Function at 0x18002f960
Capabilities:
Access the windows event log
Clear windows event logs
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x180046bd8]
xor rax, rsp
mov qword [rbp + 0x3b8], rax
mov ebx, r9d
mov dword [rbp - 0x80], ebx
mov r14, r8
mov r15, rdx
mov rdi, rcx
movdqa xmm0, xmmword [0x180041270]
movdqa xmmword [rbp + 0x280], xmm0
mov byte [rbp + 0x270], 0
movdqa xmm1, xmm0
movdqa xmmword [rbp + 0x2a0], xmm0
mov byte [rbp + 0x290], 0
movdqa xmmword [rbp + 0x2c0], xmm0
mov byte [rbp + 0x2b0], 0
movdqa xmmword [rbp + 0x310], xmm0
mov byte [rbp + 0x300], 0
movdqa xmmword [rbp + 0x330], xmm0
mov byte [rbp + 0x320], 0
xor esi, esi
mov qword [rbp + 0x98], rsi
mov word [rbp + 0xa0], si
movdqu xmmword [rbp + 0xb2], xmm0
mov byte [rbp + 0xa2], sil
mov qword [rbp + 0x68], rsi
mov word [rbp + 0x70], si
movdqu xmmword [rbp + 0x82], xmm0
mov byte [rbp + 0x72], sil
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rsi
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp], rsi
mov qword [rbp + 8], rsi
mov qword [rbp + 0x10], rsi
mov qword [rbp + 0xd0], rsi
mov qword [rbp + 0xd8], rsi
mov qword [rbp + 0xe0], rsi
lea ecx, [rsi + 0x30]
call fcn.180038fd0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0xd8], rax
mov qword [rbp + 0xe8], rsi
xorps xmm2, xmm2
movsd qword [rbp + 0xf0], xmm2
mov qword [rbp + 0xf8], rsi
mov dword [rbp + 0x100], 1
mov qword [rbp + 0x108], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x120], xmm1
movdqa xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], rsi
mov qword [rbp + 0x148], 0xffffffffffffffff
mov dword [rbp + 0x150], esi
xor eax, eax
movups xmmword [rbp + 0x158], xmm0
movups xmmword [rbp + 0x168], xmm0
movups xmmword [rbp + 0x178], xmm0
movups xmmword [rbp + 0x188], xmm0
mov qword [rbp + 0x198], rax
movdqa xmm0, xmmword [0x180041270]
movdqa xmmword [rbp + 0x1b0], xmm0
mov byte [rbp + 0x1a0], al
mov word [rbp + 0x1c0], si
mov dword [rbp + 0x1c4], esi
mov qword [rbp + 0x1c8], rsi
xorps xmm0, xmm0
movaps xmmword [rbp + 0x1d0], xmm0
movsd qword [rbp + 0x1e0], xmm2
mov byte [rbp + 0x1e8], al
mov qword [rbp + 0x1ec], rsi
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], rsi
lea esi, [rbx - 0xf]
lea rcx, [0x180000000]
cmp ebx, esi
jbe 0x18002fd02
add ebx, 0xffffff91
mov edx, 0x6d6f
lea r9d, [rax + 0x6e]
lea r10d, [rax + 0x69]
lea r11d, [rax + 0x6b]
lea r12d, [rax + 0x61]
mov r13d, 0x6579
lea r8d, [rax + 0x63]
cmp ebx, 0x2e
ja case.default.0x18002fbb3
movzx eax, byte [rcx + rbx + 0x30c4c]
mov ecx, dword [rcx + rax*4 + 0x30c10]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov word [rbp + 0x342], r9w
mov word [rbp + 0x343], r10w
jmp case.0x18002fbb3.14
mov word [rbp + 0x348], r11w
mov eax, 0x2e
mov word [rbp + 0x349], ax
jmp case.0x18002fbb3.14
cmp qword [0x180046cd8], 0
je 0x18002fc01
cmp qword [0x180046cd0], 0
je 0x18002fc01
mov byte [rsp + 0x70], 1
jmp case.0x18002fbb3.14
mov byte [rsp + 0x70], 0
jmp case.0x18002fbb3.14
mov qword [rdi], r15
mov qword [rdi + 0x100], r14
jmp case.0x18002fbb3.14
lea rax, [rdi + 0x108]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8d, 0x104
call fcn.18000bb80
mov edx, 0x6d6f
mov r8d, 0x63
lea r9d, [r8 + 0xb]
lea r10d, [r8 + 6]
lea r11d, [r8 + 8]
jmp case.0x18002fbb3.14
mov dword [rbp + 0x344], 0x666173
jmp case.0x18002fbb3.14
mov word [rbp + 0x347], r12w
jmp case.0x18002fbb3.14
mov dword [rbp + 0x368], 0x40734077
jmp case.0x18002fbb3.14
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x46
lea r9, [rbp + 0x20]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18002bae0
mov byte [rsp + 0x70], al
jmp 0x18002fc41
mov word [rbp + 0x340], r13w
jmp case.0x18002fbb3.14
mov rax, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18002fcc8
mov rax, qword [rdi]
mov qword [rbp + 0x20], rax
mov rax, qword [rdi + 0x10]
mov qword [rbp + 0x28], rax
jmp case.0x18002fbb3.14
mov word [rbp + 0x34b], dx
mov byte [rbp + 0x34d], 0
jmp case.0x18002fbb3.14
mov word [rbp + 0x34a], r8w
lea rcx, [0x180000000]
dec ebx
lea eax, [rbx + 0x6f]
cmp eax, esi
ja 0x18002fb91
mov esi, dword [rbp - 0x80]
mov dword [rsp + 0x60], esi
lea eax, [rsi - 0xd]
mov dword [rsp + 0x68], eax
mov r9d, 0x1bb
mov edi, dword [rsp + 0x70]
cmp esi, eax
jbe 0x1800302a5
add esi, 0xffffff6f
mov dword [rsp + 0x7c], esi
mov edx, 0x4073
movzx r12d, byte [rsp + 0x70]
mov r13, qword [rbp - 0x50]
mov r14, qword [rbp - 0x78]
mov ebx, dword [rsp + 0x78]
mov r15d, dword [rsp + 0x78]
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x68]
cmp esi, 0xc
ja case.default.0x18002fd6b
lea r8, [0x180000000]
mov ecx, dword [r8 + rsi*4 + 0x30c7c]
add rcx, r8
jmp rcx
mov edi, dword [rsp + 0x70]
jmp case.0x180030301.169
xor edx, edx
mov r8d, 0x126
lea rcx, [0x1800452e8]
call fcn.180021730
test al, al
jne 0x1800300b0
mov esi, 0x7e
nop word [rax + rax]
cmp esi, 0x542
ja 0x18002fece
je 0x18002fe97
cmp esi, 0x2e0
ja 0x18002fe41
je 0x18002fe32
mov eax, esi
sub eax, 0x7e
je 0x18002fe21
sub eax, 0x7a
je 0x18002fe12
sub eax, 0x7a
je 0x18002fe01
sub eax, 0x7a
je 0x18002fdf0
cmp eax, 0x7a
jne 0x18003009d
mov eax, 0x4d
mov word [rbp + 0x37e], ax
jmp 0x18003009d
mov eax, 0x20
mov word [rbp + 0x37d], ax
jmp 0x18003009d
mov eax, 0x65
mov word [rbp + 0x37c], ax
jmp 0x18003009d
mov dword [rbp + 0x379], 0x766972
jmp 0x18003009d
mov eax, 0x44
mov word [rbp + 0x378], ax
jmp 0x18003009d
mov dword [rbp + 0x37f], 0x3f646f
jmp 0x18003009d
mov eax, esi
sub eax, 0x35a
je 0x18002fe8a
sub eax, 0x7a
je 0x18002fe7a
sub eax, 0x7a
je 0x18002fe69
cmp eax, 0x7a
jne 0x18003009d
mov dword [rbp - 0x60], 0xa
jmp 0x18003009d
xor edx, edx
mov r13d, edx
mov qword [rbp - 0x50], rdx
mov dword [rbp - 0x5c], edx
jmp 0x18003009d
mov dword [rsp + 0x78], 0
mov r12b, 1
jmp 0x18003009d
mov qword [rbp - 0x78], 0
jmp 0x18003009d
mov dword [rbp - 0x70], 0x14
movsd xmm0, qword [str.jjjjNG_92_]
movsd qword [rbp + 0x388], xmm0
movzx eax, word [0x18003ed90]
mov word [rbp + 0x390], ax
movzx eax, byte [0x18003ed92]
mov byte [rbp + 0x392], al
jmp 0x18003009d
cmp esi, 0x81e
ja 0x18002ffb8
je 0x18002ff88
mov eax, esi
sub eax, 0x5bc
je 0x18002ff7a
sub eax, 0x7a
je 0x18002ff30
sub eax, 0x7a
je 0x18002ff24
sub eax, 0x7a
je 0x18002ff18
cmp eax, 0x7a
jne 0x18003009d
mov dword [rbp - 0x58], 0x14
mov dword [rbp - 0x48], 0xa
jmp 0x18003009d
mov dword [rbp - 0x7c], 0
jmp 0x18003009d
mov dword [rbp - 0x68], 0
jmp 0x18003009d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x200], xmm0
movups xmmword [rbp + 0x210], xmm0
movups xmmword [rbp + 0x220], xmm0
movups xmmword [rbp + 0x230], xmm0
movups xmmword [rbp + 0x240], xmm0
movups xmmword [rbp + 0x250], xmm0
mov dword [rbp + 0x260], eax
lea rdx, [rbp + 0x388]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_BackupEventLogA]
jmp 0x18003009d
xor edx, edx
mov qword [rbp - 0x40], rdx
mov dword [rbp - 0x64], edx
jmp 0x18003009d
mov r8d, dword [rbp - 0x7c]
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x378]
call qword [sym.imp.WINMM.dll_mmioOpenA]
mov r14, rax
lea rdx, [rbp + 0x388]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_ClearEventLogA]
jmp 0x18003009d
mov eax, esi
sub eax, 0x898
je 0x18003008b
sub eax, 0x7a
je 0x180030043
sub eax, 0x7a
je 0x18002ffdd
cmp eax, 0x7a
je case.0x180030301.169
jmp 0x18003009d
test r12b, r12b
je 0x18003003c
mov edi, 0x21
lea r13d, [rdi - 1]
nop dword [rax + rax]
cmp edi, 0x21
je 0x18003001b
cmp edi, 0x4c
jne 0x180030030
mov r8d, r15d
lea rdx, [rbp + 0x350]
mov rcx, r14
call qword [sym.imp.WINMM.dll_mmioCreateChunk]
lea edx, [rdi - 0x3c]
mov rcx, r14
call qword [sym.imp.WINMM.dll_mmioClose]
jmp 0x180030030
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x350], xmm0
mov dword [rbp + 0x360], eax
mov r15d, r13d
add edi, 0x2b
cmp edi, 0x77
jb 0x18002fff0
mov r13, qword [rbp - 0x50]
mov edi, 1
jmp 0x18003009d
mov dword [rsp + 0x50], ebx
mov eax, dword [rbp - 0x48]
mov dword [rsp + 0x48], eax
mov eax, dword [rbp - 0x58]
mov dword [rsp + 0x40], eax
mov eax, dword [rbp - 0x68]
mov dword [rsp + 0x38], eax
mov eax, dword [rbp - 0x64]
mov dword [rsp + 0x30], eax
mov rax, qword [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp - 0x70]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp - 0x60]
mov r8d, dword [rbp - 0x5c]
mov edx, dword [rsp + 0x78]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.GDI32.dll_GdiAlphaBlend]
jmp 0x18003009d
xor ebx, ebx
xor ecx, ecx
movzx eax, r12b
test r14, r14
cmovne ecx, eax
movzx r12d, cl
add esi, 0x7a
cmp esi, 0xa80
jb 0x18002fda0
mov esi, dword [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov edx, 0x4073
mov r9d, 0x1bb
jmp 0x180030286
mov byte [rbp + 0x374], 0
jmp 0x180030286
mov r8d, 1
lea rdx, [0x18003ed94]
lea rcx, [rbp + 0x290]
call fcn.180024af0
mov r9d, 0x1bb
mov word [rbp + 0x2d0], r9w
mov edx, 0x4073
jmp 0x180030286
mov word [rbp + 0x36c], dx
jmp 0x180030286
lea rax, [rbp + 0x340]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180030125
lea rdx, [rbp + 0x340]
lea rcx, [rbp + 0x270]
call fcn.180024af0
mov edx, 0x4073
mov r9d, 0x1bb
jmp 0x180030286
mov byte [rbp + 0x370], 0x73
jmp 0x180030286
movups xmm0, xmmword [str.gst_live_live_adder_chain]
movups xmmword [rbp + 0x398], xmm0
movsd xmm1, qword [0x18003eda8]
movsd qword [rbp + 0x3a8], xmm1
movzx eax, word [0x18003edb0]
mov word [rbp + 0x3b0], ax
mov word [rsp + 0x70], r9w
lea r9, [0x180045348]
mov r8d, 0x5b
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x98]
call fcn.180023aa0
mov edx, 0x4073
mov r9d, 0x1bb
jmp 0x180030286
mov byte [rbp + 0x36e], 0
mov r8d, 2
lea rdx, [0x18003edc8]
lea rcx, [rbp + 0x36e]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov edx, 0x4073
mov r9d, 0x1bb
jmp 0x180030286
mov byte [rbp + 0x374], 0x73
jmp 0x180030286
lea r8, [rbp + 0x2b0]
xor edx, edx
lea ecx, [rdx + 0x6a]
call fcn.180030f10
lea r9, [rbp + 0x300]
mov r8d, 0x73
lea rdx, [rbp + 0x270]
xor ecx, ecx
call fcn.180018e70
mov edx, 0x4073
mov r9d, 0x1bb
jmp 0x180030286
mov byte [rbp + 0x371], 0
jmp 0x180030286
mov byte [rbp + 0x375], 0
mov r8d, 1
lea rdx, str._____msg.vmplayer.welcomePage.vm.ram_RAM:
lea rcx, [rbp + 0x368]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov edx, 0x4073
mov r9d, 0x1bb
jmp 0x180030286
movzx eax, word [0x18003ee05]
mov word [rbp + 0x371], ax
movzx eax, byte [0x18003ee07]
mov byte [rbp + 0x373], al
mov ecx, dword [rsp + 0x68]
mov eax, dword [rsp + 0x60]
dec eax
mov dword [rsp + 0x60], eax
dec esi
mov dword [rsp + 0x7c], esi
cmp eax, ecx
ja 0x18002fd50
mov esi, dword [rbp - 0x80]
lea eax, [rsi + 0xd]
mov dword [rbp - 0x68], eax
cmp esi, eax
jae case.0x180030301.169
lea rdx, [0x180008b80]
mov r14d, dword [rsp + 0x78]
mov r13d, dword [rsp + 0x78]
mov r15d, dword [rsp + 0x78]
mov r12d, dword [rsp + 0x78]
mov rbx, qword [rbp - 0x70]
nop dword [rax]
nop word [rax + rax]
lea eax, [rsi - 0x9d]
cmp eax, 0xc
ja case.0x180030301.161
lea r8, [0x180000000]
mov ecx, dword [r8 + rax*4 + 0x30cb0]
add rcx, r8
jmp rcx
mov qword [rbp - 0x78], rdx
mov qword [rsp + 0x28], 0
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8d, 0xee
call fcn.18000bb80
mov r9d, 0x8e
lea r8, [0x1800452e0]
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0xd0]
call fcn.18002f960
jmp 0x180030948
xor edx, edx
lea r8d, [rdx + 0x73]
lea rcx, [rbp + 0xd0]
call fcn.1800052c0
jmp 0x180030948
lea rax, [rbp - 0x30]
mov qword [rbp + 0x340], rax
mov eax, dword [0x180045390]
mov dword [rbp + 0x348], eax
mov eax, dword [0x180045394]
mov dword [rbp + 0x34c], eax
movaps xmm0, xmmword [rbp + 0x340]
movdqa xmmword [rbp + 0x30], xmm0
jmp case.0x180030301.161
xor edi, edi
jmp case.0x180030301.161
xorps xmm0, xmm0
movups xmmword [rbp + 0x2e0], xmm0
movups xmmword [rbp + 0x2f0], xmm0
lea r8, [rbp - 0x30]
xor edx, edx
mov ecx, 0xa0
call fcn.180036bd0
jmp 0x180030948
xor ebx, ebx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
lea r9, [rbp + 0x30]
lea r8, [0x18001ba70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x70], rax
cmp rax, rbx
jne 0x180030852
lea esi, [rbx + 0x62]
jmp 0x180030402
xor ebx, ebx
cmp esi, 0x8ea
ja 0x1800305be
je 0x1800305b4
cmp esi, 0x452
ja 0x180030502
je 0x1800304dc
cmp esi, 0x25a
ja 0x1800304ad
je 0x180030482
cmp esi, 0x62
je 0x180030476
cmp esi, 0x10a
je 0x180030457
cmp esi, 0x1b2
jne 0x180030834
mov word [rbp + 0x352], 0x73
jmp 0x180030834
mov r8d, 2
lea rdx, [0x18003ef09]
lea rcx, [rbp + 0x350]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x180030834
mov byte [rbp + 0x350], 0
jmp 0x180030834
mov r8d, 3
lea rdx, [0x18003eed7]
lea rcx, [rbp + 0x350]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, 0x6552
mov word [rbp + 0x356], ax
jmp 0x180030834
cmp esi, 0x302
je 0x1800304d0
cmp esi, 0x3aa
jne 0x180030834
mov dword [rbp + 0x358], 0x7265646e
jmp 0x180030834
mov byte [rbp + 0x358], 0
jmp 0x180030834
mov byte [rbp + 0x35c], 0
mov r8d, 4
lea rdx, [0x18003eeb9]
lea rcx, [rbp + 0x35c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x180030834
cmp esi, 0x6f2
ja 0x180030585
je 0x180030579
cmp esi, 0x4fa
je 0x18003056d
cmp esi, 0x5a2
je 0x180030534
cmp esi, 0x64a
jne 0x180030834
mov byte [rbp + 0x366], 0
jmp 0x180030834
mov r8d, 4
lea rdx, [0x18003ee6a]
lea rcx, [rbp + 0x350]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 2
lea rdx, [0x18003ee91]
lea rcx, [rbp + 0x364]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x180030834
mov byte [rbp + 0x360], 0
jmp 0x180030834
mov byte [rbp + 0x366], 0x65
jmp 0x180030834
cmp esi, 0x79a
je 0x1800305a3
cmp esi, 0x842
jne 0x180030834
mov byte [rsp + 0x6c], 1
jmp 0x180030834
mov byte [rbp + 0x367], 0
mov byte [rsp + 0x70], 1
jmp 0x180030834
mov byte [rsp + 0x6d], 1
jmp 0x180030834
cmp esi, 0xe2a
ja 0x1800306c0
je 0x18003068d
cmp esi, 0xc32
ja 0x180030643
je 0x18003063a
cmp esi, 0xa3a
je 0x180030620
cmp esi, 0xae2
je 0x180030603
cmp esi, 0xb8a
jne 0x180030834
mov qword [rbp - 0x50], rbx
mov dword [rsp + 0x68], ebx
jmp 0x180030834
lea rax, [rbp + 0x350]
mov r14, 0xffffffffffffffff
inc r14
cmp byte [rax + r14], 0
jne 0x180030611
jmp 0x180030834
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rax
mov qword [rbp - 0x40], rbx
jmp 0x180030834
mov dword [rsp + 0x7c], ebx
jmp 0x180030834
cmp esi, 0xcda
je 0x18003066e
cmp esi, 0xd82
jne 0x180030834
lea rdx, [rsp + 0x68]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.WINMM.dll_midiInGetID]
mov dword [rbp - 0x7c], eax
jmp 0x180030834
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorGroup]
mov dword [rsp + 0x78], eax
mov qword [rbp - 0x58], rbx
jmp 0x180030834
lea r9, [rbp - 0x58]
lea r8, [rsp + 0x7c]
mov edx, r14d
lea rcx, [rbp + 0x350]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov dword [rbp - 0x5c], eax
mov edx, ebx
movzx ecx, byte [rsp + 0x70]
cmp dword [rsp + 0x78], 0
cmovne edx, ecx
mov byte [rsp + 0x70], dl
jmp 0x180030834
cmp esi, 0xed2
je 0x180030809
cmp esi, 0xf7a
je 0x1800307f5
cmp esi, 0x1022
je 0x180030779
