, 0x63
mov word [rbp + 0x24b], ax
mov eax, 0x6568
mov word [rbp + 0x24c], ax
jmp case.0x18001773c.25
mov qword [rbp - 0x18], rdx
jmp case.0x18001773c.25
mov eax, 0x6c
mov word [rbp + 0x282], ax
mov eax, 0x6569
mov word [rbp + 0x283], ax
jmp case.0x18001773c.25
mov eax, 0x6d
mov word [rbp + 0x276], ax
mov eax, 0x646f
mov word [rbp + 0x277], ax
jmp case.0x18001773c.25
movzx eax, byte [rsp + 0x74]
test r14, r14
mov ecx, edx
cmovne ecx, eax
movzx eax, byte [rsp + 0x75]
cmp dword [rbp - 0x60], 0
mov byte [rsp + 0x74], cl
mov ecx, edx
cmove ecx, eax
mov byte [rsp + 0x75], cl
jmp case.0x18001773c.25
mov eax, 0x7461
mov word [rbp + 0x246], ax
jmp case.0x18001773c.25
mov byte [rsp + 0x75], 1
mov qword [rbp + 0x10], rdx
jmp case.0x18001773c.25
mov eax, 0x7d7b
mov dword [rbp + 0x250], 0x203d20
mov word [rbp + 0x253], ax
jmp case.0x18001773c.25
mov eax, 0x57
mov word [rbp + 0x248], ax
mov eax, 0x61
mov word [rbp + 0x249], ax
jmp case.0x18001773c.25
mov eax, 0x73
mov word [rbp + 0x28b], ax
jmp case.0x18001773c.25
mov eax, 0x6966
mov word [rbp + 0x27a], ax
jmp case.0x18001773c.25
mov eax, 0x61
mov word [rbp + 0x241], ax
jmp case.0x18001773c.25
mov byte [rsp + 0x74], 1
jmp case.0x18001773c.25
mov dword [rbp + 0x285], 0x6f742064
jmp case.0x18001773c.25
cmp byte [rsp + 0x74], 0
je 0x180017912
mov edi, 0xce
mov eax, edi
sub eax, 0xce
je 0x180017906
sub eax, 1
je 0x1800178f8
sub eax, 1
je 0x1800178ed
sub eax, 1
je 0x180017906
cmp eax, 1
jne 0x180017906
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x180017906
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_DeleteService]
jmp 0x180017906
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
inc edi
cmp edi, 0xd3
jb 0x1800178c5
xor edx, edx
cmp byte [rsp + 0x75], 0
je case.0x18001773c.25
mov edi, 0xda
mov eax, edi
sub eax, 0xda
je 0x180017940
cmp eax, 1
jne 0x18001795d
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x18001795d
call sub.RPCRT4.dll_MesHandleFree
jmp 0x18001795a
mov rcx, qword [rbp - 0x18]
xor r9d, r9d
mov dword [rsp + 0x28], edx
xor r8d, r8d
mov qword [rsp + 0x20], rdx
xor edx, edx
call sub.RPCRT4.dll_MesIncrementalHandleReset
mov dword [rbp - 0x60], eax
inc edi
mov edx, 0
cmp edi, 0xdc
jb 0x180017922
jmp case.0x18001773c.25
mov eax, 0x2520
mov word [rbp + 0x289], ax
jmp case.0x18001773c.25
mov eax, 0x7265
mov dword [rbp + 0x27e], 0x70706120
mov word [rbp + 0x27c], ax
jmp case.0x18001773c.25
mov r14, rdx
mov qword [rbp - 0x58], rdx
jmp case.0x18001773c.25
lea r9, [rbp - 0x18]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov rcx, qword [rbp + 0x10]
lea r8, [rbp + 0x270]
mov dword [rbp - 0x60], eax
lea rdx, [rbp + 0x240]
xor eax, eax
mov r9d, 0xf01ff
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], reloc.SHELL32.dll_ILFindLastID
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov r14, rax
mov qword [rbp - 0x58], rax
jmp case.0x18001773c.25
mov eax, 0x69
mov word [rbp + 0x279], ax
jmp case.0x18001773c.25
mov eax, 0x72
mov word [rbp + 0x24e], ax
mov eax, 0x73
mov word [rbp + 0x24f], ax
jmp case.0x18001773c.25
mov eax, 0x73
mov word [rbp + 0x244], ax
mov eax, 0x74
mov word [rbp + 0x245], ax
jmp case.0x18001773c.25
mov dword [rbp + 0x271], 0x706374
jmp case.0x18001773c.25
mov eax, 0x3b
mov word [rbp + 0x255], ax
mov eax, 0x27
mov word [rbp + 0x270], ax
inc esi
lea rdi, [0x180000000]
mov edx, 0
lea eax, [rsi + 0x14]
cmp eax, 0x32
jb 0x180017727
jmp 0x180017d13
movzx eax, byte [rsp + 0x70]
mov ecx, r8d
cmp dword [rbp - 0x70], 0
cmovne ecx, eax
mov byte [rsp + 0x70], cl
jmp 0x180017d17
cmp eax, 0xa53f
je 0x180017bdc
cmp eax, 0xb42f
jne 0x180017d1b
mov edi, 0xf4
mov eax, edi
sub eax, 0xf3
je 0x180017d38
cmp eax, 1
jne 0x180017af6
xor edx, edx
lea ecx, [rax + 0x2a]
call fcn.18007fb20
movzx ebx, al
mov byte [rsp + 0x76], al
dec edi
cmp edi, 0xf2
ja 0x180017ad3
mov eax, dword [rsp + 0x78]
mov r9d, dword [rbp - 0x80]
movzx edx, byte [rsp + 0x70]
test dl, dl
je 0x180017d1b
mov r15d, dword [rbp - 0x2c]
mov edi, 0x8b
mov r14d, dword [rbp - 0x40]
mov ebx, dword [rbp - 0x44]
mov r13d, dword [rbp - 0x70]
nop dword [rax]
mov eax, edi
sub eax, 0x87
je 0x180017b9f
sub eax, 1
je 0x180017b92
sub eax, 1
je 0x180017b75
sub eax, 1
je 0x180017b5a
cmp eax, 1
jne 0x180017bbe
mov ebx, 0x810
mov r14d, 0x400
jmp 0x180017bbe
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x240], xmm0
mov qword [rbp + 0x250], rax
mov dword [rbp + 0x258], eax
jmp 0x180017bbe
lea r9, [rbp + 0x240]
mov r8d, r14d
mov r9d, r9d
mov edx, ebx
mov ecx, r13d
call qword [sym.imp.WINMM.dll_mciSendCommandW]
mov r15d, eax
jmp 0x180017bb9
test r15d, r15d
jne 0x180017bbe
xor dl, dl
mov byte [rsp + 0x70], dl
jmp 0x180017bbe
test dl, dl
je 0x180017bbe
mov r8d, 0x104
lea rdx, [rbp + 0x350]
mov ecx, r15d
call qword [sym.imp.WINMM.dll_mciGetErrorStringW]
movzx edx, byte [rsp + 0x70]
dec edi
cmp edi, 0x86
ja 0x180017b30
mov dword [rbp - 0x44], ebx
mov dword [rbp - 0x40], r14d
mov dword [rbp - 0x2c], r15d
jmp 0x180017d00
cmp byte [rsp + 0x7c], 0
je 0x180017d1b
movzx r15d, byte [rsp + 0x72]
mov edi, 0xc3
mov r14d, dword [rbp - 0x20]
mov ebx, dword [rbp - 0x30]
mov r12d, dword [rbp - 0x34]
mov r13d, dword [rbp - 0x38]
cmp edi, 0x227
ja 0x180017c63
je 0x180017c51
mov eax, edi
sub eax, 0xc3
je 0x180017c49
sub eax, 0x59
je 0x180017c40
sub eax, 0x59
je 0x180017c35
cmp eax, 0x59
jne 0x180017cd3
mov r12d, 0x2381f
mov ebx, r8d
jmp 0x180017cd3
mov r13d, 1
jmp 0x180017cd3
mov qword [rbp + 0x18], r8
jmp 0x180017cd3
mov r15b, 1
jmp 0x180017cd3
xor eax, eax
mov dword [rbp - 0x3c], 1
mov qword [rbp + 0x20], rax
mov dword [rbp + 0x28], eax
jmp 0x180017cd3
mov eax, edi
sub eax, 0x280
je 0x180017cad
sub eax, 0x59
je 0x180017c9a
sub eax, 0x59
je 0x180017c8a
cmp eax, 0x59
jne 0x180017cd3
mov rcx, qword [rbp - 0x10]
lea edx, [rax - 0x49]
call qword [sym.imp.WINMM.dll_mmioClose]
jmp 0x180017cd3
test r15b, r15b
je 0x180017cd3
mov ecx, r14d
call qword [sym.imp.SHELL32.dll_SHChangeNotifyDeregister]
jmp 0x180017cd3
movzx eax, r15b
test r14d, r14d
mov ecx, r8d
cmovne ecx, eax
movzx r15d, cl
jmp 0x180017cd3
mov rcx, qword [rbp + 0x18]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
mov r9d, ebx
mov eax, dword [rbp - 0x3c]
mov r8d, r12d
mov edx, r13d
mov dword [rsp + 0x20], eax
call qword [sym.imp.SHELL32.dll_SHChangeNotifyRegister]
mov r14d, eax
add edi, 0x59
mov r8d, 0
cmp edi, 0x3e4
jb 0x180017c01
mov dword [rbp - 0x34], r12d
mov r12d, dword [rbp - 0x78]
mov dword [rbp - 0x38], r13d
mov dword [rbp - 0x30], ebx
mov dword [rbp - 0x20], r14d
mov byte [rsp + 0x72], r15b
movzx r13d, byte [rsp + 0x71]
movzx ebx, byte [rsp + 0x76]
mov r14, qword [rbp - 0x58]
mov r15, qword [rbp - 0x50]
mov r9d, dword [rbp - 0x80]
mov eax, dword [rsp + 0x78]
mov ecx, r9d
shl ecx, 4
add eax, ecx
mov dword [rsp + 0x78], eax
cmp eax, dword [rbp - 0x28]
ja 0x180017d38
xor r8d, r8d
jmp 0x180017240
xor al, al
jmp 0x180017d3b
movzx eax, bl
mov rcx, qword [rbp + 0x560]
xor rcx, rsp
call fcn.180084890
mov rbx, qword [rsp + 0x6b0]
add rsp, 0x670
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret