Function at 0x18000a540
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x368]
sub rsp, 0x430
movaps xmmword [rax - 0x48], xmm6
mov rsi, r9
mov rdi, r8
mov r12d, edx
mov rdx, rcx
mov ebx, r12d
imul r14d, r12d, 0xa56
xor r8d, r8d
lea eax, [r8 + 0x61]
cmp r12d, r14d
ja 0x18000a8eb
movabs r15, 0x6500620069006c
movss xmm6, dword [rbp + 0x378]
cmp ebx, 0x164cb
ja 0x18000a788
je 0x18000a76b
cmp ebx, 0x9178
ja 0x18000a6f1
je 0x18000a6af
mov eax, ebx
sub eax, 0xc4
je 0x18000a634
sub eax, 0x11
je 0x18000a628
cmp eax, 0x1c
jne 0x18000a844
lea r9, [rbp + 0x88]
mov r8, rdx
mov rdx, rsi
mov ecx, 0x9e
call fcn.180037ca0
mov r8, rsi
mov rdx, qword [rbp + 0x370]
mov ecx, 0xfe
call fcn.180008440
mov dword [rsp + 0x40], eax
movss xmm0, dword [rbp + 0x88]
movss dword [rdi], xmm0
mov rdx, qword [rbp + 0x370]
xor r8d, r8d
jmp 0x18000a844
mov dword [rbp - 0x38], 0x6d
jmp 0x18000a844
movss xmm3, dword [rdx + 8]
cvtps2pd xmm3, xmm3
movss xmm2, dword [rdx + 4]
cvtps2pd xmm2, xmm2
movss xmm1, dword [rdx]
cvtps2pd xmm1, xmm1
movq r9, xmm3
movq r8, xmm2
movq rdx, xmm1
lea rcx, str.428_429_431_GHE
call fcn.18003ac00
mov rax, qword [rbp + 0x370]
movss xmm3, dword [rax + 0x14]
cvtps2pd xmm3, xmm3
movss xmm2, dword [rax + 0x10]
cvtps2pd xmm2, xmm2
movss xmm1, dword [rax + 0xc]
cvtps2pd xmm1, xmm1
movq r9, xmm3
movq r8, xmm2
movq rdx, xmm1
lea rcx, str.TextEmbeddedObject
call fcn.18003ac00
mov rdx, qword [rbp + 0x370]
xor r8d, r8d
jmp 0x18000a844
movss xmm3, dword [rdx + 0x20]
cvtps2pd xmm3, xmm3
movss xmm2, dword [rdx + 0x1c]
cvtps2pd xmm2, xmm2
movss xmm1, dword [rdx + 0x18]
cvtps2pd xmm1, xmm1
movq r9, xmm3
movq r8, xmm2
movq rdx, xmm1
lea rcx, str.DxDriverMiscEvents
call fcn.18003ac00
mov rdx, qword [rbp + 0x370]
xor r8d, r8d
jmp 0x18000a844
cmp ebx, 0x9e16
je 0x18000a75a
cmp ebx, 0xb2de
je 0x18000a748
cmp ebx, 0x13b57
jne 0x18000a844
mov r8d, 1
lea rdx, [0x180052db6]
lea rcx, [rbp - 0x38]
call fcn.18003f900
mov r8d, 3
lea rdx, [0x180052de6]
lea rcx, [rbp - 0x30]
call fcn.18003f948
mov rdx, qword [rbp + 0x370]
xor r8d, r8d
jmp 0x18000a844
movss xmm0, dword [rbp + 0x8c]
movss dword [rdi + 4], xmm0
jmp 0x18000a844
mov dword [rbp - 0x36], 0x760073
mov word [rbp - 0x32], r8w
jmp 0x18000a844
movss xmm0, dword [rbp + 0x90]
movss dword [rdi + 8], xmm0
movss xmm1, dword [rsp + 0x40]
movss dword [rdi + 0xc], xmm1
jmp 0x18000a844
cmp ebx, 0x2c8a5
ja 0x18000a824
je 0x18000a808
cmp ebx, 0x1d898
je 0x18000a81d
cmp ebx, 0x216b8
je 0x18000a7d4
cmp ebx, 0x275d9
jne 0x18000a844
mov r8d, 1
lea rdx, [0x180052d08]
lea rcx, [rbp - 0x38]
call fcn.18003f900
mov rdx, qword [rbp + 0x370]
xor r8d, r8d
jmp 0x18000a844
xor r9d, r9d
mov r8, rdi
xor edx, edx
mov ecx, 0x8e
call fcn.180024830
mov qword [rbp - 0x80], rax
movss xmm6, dword [rbp - 0x80]
movaps xmm0, xmm6
addss xmm0, dword [rdi + 0xc]
movss dword [rdi + 0xc], xmm0
mov rdx, qword [rbp + 0x370]
xor r8d, r8d
jmp 0x18000a844
mov eax, 0x2a
nop dword [rax]
cmp eax, 0x2a
je 0x18000a860
add eax, 0x1f
cmp eax, 0x49
jb 0x18000a810
mov word [rbp - 0x2a], r8w
jmp 0x18000a844
cmp ebx, 0x3131a
je 0x18000a83d
cmp ebx, 0x3b05b
jne 0x18000a844
mov word [rbp + 0xc0], ax
jmp 0x18000a844
mov qword [rbp + 0xb8], r15
imul eax, r12d, 0xbd
add ebx, eax
cmp ebx, r14d
ja 0x18000a8eb
mov eax, 0x61
jmp 0x18000a5a3
xorps xmm0, xmm0
movss dword [rsp + 0x40], xmm0
movss dword [rbp + 0x378], xmm6
lea r8, [rbp + 0x378]
lea rdx, [rsp + 0x40]
mov ecx, 5
call fcn.18000c380
test ax, ax
jne 0x18000a8e3
mov ecx, 0x11
mov eax, ecx
sub eax, 0xf
je 0x18000a8ce
sub eax, 1
je 0x18000a8b0
cmp eax, 1
jne 0x18000a8dc
movss xmm0, dword [rdi]
divss xmm0, xmm6
movss dword [rdi], xmm0
jmp 0x18000a8dc
movss xmm0, dword [rdi + 4]
divss xmm0, xmm6
movss dword [rdi + 4], xmm0
movss xmm1, dword [rdi + 8]
divss xmm1, xmm6
movss dword [rdi + 8], xmm1
jmp 0x18000a8dc
movss xmm0, dword [rdi + 0xc]
divss xmm0, xmm6
movss dword [rdi + 0xc], xmm0
dec ecx
cmp ecx, 0xe
ja 0x18000a891
mov rax, rdi
jmp 0x18000ab2a
mov eax, r12d
mov dword [rsp + 0x40], eax
imul edi, r12d, 0x2d
mov dword [rsp + 0x7c], edi
cmp r12d, edi
ja 0x18000ab26
movabs rbx, 0x65006c00730073
mov r14d, 0x32
lea r9d, [r14 + 0x33]
lea r11, [0x180000000]
movabs r10, 0x7ffffffffffffffe
mov r15, qword [rbp - 0x58]
mov r13d, dword [rsp + 0x48]
cmp eax, 0x124e
ja 0x18000aa44
je 0x18000aa21
cmp eax, 0x852
ja 0x18000a9d2
je 0x18000a9c6
cmp eax, 0xd5
je 0x18000a9a8
cmp eax, 0x354
je 0x18000a99a
cmp eax, 0x5d3
jne 0x18000b3f4
mov r8d, 2
lea rdx, [0x180052e46]
lea rcx, [rbp + 0x60]
call fcn.18003f900
mov r9d, 0x65
movabs r10, 0x7ffffffffffffffe
lea r11, [0x180000000]
jmp 0x18000b3f1
mov qword [rbp + 0x60], rbx
mov word [rbp + 0x68], r8w
jmp 0x18000b3f4
mov word [rbp + 0xc2], r8w
mov r8d, 3
lea rdx, [0x180052e06]
lea rcx, [rbp + 0xb8]
jmp 0x18000a979
mov dword [rbp + 0x6c], 0x320033
jmp 0x18000b3f4
cmp eax, 0xad1
je 0x18000a9ff
cmp eax, 0xd50
je 0x18000a9f5
cmp eax, 0xfcf
jne 0x18000b3f4
mov byte [rsp + 0x30], 1
jmp 0x18000b3f4
mov byte [rsp + 0x31], 1
jmp 0x18000b3f4
mov word [rbp + 0x70], r8w
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rbp + 0xd0], xmm0
movsd xmm1, qword [rbp - 0x10]
movsd qword [rbp + 0xe0], xmm1
jmp 0x18000b3f4
movups xmm0, xmmword [str.MAAP_MVBAND6_COMP_ONOFF]
movups xmmword [rbp + 0xf0], xmm0
movsd xmm1, qword [0x180052e98]
movsd qword [rbp + 0x100], xmm1
jmp 0x18000b3f4
cmp eax, 0x1c4a
ja 0x18000ab05
je 0x18000aab1
cmp eax, 0x14cd
je 0x18000aa9a
cmp eax, 0x174c
je 0x18000aa73
cmp eax, 0x19cb
jne 0x18000b3f4
mov dword [rbp - 0x40], r8d
jmp 0x18000b3f4
lea rax, [rbp + 0xb8]
mov qword [rbp + 0xd8], rax
call qword [sym.imp.WINMM.dll_midiOutGetNumDevs]
mov dword [rbp - 0x78], eax
lea rax, [rbp + 0x60]
mov qword [rbp + 0xe0], rax
jmp 0x18000a97e
lea rax, [rbp - 0x38]
mov qword [rbp + 0xd0], rax
mov dword [rbp], 0xf003f
jmp 0x18000b3f4
mov eax, dword [rbp - 0x40]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x80]
xor r8d, r8d
mov edx, dword [rbp]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.SHLWAPI.dll_SHRegOpenUSKeyA]
mov dword [rbp - 0x74], eax
xor r8d, r8d
mov edx, r8d
movzx ecx, byte [rsp + 0x30]
cmp dword [rbp - 0x78], r8d
cmovne edx, ecx
mov byte [rsp + 0x30], dl
lea r9d, [r8 + 0x65]
movabs r10, 0x7ffffffffffffffe
lea r11, [0x180000000]
jmp 0x18000b3f4
cmp eax, 0x1ec9
je 0x18000adf7
cmp eax, 0x2148
je 0x18000ab4d
cmp eax, 0x23c7
jne 0x18000b3f4
mov byte [rbp - 0x48], 1
mov rax, qword [rbp - 0x48]
mov rbx, qword [rsp + 0x480]
movaps xmm6, xmmword [rsp + 0x420]
add rsp, 0x430
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, r8d
movzx eax, byte [rsp + 0x31]
cmp dword [rbp - 0x74], 0
cmove ecx, eax
mov byte [rsp + 0x31], cl
movzx r14d, byte [rsp + 0x30]
test r14b, r14b
je 0x18000ad44
mov edi, 0x19
mov dword [rsp + 0x34], edi
lea r12d, [rdi + 0x3b]
lea r15d, [rdi + 0x53]
cmp edi, 0x19
je 0x18000acf8
cmp edi, 0xf0a
jne 0x18000ad0b
mov ecx, r8d
movzx eax, r14b
mov esi, dword [rbp - 0x6c]
test esi, esi
cmovne ecx, eax
movzx r14d, cl
mov byte [rsp + 0x30], cl
test cl, cl
je 0x18000ad0b
mov ebx, 0xb1
lea edi, [rbx - 0x68]
nop dword [rax]
cmp ebx, 0x3e5
ja 0x18000ac60
je 0x18000ac54
cmp ebx, 0xb1
je 0x18000ac3a
cmp ebx, 0x155
je 0x18000ac30
cmp ebx, 0x1f9
je 0x18000ac1f
cmp ebx, 0x29d
je 0x18000ac0a
cmp ebx, 0x341
jne 0x18000ace0
mov dword [rbp + 0x2a], 0x3a0031
jmp 0x18000ace0
mov eax, 0x61
mov word [rbp + 0x24], ax
mov dword [rbp + 0x26], 0x310064
jmp 0x18000ace0
mov dword [rbp + 0x1e], 0x720068
mov word [rbp + 0x22], r9w
jmp 0x18000ace0
mov word [rbp + 0x1c], r12w
jmp 0x18000ace0
mov dword [rbp + 0x10], 0x61004a
mov dword [rbp + 0x14], 0x610076
mov dword [rbp + 0x18], 0x5c003a
jmp 0x18000ace0
mov dword [rbp + 0x2e], 0x64003a
jmp 0x18000ace0
cmp ebx, 0x489
je 0x18000acdb
cmp ebx, 0x52d
je 0x18000acd4
cmp ebx, 0x5d1
je 0x18000acbe
cmp ebx, 0x675
je 0x18000acb0
cmp ebx, 0x7bd
jne 0x18000ace0
lea rcx, [rbp + 0x10]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
mov r8d, 0x104
lea rdx, [rbp + 0x110]
mov ecx, esi
call qword [sym.imp.WINMM.dll_midiOutGetErrorTextW]
xor r8d, r8d
lea r9d, [r8 + 0x65]
jmp 0x18000ace0
mov dword [rbp + 0x3e], 0x290028
mov word [rbp + 0x42], r8w
jmp 0x18000ace0
mov word [rbp + 0x36], di
mov dword [rbp + 0x38], 0x73006e
mov eax, 0x70
mov word [rbp + 0x3c], ax
jmp 0x18000ace0
mov word [rbp + 0x34], r15w
jmp 0x18000ace0
mov word [rbp + 0x32], r9w
add ebx, 0xa4
cmp ebx, 0x861
jb 0x18000abc0
mov edi, dword [rsp + 0x34]
jmp 0x18000ad0b
mov dword [rbp - 0x70], r8d
lea rdx, [rbp - 0x70]
xor ecx, ecx
call qword [sym.imp.WINMM.dll_midiOutGetID]
mov dword [rbp - 0x6c], eax
add edi, 0xef1
mov dword [rsp + 0x34], edi
cmp edi, 0x1de2
mov r8d, 0
lea r9d, [r8 + 0x65]
jbe 0x18000ab80
mov r13d, dword [rsp + 0x48]
mov r15, qword [rbp - 0x58]
mov r12d, dword [rbp + 0x378]
movzx ecx, byte [rsp + 0x31]
mov edi, dword [rsp + 0x7c]
test cl, cl
je 0x18000addb
mov ebx, 0xa7
mov r15d, dword [rbp - 0x60]
mov r13d, dword [rbp - 0x64]
nop dword [rax]
cmp ebx, 0xa7
je 0x18000adaf
cmp ebx, 0xe5a
je 0x18000ada7
cmp ebx, 0x1c0d
jne 0x18000adb6
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, dword [rbp - 0x68]
xor edx, edx
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.SHLWAPI.dll_SHRegWriteUSValueA]
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.SHLWAPI.dll_SHRegCloseUSKey]
jmp 0x18000adb6
mov r15d, 1
jmp 0x18000adb6
mov dword [rbp - 0x68], r8d
mov r13d, r8d
add ebx, 0xdb3
cmp ebx, 0x2919
mov r8d, 0
jbe 0x18000ad60
mov dword [rbp - 0x64], r13d
mov dword [rbp - 0x60], r15d
mov r13d, dword [rsp + 0x48]
mov r15, qword [rbp - 0x58]
mov r9d, 0x65
movabs r10, 0x7ffffffffffffffe
lea r11, [0x180000000]
jmp 0x18000b3e1
xor r14d, r14d
mov dword [rsp + 0x78], r14d
lea rsi, [rbp + 0xd0]
mov qword [rbp - 0x50], rsi
nop word [rax + rax]
mov qword [rsp + 0x60], r14
mov r12d, 7
mov qword [rsp + 0x68], r12
mov word [rsp + 0x50], r14w
mov edi, 0x63
mov dword [rsp + 0x34], edi
mov ebx, r14d
mov dword [rsp + 0x38], ebx
cmp ebx, 9
ja case.default.0x18000ae4c
mov eax, ebx
mov ecx, dword [r11 + rax*4 + 0xb47c]
add rcx, r11
jmp rcx
mov dword [rbp - 0x14], 0x73005f
mov dword [rbp - 0x10], 0x610074
jmp case.default.0x18000ae4c
mov dword [rsp + 0x70], r14d
mov rsi, qword [rsp + 0x60]
cmp rsi, r12
jae 0x18000ae94
lea rax, [rsi + 1]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
cmp r12, 8
cmovae rax, qword [rsp + 0x50]
mov dword [rax + rsi*2], 0x2e
jmp 0x18000af73
mov rax, r10
sub rax, rsi
cmp rax, 1
jb 0x18000b46a
lea r14, [rsi + 1]
mov rbx, r14
or rbx, 7
cmp rbx, r10
jbe 0x18000aeb9
mov rbx, r10
jmp 0x18000aeda
mov rcx, r12
shr rcx, 1
mov rax, r10
sub rax, rcx
cmp r12, rax
jbe 0x18000aecf
mov rbx, r10
jmp 0x18000aeda
lea rax, [rcx + r12]
cmp rbx, rax
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x50]
call fcn.180016dc0
mov rdi, rax
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], rbx
add rsi, rsi
mov r8, rsi
mov rcx, rax
cmp r12, 8
jb 0x18000af52
mov rbx, qword [rsp + 0x50]
mov rdx, rbx
call fcn.18003c580
mov dword [rsi + rdi], 0x2e
xor r14d, r14d
lea rdx, [r12*2 + 2]
cmp rdx, 0x1000
jb 0x18000af48
add rdx, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x18000b476
mov rbx, rcx
mov rcx, rbx
call fcn.18003ae74
jmp 0x18000af66
lea rdx, [rsp + 0x50]
call fcn.18003c580
mov dword [rsi + rdi], 0x2e
xor r14d, r14d
mov qword [rsp + 0x50], rdi
mov edi, dword [rsp + 0x34]
mov ebx, dword [rsp + 0x38]
lea rdx, [rsp + 0x70]
mov rcx, r15
call qword [sym.imp.WINMM.dll_midiInGetID]
mov dword [rsp + 0x74], eax
mov rsi, qword [rbp - 0x50]
jmp 0x18000b328
mov rdi, qword [rdx + 0x10]
mov rbx, rdx
cmp qword [rdx + 0x18], 8
jb 0x18000af9f
mov rbx, qword [rdx]
cmp rdi, 8
jae 0x18000afbe
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x98], xmm0
mov r14d, 7
mov r15, qword [rbp + 0x98]
jmp 0x18000b008
mov r14, rdi
or r14, 7
cmp r14, r10
cmova r14, r10
lea rdx, [r14 + 1]
lea rcx, [rbp + 0x98]
call fcn.180016dc0
mov r15, rax
mov qword [rbp + 0x98], rax
lea r8, [rdi*2 + 2]
mov rdx, rbx
mov rcx, rax
call fcn.18003c580
mov r12, qword [rsp + 0x68]
movabs r10, 0x7ffffffffffffffe
mov qword [rbp + 0xb0], r14
mov qword [rbp + 0xa8], rdi
lea rsi, [rbp + 0x98]
cmp r14, 8
cmovae rsi, r15
cmp rdi, 8
jae 0x18000b038
movups xmm6, xmmword [rsi]
mov qword [rbp + 0x28], 7
jmp 0x18000b077
mov rbx, rdi
or rbx, 7
cmp rbx, r10
cmova rbx, r10
lea rdx, [rbx + 1]
lea rcx, [rbp + 0x10]
call fcn.180016dc0
mov qword [rbp + 0x10], rax
lea r8, [rdi*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.18003c580
mov qword [rbp + 0x28], rbx
mov r12, qword [rsp + 0x68]
movups xmm6, xmmword [rbp + 0x10]
mov qword [rbp + 0x20], rdi
cmp r12, 8
jb 0x18000b0b8
lea rdx, [r12*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b0b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b470
call fcn.18003ae74
movups xmmword [rsp + 0x50], xmm6
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [rsp + 0x60], xmm0
cmp r14, 8
jb 0x18000b101
lea rdx, [r14*2 + 2]
mov rax, r15
cmp rdx, 0x1000
jb 0x18000b0f9
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b476
mov rcx, r15
call fcn.18003ae74
xor r14d, r14d
mov r15d, r14d
mov qword [rbp - 0x58], r14
mov rsi, qword [rbp - 0x50]
mov rdx, qword [rsi]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], r14w
jne 0x18000b120
lea rcx, [rsp + 0x50]
call fcn.180016ec0
jmp 0x18000b320
mov r8d, 3
lea rdx, [0x180052e18]
lea rcx, [rsp + 0x50]
call fcn.180016ec0
jmp 0x18000b328
mov dword [rbp - 8], 0x5f
mov byte [rsp + 0x32], 1
jmp case.default.0x18000ae4c
mov dword [rbp - 0xc], 0x650074
jmp case.default.0x18000ae4c
mov ecx, 0x69
mov word [rbp - 0x16], cx
jmp case.default.0x18000ae4c
mov dword [rbp - 0x20], 0x720062
mov ecx, 0x6f
mov word [rbp - 0x1c], cx
mov dword [rbp - 0x1a], 0x6c0074
jmp case.default.0x18000ae4c
mov ecx, r14d
movzx eax, byte [rsp + 0x32]
cmp dword [rsp + 0x74], 0
cmove ecx, eax
mov byte [rsp + 0x32], cl
lea rcx, [rsp + 0x50]
cmp r12, 8
cmovae rcx, qword [rsp + 0x50]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rbp + 0xe8], rax
cmp byte [rsp + 0x32], 0
je 0x18000b328
mov ebx, 0x34
mov ecx, ebx
sub ecx, 0x34
je 0x18000b207
cmp ecx, 1
jne 0x18000b223
mov ecx, dword [rsp + 0x70]
mov r8d, 0x4c
lea rdx, [rbp + 0x10]
call qword [sym.imp.WINMM.dll_midiInGetDevCapsW]
mov dword [rsp + 0x74], eax
jmp 0x18000b223
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], rax
mov dword [rbp + 0x58], eax
inc ebx
cmp ebx, 0x36
jb 0x18000b1e1
jmp 0x18000b324
lea rcx, [rbp - 0x20]
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
cmp qword [rbp + 0xe8], 0
jne 0x18000b328
mov edi, 0x129
nop dword [rax]
mov eax, edi
sub eax, 0x125
je 0x18000b417
sub eax, 1
je 0x18000b2b0
sub eax, 1
je 0x18000b29c
sub eax, 1
je 0x18000b296
cmp eax, 1
jne 0x18000b312
mov byte [rsp + 0x33], al
mov qword [rbp - 0x80], r14
lea r9, [rbp - 0x80]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov r13d, eax
mov dword [rsp + 0x48], eax
jmp 0x18000b312
mov dword [rbp - 0x5c], r14d
jmp 0x18000b312
mov ecx, r14d
movzx eax, byte [rsp + 0x33]
test r13d, r13d
cmove ecx, eax
mov byte [rsp + 0x33], cl
jmp 0x18000b312
cmp byte [rsp + 0x33], 0
je 0x18000b305
mov ebx, 0x98
nop dword [rax]
mov eax, ebx
sub eax, 0x98
je 0x18000b2d4
cmp eax, 1
jne 0x18000b2f6
mov rcx, qword [rbp + 0x78]
jmp 0x18000b2ec
mov qword [rbp + 0x78], r14
lea r8, [rbp + 0x78]
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
mov r13d, eax
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x18000b2f6
call sub.RPCRT4.dll_MesHandleFree
inc ebx
cmp ebx, 0x9a
jb 0x18000b2c0
mov dword [rsp + 0x48], r13d
mov ecx, dword [rbp - 0x5c]
call qword [sym.imp.RPCRT4.dll_I_RpcMapWin32Status]
mov byte [rbp - 0x48], 0
dec edi
cmp edi, 0x124
ja 0x18000b250
mov edi, dword [rsp + 0x34]
mov ebx, dword [rsp + 0x38]
mov r12, qword [rsp + 0x68]
mov r9d, 0x65
movabs r10, 0x7ffffffffffffffe
lea r11, [0x180000000]
inc edi
mov dword [rsp + 0x34], edi
inc ebx
mov dword [rsp + 0x38], ebx
cmp edi, 0x6d
mov rdx, qword [rbp + 0x370]
jb 0x18000ae36
cmp r12, 8
jb 0x18000b39d
lea rdx, [r12*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b398
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b464
call fcn.18003ae74
mov eax, dword [rsp + 0x78]
inc eax
mov dword [rsp + 0x78], eax
add rsi, 8
mov qword [rbp - 0x50], rsi
cmp eax, 3
mov rdx, qword [rbp + 0x370]
mov r9d, 0x65
movabs r10, 0x7ffffffffffffffe
lea r11, [0x180000000]
jb 0x18000ae10
mov r12d, dword [rbp + 0x378]
mov edi, dword [rsp + 0x7c]
mov r14d, 0x32
movabs rbx, 0x65006c00730073
xor r8d, r8d
mov eax, r12d
add eax, dword [rsp + 0x40]
lea eax, [rax + r12*2]
mov dword [rsp + 0x40], eax
cmp eax, edi
ja 0x18000ab26
mov rdx, qword [rbp + 0x370]
jmp 0x18000a931
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000ab26
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b454
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b45e
call fcn.18003ae74
jmp 0x18000ab26
call fcn.18003f694
int3
call fcn.18003f694
nop
call fcn.180015450
nop
call fcn.18003f694
nop
call fcn.18003f694
int3