cmp esi, 0x10ca
je 0x1800306fd
cmp esi, 0x1172
je case.0x180030301.169
jmp 0x180030834
cmp byte [rsp + 0x6c], 0
je 0x18003076f
mov ebx, 0xb0
nop dword [rax]
mov eax, ebx
sub eax, 0xae
je 0x180030757
sub eax, 1
je 0x18003072b
cmp eax, 1
jne 0x180030765
mov r15d, eax
xor r12d, r12d
jmp 0x180030765
mov qword [rbp - 0x48], 0
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
lea r9, [rbp - 0x48]
mov r8d, r12d
mov edx, r15d
mov rcx, qword [rbp - 0x58]
call sub.RPCRT4.dll_MesBufferHandleReset
jmp 0x180030765
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x180030765
call sub.RPCRT4.dll_MesHandleFree
dec ebx
cmp ebx, 0xad
ja 0x180030710
mov edi, 1
jmp 0x180030834
cmp byte [rsp + 0x6d], 0
je 0x180030834
mov ebx, 0xcc
nop dword [rax]
mov eax, ebx
sub eax, 0xcb
je 0x1800307d2
cmp eax, 1
jne 0x1800307e9
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x200], xmm0
movups xmmword [rbp + 0x210], xmm0
movups xmmword [rbp + 0x220], xmm0
movups xmmword [rbp + 0x230], xmm0
mov qword [rbp + 0x240], rax
mov dword [rbp + 0x248], eax
lea r13d, [rax + 0x4c]
jmp 0x1800307e9
mov ecx, dword [rsp + 0x68]
mov r8d, r13d
lea rdx, [rbp + 0x200]
call qword [sym.imp.WINMM.dll_midiInGetDevCapsW]
mov dword [rbp - 0x7c], eax
dec ebx
cmp ebx, 0xca
ja 0x180030790
jmp 0x180030834
mov ecx, ebx
movzx eax, byte [rsp + 0x6c]
cmp dword [rbp - 0x5c], 0
cmove ecx, eax
mov byte [rsp + 0x6c], cl
jmp 0x180030834
mov ecx, ebx
movzx eax, byte [rsp + 0x6d]
cmp dword [rbp - 0x7c], 0
cmove ecx, eax
mov byte [rsp + 0x6d], cl
cmp byte [rsp + 0x70], 0
je 0x180030834
mov r8d, dword [rbp - 0x60]
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorGroup]
add esi, 0xa8
cmp esi, 0x121a
jb 0x180030400
mov rbx, qword [rbp - 0x70]
mov esi, dword [rbp - 0x80]
jmp 0x180030948
mov rbx, rax
jmp 0x180030948
mov dword [rbp - 0x64], 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180030948
lea rax, [rbp + 0x68]
mov qword [rbp - 0x78], rax
mov rax, qword [rbp - 0x28]
cmp rax, qword [rbp - 0x20]
je 0x18003088f
lea rcx, [rbp + 0x68]
mov qword [rax], rcx
add qword [rbp - 0x28], 8
jmp 0x1800308a0
lea r8, [rbp - 0x78]
mov rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1800011a0
mov eax, dword [0x180045390]
mov dword [rbp - 0x70], eax
lea r8, [rbp - 0x30]
mov edx, 0x92
lea rcx, [rbp - 0x70]
call fcn.18001f430
jmp 0x180030948
lea rax, [rbp + 0x98]
mov qword [rbp - 0x78], rax
mov rax, qword [rbp - 0x28]
cmp rax, qword [rbp - 0x20]
je 0x1800308e6
lea rcx, [rbp + 0x98]
mov qword [rax], rcx
add qword [rbp - 0x28], 8
jmp case.0x180030301.161
lea r8, [rbp - 0x78]
mov rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1800011a0
jmp 0x180030948
mov word [rsp + 0x60], r9w
lea r9, [rbp + 0x68]
lea r8, [rsp + 0x60]
lea rdx, [0x180045368]
mov ecx, 0xf3
call fcn.180008bc0
jmp 0x180030948
mov r8d, 8
lea rdx, [rbp + 0x368]
lea rcx, [rbp + 0x398]
call qword [sym.imp.SHLWAPI.dll_StrCmpNCA]
mov r8d, dword [rbp - 0x64]
lea rdx, [rbp + 0x2e0]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_TranslateCharsetInfo]
lea rdx, [0x180008b80]
inc esi
mov dword [rbp - 0x80], esi
cmp esi, dword [rbp - 0x68]
mov r9d, 0x1bb
jb 0x1800302e0
lea rcx, [rbp + 0x148]
call fcn.180003220
mov rbx, qword [rbp + 0x130]
test rbx, rbx
je 0x1800309ed
mov rsi, qword [rbp + 0x138]
cmp rbx, rsi
je 0x18003099f
mov rcx, rbx
call fcn.1800245a0
add rbx, 0x20
cmp rbx, rsi
jne 0x180030987
mov rbx, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x140]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x1800309ce
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180030a2b
mov rcx, rbx
call fcn.18003900c
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x130], xmm0
xor r14d, r14d
mov qword [rbp + 0x140], r14
jmp 0x1800309f0
xor r14d, r14d
mov rcx, qword [rbp + 0x118]
test rcx, rcx
je 0x180030a49
mov rdx, qword [rbp + 0x128]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x180030a32
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180030a32
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003900c
mov qword [rbp + 0x118], r14
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x120], xmm0
lea rcx, [rbp + 0xd8]
call fcn.180003150
nop
mov rbx, qword [rbp - 0x18]
test rbx, rbx
je 0x180030aeb
mov rsi, qword [rbp - 0x10]
cmp rbx, rsi
je 0x180030a85
nop dword [rax]
mov rcx, rbx
call fcn.180002a60
add rbx, 0x28
cmp rbx, rsi
jne 0x180030a70
mov rbx, qword [rbp - 0x18]
mov rcx, qword [rbp - 8]
sub rcx, rbx
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rax, rbx
cmp rdx, 0x1000
jb 0x180030ad7
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180030ad7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.18003900c
mov qword [rbp - 0x18], r14
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
mov rdx, qword [rbp - 0x30]
test rdx, rdx
je 0x180030b14
mov r8, qword [rbp - 0x20]
sub r8, rdx
sar r8, 3
lea rcx, [rbp - 0x30]
call fcn.18002b0b0
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r14
mov rdx, qword [rbp + 0x8a]
cmp rdx, 0x10
jb 0x180030b55
inc rdx
mov rcx, qword [rbp + 0x72]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180030b50
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180030b50
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003900c
movdqa xmm0, xmmword [0x180041270]
movdqu xmmword [rbp + 0x82], xmm0
mov byte [rbp + 0x72], 0
mov rdx, qword [rbp + 0xba]
cmp rdx, 0x10
jb 0x180030bad
inc rdx
mov rcx, qword [rbp + 0xa2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180030ba8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180030ba8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003900c
movdqa xmm0, xmmword [0x180041270]
movdqu xmmword [rbp + 0xb2], xmm0
mov byte [rbp + 0xa2], 0
lea rcx, [rbp + 0x300]
call fcn.180002dc0
nop
lea rcx, [rbp + 0x270]
call fcn.180002e70
mov eax, edi
mov rcx, qword [rbp + 0x3b8]
xor rcx, rsp
call fcn.180039520
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret