Function at 0x1800318b0
Capabilities:
Create thread
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x530]
sub rsp, 0x630
mov rax, qword [0x18006e218]
xor rax, rsp
mov qword [rbp + 0x520], rax
mov rdi, r9
mov qword [rbp - 0x78], r9
mov qword [rbp - 0x80], r8
mov dword [rsp + 0x78], edx
mov r15, rcx
mov r14, qword [rbp + 0x590]
movdqa xmm0, xmmword [0x180067550]
movdqa xmmword [rbp + 0x200], xmm0
mov byte [rbp + 0x1f0], 0
movdqa xmm1, xmm0
movdqa xmmword [rbp + 0x220], xmm0
mov byte [rbp + 0x210], 0
movdqa xmmword [rbp + 0x240], xmm0
mov byte [rbp + 0x230], 0
movdqa xmmword [rbp + 0x260], xmm0
mov byte [rbp + 0x250], 0
movdqa xmmword [rbp + 0x290], xmm0
mov byte [rbp + 0x280], 0
movdqa xmmword [rbp + 0x2b0], xmm0
mov byte [rbp + 0x2a0], 0
xor ecx, ecx
mov qword [rbp + 0x70], rcx
mov word [rbp + 0x78], cx
movdqu xmmword [rbp + 0x8a], xmm0
mov byte [rbp + 0x7a], cl
mov qword [rbp + 0x40], rcx
mov word [rbp + 0x48], cx
movdqu xmmword [rbp + 0x5a], xmm0
mov byte [rbp + 0x4a], cl
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rcx
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x10], rcx
mov qword [rbp + 0xa0], rcx
mov qword [rbp + 0xa8], rcx
mov qword [rbp + 0xb0], rcx
mov ecx, 0x30
call fcn.18005b14c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0xa8], rax
xor ecx, ecx
mov qword [rbp + 0xb8], rcx
xorps xmm2, xmm2
movsd qword [rbp + 0xc0], xmm2
mov qword [rbp + 0xc8], rcx
mov dword [rbp + 0xd0], 1
mov qword [rbp + 0xd8], rcx
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xe0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xf0], xmm1
movdqa xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rcx
mov qword [rbp + reloc.SHLWAPI.dll_SHRegGetIntW], 0xffffffffffffffff
mov dword [rbp + 0x120], ecx
xor eax, eax
movups xmmword [rbp + 0x128], xmm0
movups xmmword [rbp + 0x138], xmm0
movups xmmword [rbp + 0x148], xmm0
movups xmmword [rbp + 0x158], xmm0
mov qword [rbp + 0x168], rax
movdqa xmm0, xmmword [0x180067550]
movdqa xmmword [rbp + 0x180], xmm0
mov byte [rbp + 0x170], al
mov word [rbp + 0x190], cx
mov dword [rbp + 0x194], ecx
mov qword [rbp + 0x198], rcx
xorps xmm0, xmm0
movaps xmmword [rbp + 0x1a0], xmm0
movsd qword [rbp + 0x1b0], xmm2
mov byte [rbp + 0x1b8], al
mov qword [rbp + 0x1bc], rcx
mov eax, dword [rsp + 0x78]
mov esi, eax
lea ebx, [rax + 0x7cb]
mov dword [rsp + 0x58], ebx
cmp eax, ebx
mov ebx, dword [rsp + 0x7c]
jae 0x180031b55
mov ecx, 0x2e65
mov edx, 0x6e74
mov r8d, 0x6568
mov r9d, 0x78
mov r10d, 0x6261
mov r11d, 0x7479
mov r13d, dword [rsp + 0x74]
mov r12, qword [rbp - 0x60]
mov eax, dword [rsp + 0x58]
nop word [rax + rax]
cmp esi, 0x1be
ja 0x180031d45
je 0x180031d39
cmp esi, 0xb4
ja 0x180031caa
je 0x180031c8c
mov eax, esi
sub eax, 0x1c
je 0x180031c10
sub eax, 0x13
je 0x180031bfc
cmp eax, 0x72
je 0x180032459
mov eax, dword [rsp + 0x58]
add esi, 0x85
cmp esi, eax
jb 0x180031b00
mov eax, dword [rsp + 0x78]
xor ecx, ecx
lea edi, [rax + 0x560]
mov dword [rsp + 0x68], edi
cmp eax, edi
jae 0x180032459
mov edx, 0x70
lea r8, [0x18000c4f0]
mov r15, qword [rbp - 0x68]
mov r12d, dword [rsp + 0x74]
mov r13d, dword [rsp + 0x74]
mov r14d, dword [rsp + 0x74]
mov esi, 0x1bb
cmp eax, 0x3ca
ja 0x18003264c
je 0x18003226c
cmp eax, 0x272
ja 0x1800320eb
je 0x180032077
sub eax, 0x11a
je 0x180032051
sub eax, 0x56
je 0x180031e62
sub eax, 0x56
je 0x180031e32
cmp eax, 0x56
jne 0x180032738
lea r8d, [rax - 0x55]
lea rdx, [0x180062778]
lea rcx, [rbp + 0x210]
call fcn.18001fe20
xor ecx, ecx
mov qword [rbp - 0x60], rcx
mov word [rbp + 0x270], si
jmp 0x18003272c
mov qword [r14 + 0x3c0], 0
mov r12, qword [r14 + 0x50]
jmp 0x180031b41
mov dword [r15], 0
lea rdi, [0x180060cc0]
nop
mov eax, dword [rdi]
mov dword [rsp + 0x68], eax
mov r9, r14
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x7c]
mov ecx, 0x10e
call fcn.180038a70
mov ebx, eax
test eax, eax
jne 0x180032459
cmp dword [rsp + 0x7c], eax
je 0x180031e24
add rdi, 4
lea rax, [0x1800610c0]
cmp rdi, rax
jl 0x180031c20
mov rdi, qword [rbp - 0x78]
mov ecx, 0x2e65
mov edx, 0x6e74
mov r8d, 0x6568
mov r9d, 0x78
mov r10d, 0x6261
mov r11d, 0x7479
jmp 0x180031b41
mov qword [r14 + 0x50], r15
mov eax, dword [rdi]
mov dword [rsp + 0x68], eax
mov r8, r14
lea rdx, [rsp + 0x68]
mov ecx, 0xc1
call fcn.18004e250
jmp 0x180031c65
mov eax, esi
sub eax, 0x11a
je 0x180031d20
sub eax, 0x1f
je 0x180031cd7
cmp eax, 0x66
jne 0x180031b41
mov dword [rbp + 0x34f], 0x6e742e65
mov byte [rbp + 0x353], 0
jmp 0x180031b41
mov rax, qword [rbp - 0x80]
mov eax, dword [rax]
mov dword [rsp + 0x68], eax
mov r8, r14
lea rdx, [rsp + 0x68]
mov ecx, 0xc1
call fcn.18004e250
mov dword [rsp + 0x68], 0x12
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8, r14
mov edx, 0x11e
xor ecx, ecx
call fcn.18002a7e0
mov r13d, eax
jmp 0x180031c65
mov dword [rbp + 0x348], 0x786568
mov dword [rbp + 0x34b], 0x74796261
jmp 0x180031b41
mov qword [r14 + 0x50], r12
mov ebx, r13d
jmp 0x180031b45
cmp esi, 0x32e
ja 0x180031dbf
je 0x180031d9f
mov eax, esi
sub eax, 0x224
je 0x180031d91
sub eax, 0x1f
je 0x180032459
cmp eax, 0x66
jne 0x180031b41
movzx eax, word [0x1800665cb]
mov word [rbp + 0x332], ax
movzx eax, byte [0x1800665cd]
mov byte [rbp + 0x334], al
mov byte [rbp + 0x335], 0
jmp 0x180031b41
mov word [rbp + 0x330], 0x656e
jmp 0x180031b41
movzx eax, word [0x1800665e4]
mov word [rbp + 0x335], ax
movzx eax, byte [0x1800665e6]
mov byte [rbp + 0x337], al
jmp 0x180031b41
cmp esi, 0x3b3
je 0x180031e15
cmp esi, 0x438
je 0x180031e09
cmp esi, 0x4bd
jne 0x180031b45
mov byte [rbp + 0x33c], 0x6f
movzx eax, word [0x1800665ff]
mov word [rbp + 0x33d], ax
movzx eax, byte [0x180066601]
mov byte [rbp + 0x33f], al
mov byte [rbp + 0x340], 0
jmp 0x180031b41
mov byte [rbp + 0x33c], 0
jmp 0x180031b45
mov dword [rbp + 0x338], 0x72746e6f
jmp 0x180031b45
mov dword [r15], 1
xor ebx, ebx
jmp 0x180032459
lea rax, [rbp + 0x348]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180031e40
lea rdx, [rbp + 0x348]
lea rcx, [rbp + 0x1f0]
call fcn.18001fe20
jmp 0x18003272a
mov byte [rbp + 0x345], 0
lea r8, [0x18006e128]
mov edx, 0x39
xor ecx, ecx
call fcn.18000f850
test al, al
jne 0x18003203e
xor edx, edx
mov esi, edx
nop dword [rax + rax]
cmp esi, 7
ja case.default.0x180031ead
mov eax, esi
lea r8, [0x180000000]
mov ecx, dword [r8 + rax*4 + 0x32960]
add rcx, r8
jmp rcx
mov word [rbp + 0x390], dx
mov r8d, 1
lea rdx, [0x180066654]
lea rcx, [rbp + 0x368]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov byte [rsp + 0x60], 1
jmp 0x180032025
mov word [rbp + 0x368], dx
mov r8d, 3
lea rdx, [0x18006666a]
lea rcx, [rbp + 0x368]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
movsd xmm0, qword [0x1800666cc]
movsd qword [rbp + 0x36e], xmm0
movzx eax, word [0x1800666d4]
mov word [rbp + 0x376], ax
jmp 0x180032025
mov eax, 0x70
mov word [rbp + 0x38e], ax
jmp case.default.0x180031ead
mov eax, dword [0x180066720]
mov dword [rbp + 0x37e], eax
movzx eax, word [0x180066724]
mov word [rbp + 0x382], ax
mov word [rbp + 0x384], dx
mov r8d, 5
lea rdx, [0x18006679e]
lea rcx, [rbp + 0x368]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x180032025
mov r15, 0xffffffffffffffff
mov qword [rbp - 0x68], r15
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.dbghelp.dll_SymInitialize]
xor edx, edx
test eax, eax
jne case.default.0x180031ead
mov byte [rsp + 0x60], al
jmp case.default.0x180031ead
mov eax, dword [0x180066800]
mov dword [rbp + 0x378], eax
movzx eax, word [0x180066804]
mov word [rbp + 0x37c], ax
jmp case.default.0x180031ead
cmp byte [rsp + 0x60], 0
je 0x180032018
mov edi, 0x9a
mov eax, edi
sub eax, 0x98
je 0x180032005
sub eax, 1
je 0x180031ff3
cmp eax, 1
jne 0x18003200e
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
movups xmmword [rbp + 0x1e0], xmm0
mov dword [rbp + 0x1d0], 0x20
jmp 0x18003200e
lea rdx, [rbp + 0x1d0]
mov rcx, r15
call qword [sym.imp.dbghelp.dll_SymGetSymPrev64]
jmp 0x18003200e
mov rcx, r15
call qword [sym.imp.dbghelp.dll_SymCleanup]
dec edi
cmp edi, 0x97
ja 0x180031fc3
lea rcx, [rbp + 0x368]
call qword [sym.imp.SHLWAPI.dll_SHStripMneumonicW]
xor edx, edx
inc esi
lea eax, [rsi + 0xd1]
cmp eax, 0xd9
jb 0x180031e90
mov edi, dword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
jmp 0x18003272a
mov r8d, 4
lea rdx, [0x180066868]
lea rcx, [rbp + 0x340]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x344], 0x65
jmp 0x18003272a
xor r8d, r8d
mov edx, 0xd9
lea rcx, [rbp + 0x230]
call fcn.1800184a0
mov r9d, 0x64
lea r8, [rbp + 0x1f0]
xor edx, edx
lea rcx, [rbp + 0x280]
call fcn.18000f390
mov word [rsp + 0x58], si
lea rax, [rbp + 0x70]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
lea rax, [0x18006e188]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10e
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x58]
xor ecx, ecx
call fcn.180023b30
jmp 0x18003272a
sub eax, 0x2c8
je 0x180032230
sub eax, 0x56
je 0x18003219f
cmp eax, 0x56
jne 0x180032738
lea rax, [rbp + 0x40]
mov qword [rsp + 0x58], rax
mov rdx, qword [rbp - 0x48]
cmp rdx, qword [rbp - 0x40]
je 0x180032129
lea rax, [rbp + 0x40]
mov qword [rdx], rax
add qword [rbp - 0x48], 8
jmp 0x180032137
lea r8, [rsp + 0x58]
lea rcx, [rbp - 0x50]
call fcn.1800031f0
mov eax, dword [0x18006e1d0]
mov dword [rsp + 0x58], eax
xor ecx, ecx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x50]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0x3c]
call fcn.1800113f0
lea rax, [rbp - 0x50]
mov qword [rbp + 0x20], rax
mov eax, dword [0x18006e1d0]
mov dword [rbp + 0x28], eax
mov eax, dword [0x18006e1d4]
mov dword [rbp + 0x2c], eax
movaps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x30], xmm0
jmp 0x18003272a
mov r9d, 0x10e
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x50]
call fcn.180015080
lea rax, [rbp + 0x70]
mov qword [rsp + 0x58], rax
mov rdx, qword [rbp - 0x48]
cmp rdx, qword [rbp - 0x40]
je 0x1800321d4
lea rax, [rbp + 0x70]
mov qword [rdx], rax
add qword [rbp - 0x48], 8
jmp 0x1800321e2
lea r8, [rsp + 0x58]
lea rcx, [rbp - 0x50]
call fcn.1800031f0
xorps xmm0, xmm0
movups xmmword [rbp + 0x2c0], xmm0
movups xmmword [rbp + 0x2d0], xmm0
movups xmmword [rbp + 0x2e0], xmm0
movups xmmword [rbp + 0x2f0], xmm0
movups xmmword [rbp + 0x300], xmm0
movups xmmword [rbp + 0x310], xmm0
movups xmmword [rbp + 0x320], xmm0
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_AddAtomA]
mov word [rsp + 0x70], ax
jmp 0x18003272a
movzx eax, byte [rbp + rcx + 0x330]
mov byte [rbp + rcx + 0x3a0], al
lea rcx, [rcx + 1]
test al, al
jne 0x180032230
mov word [rsp + 0x58], si
lea r9, [rbp + 0x40]
mov r8d, 0x50
lea rdx, [rsp + 0x58]
lea rcx, [0x18006e1a8]
call fcn.18003c430
jmp 0x18003272a
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ecx
lea r9, [rbp + 0x30]
lea r8, [0x180017980]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x78], rax
cmp rax, 0
jne 0x18003272a
mov esi, 0x87
nop dword [rax]
cmp esi, 0xae8d
ja 0x180032418
je 0x180032402
cmp esi, 0x87
je 0x1800323dc
cmp esi, 0x2355
je 0x18003238b
cmp esi, 0x4623
je 0x18003237f
cmp esi, 0x68f1
je 0x18003233e
cmp esi, 0x8bbf
jne 0x180032321
mov r8d, 5
lea rdx, [0x1800668cc]
lea rcx, [rbp + 0x358]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 1
lea rdx, [0x1800668e6]
lea rcx, [rbp + 0x358]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov byte [rbp + 0x362], 0x30
xor ecx, ecx
add esi, 0x22ce
cmp esi, 0x17eda
jbe 0x1800322a0
mov edi, dword [rsp + 0x68]
jmp 0x18003272c
movsd xmm0, qword [str.m2m]
movsd qword [rbp + 0x388], xmm0
movups xmm0, xmmword [str._db.txt]
movups xmmword [rbp + 0x390], xmm0
mov r8d, 4
lea rdx, [0x1800668b2]
lea rcx, [rbp + 0x358]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x35c], 0
jmp 0x180032321
mov dword [rbp + 0x386], 0x3a
jmp 0x180032321
mov r8d, 1
lea rdx, [0x1800643a8]
lea rcx, [rbp + 0x368]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
movsd xmm0, qword [str.e_serv]
movsd qword [rbp + 0x374], xmm0
mov eax, dword [0x180066878]
mov dword [rbp + 0x37c], eax
mov eax, dword [0x180063978]
mov dword [rbp + 0x380], eax
mov dword [rbp + 0x384], 0x5f
jmp 0x180032321
xor eax, eax
mov word [rbp + 0x368], ax
lea r8d, [rax + 5]
lea rdx, str.skyla
lea rcx, [rbp + 0x368]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x180032321
mov byte [rbp + 0x363], 0
mov byte [rsp + 0x50], 1
mov byte [rsp + 0x51], 1
jmp 0x180032321
cmp esi, 0xd15b
je 0x18003261e
cmp esi, 0xf429
je 0x180032601
cmp esi, 0x116f7
je 0x1800325c4
cmp esi, 0x139c5
je 0x1800324d7
cmp esi, 0x15c93
jne 0x180032321
mov ebx, 1
lea rcx, [rbp + reloc.SHLWAPI.dll_SHRegGetIntW]
call fcn.1800052c0
mov rdi, qword [rbp + 0x100]
test rdi, rdi
je 0x18003276f
mov rsi, qword [rbp + 0x108]
cmp rdi, rsi
je 0x180032499
mov rcx, rdi
call fcn.18001f8d0
add rdi, 0x20
cmp rdi, rsi
jne 0x180032481
mov rdi, qword [rbp + 0x100]
mov rdx, qword [rbp + 0x110]
sub rdx, rdi
and rdx, 0xffffffffffffffe0
mov rax, rdi
cmp rdx, 0x1000
jb 0x180032750
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032750
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
xor r8d, r8d
mov ecx, r8d
movzx eax, byte [rsp + 0x51]
test r12d, r12d
cmove ecx, eax
movzx edx, cl
mov byte [rsp + 0x51], cl
mov ecx, r8d
movzx eax, byte [rsp + 0x50]
test r13d, r13d
cmove ecx, eax
mov byte [rsp + 0x50], cl
cmp cl, r8b
je 0x18003255a
mov edi, 0x1c
xor r15d, r15d
nop
mov eax, edi
sub eax, 0x1c
je 0x180032522
cmp eax, 1
jne 0x18003254a
mov rcx, qword [rbp]
jmp 0x180032540
mov qword [rbp], r15
lea r8, [rbp]
mov edx, r14d
lea rcx, [rbp + 0x358]
call sub.RPCRT4.dll_MesDecodeBufferHandleCreate
mov r13d, eax
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x18003254a
call sub.RPCRT4.dll_MesHandleFree
inc edi
cmp edi, 0x1e
jb 0x180032510
mov r15, qword [rbp - 0x68]
movzx edx, byte [rsp + 0x51]
test dl, dl
je 0x180032321
mov edi, 0x30
xor r15d, r15d
nop word [rax + rax]
cmp edi, 0x30
je 0x1800325af
cmp edi, 0x48
je 0x18003259d
cmp edi, 0x60
jne 0x1800325b3
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x18003258d
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x1800325b3
call sub.RPCRT4.dll_MesHandleFree
jmp 0x1800325b3
lea r8, [rbp + 8]
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
mov r12d, eax
jmp 0x1800325b3
mov qword [rbp + 8], r15
add edi, 0x18
cmp edi, 0x78
jb 0x180032570
mov r15, qword [rbp - 0x68]
jmp 0x180032321
xor eax, eax
mov qword [rbp + 0x10], rax
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x70]
mov edx, r14d
lea rcx, [rbp + 0x358]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov r13d, eax
mov r8d, dword [rbp - 0x6c]
lea rdx, [rbp + 0x4b0]
lea rcx, [rbp + 0x368]
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
jmp 0x180032321
xor eax, eax
mov dword [rbp - 0x70], eax
lea r9, [rbp - 0x80]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov r12d, eax
jmp 0x180032321
lea rax, [rbp + 0x358]
mov r14, 0xffffffffffffffff
nop dword [rax]
inc r14
cmp byte [rax + r14], 0
jne 0x180032630
mov dword [rbp - 0x6c], 0x32
xor ecx, ecx
mov qword [rbp - 0x80], rcx
jmp 0x180032323
cmp eax, 0x522
ja 0x1800326ee
je 0x1800326b2
sub eax, 0x420
je 0x1800326a6
sub eax, 0x56
je 0x180032685
cmp eax, 0x56
jne 0x180032738
mov qword [rsp + 0x58], r8
lea rdx, [rsp + 0x58]
lea ecx, [rax + 0x4f]
call fcn.1800472a0
jmp 0x18003272a
mov dword [rsp + 0x74], edx
mov r8d, 0x104
lea rdx, [rbp + 0x3a0]
movzx ecx, word [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetAtomNameA]
jmp 0x18003272a
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18003272a
lea r9, [0x18006e120]
lea r8, [rbp - 0x50]
lea rdx, [rbp + 0xa0]
mov ecx, 0x104
call fcn.180009800
xor eax, eax
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x136
lea rcx, [rbp + 0xa0]
call fcn.18000e1f0
jmp 0x18003272a
sub eax, 0x578
je 0x180032709
sub eax, 0x56
je 0x180032705
cmp eax, 0x56
je 0x180032459
jmp 0x180032738
mov ebx, ecx
jmp 0x180032738
mov r8d, dword [rsp + 0x74]
lea rdx, [rbp + 0x2c0]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.WINMM.dll_midiInAddBuffer]
movzx ecx, word [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
xor ecx, ecx
mov edx, 0x70
lea r8, [0x18000c4f0]
mov eax, dword [rsp + 0x78]
add eax, 0x56
mov dword [rsp + 0x78], eax
cmp eax, edi
jae 0x180032459
jmp 0x180031b86
mov rcx, rdi
call fcn.18005b188
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x100], xmm0
xor r14d, r14d
mov qword [rbp + 0x110], r14
jmp 0x180032772
xor r14d, r14d
mov rdx, qword [rbp + 0xe8]
test rdx, rdx
je 0x1800327aa
mov r8, qword [rbp + 0xf8]
sub r8, rdx
sar r8, 4
lea rcx, [rbp + 0xe8]
call fcn.1800214e0
mov qword [rbp + 0xe8], r14
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xf0], xmm0
lea rcx, [rbp + 0xa8]
call fcn.1800051f0
nop
mov rdi, qword [rbp - 0x38]
test rdi, rdi
je 0x18003284b
mov rsi, qword [rbp - 0x30]
cmp rdi, rsi
je 0x1800327e5
nop dword [rax]
mov rcx, rdi
call fcn.180004ab0
add rdi, 0x28
cmp rdi, rsi
jne 0x1800327d0
mov rdi, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x28]
sub rcx, rdi
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rax, rdi
cmp rdx, 0x1000
jb 0x180032837
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032837
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.18005b188
mov qword [rbp - 0x38], r14
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
mov rdx, qword [rbp - 0x50]
test rdx, rdx
je 0x180032874
mov r8, qword [rbp - 0x40]
sub r8, rdx
sar r8, 3
lea rcx, [rbp - 0x50]
call fcn.180021490
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r14
mov rdx, qword [rbp + 0x62]
cmp rdx, 0x10
jb 0x1800328b2
inc rdx
mov rcx, qword [rbp + 0x4a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800328ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800328ad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18005b188
movdqa xmm0, xmmword [0x180067550]
movdqu xmmword [rbp + 0x5a], xmm0
mov byte [rbp + 0x4a], 0
mov rdx, qword [rbp + 0x92]
cmp rdx, 0x10
jb 0x180032904
inc rdx
mov rcx, qword [rbp + 0x7a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800328ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800328ff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18005b188
movdqa xmm0, xmmword [0x180067550]
movdqu xmmword [rbp + 0x8a], xmm0
mov byte [rbp + 0x7a], 0
lea rcx, [rbp + 0x280]
call fcn.180004e10
nop
lea rcx, [rbp + 0x1f0]
call fcn.180004ec0
mov eax, ebx
mov rcx, qword [rbp + 0x520]
xor rcx, rsp
call fcn.18005b930
mov rbx, qword [rsp + 0x678]
add rsp, 0x630
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret