Function at 0x1800c5910
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x558]
sub rsp, 0x620
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
movaps xmmword [rax - 0x88], xmm10
movaps xmmword [rax - 0x98], xmm11
movaps xmmword [rax - 0xa8], xmm12
movaps xmmword [rax - 0xb8], xmm13
movaps xmmword [rax - 0xc8], xmm15
mov rax, qword [0x1803964c0]
xor rax, rsp
mov qword [rbp + 0x480], rax
mov qword [rbp + 0x58], r9
mov esi, r8d
mov dword [rbp - 0x7c], r8d
mov qword [rbp - 0x30], rdx
mov qword [rbp + 0x60], rcx
mov rax, qword [rbp + 0x580]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp + 0x588]
mov qword [rbp + 0x68], rax
movdqa xmm0, xmmword [0x18037aa90]
movdqa xmmword [rbp + 0x260], xmm0
mov byte [rbp + 0x250], 0
movdqa xmm1, xmm0
movdqa xmmword [rbp + 0x280], xmm0
mov byte [rbp + 0x270], 0
movdqa xmmword [rbp + 0x2a0], xmm0
mov byte [rbp + 0x290], 0
movdqa xmmword [rbp + 0x330], xmm0
mov byte [rbp + 0x320], 0
movdqa xmmword [rbp + 0x350], xmm0
mov byte [rbp + 0x340], 0
xor ecx, ecx
mov qword [rbp + 0xe8], rcx
mov word [rbp + 0xf0], cx
movdqu xmmword [rbp + 0x102], xmm0
mov byte [rbp + 0xf2], cl
mov qword [rbp + 0xb8], rcx
mov word [rbp + 0xc0], cx
movdqu xmmword [rbp + 0xd2], xmm0
mov byte [rbp + 0xc2], cl
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp], rcx
mov qword [rbp + 8], rcx
movdqa xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x120], rcx
mov qword [rbp + 0x128], rcx
mov qword [rbp + 0x130], rcx
mov ecx, 0x30
call fcn.18012bf4c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x128], rax
xor r8d, r8d
mov qword [rbp + 0x138], r8
xorps xmm13, xmm13
movsd qword [rbp + 0x140], xmm13
mov qword [rbp + 0x148], r8
mov edi, 1
mov dword [rbp + 0x150], edi
mov qword [rbp + 0x158], r8
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x160], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x170], xmm1
movdqa xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], r8
mov qword [rbp + 0x198], 0xffffffffffffffff
mov dword [rbp + 0x1a0], r8d
xor eax, eax
movups xmmword [rbp + 0x1a8], xmm0
movups xmmword [rbp + 0x1b8], xmm0
movups xmmword [rbp + 0x1c8], xmm0
movups xmmword [rbp + 0x1d8], xmm0
mov qword [rbp + 0x1e8], rax
movdqa xmm0, xmmword [0x18037aa90]
movdqa xmmword [rbp + 0x200], xmm0
mov byte [rbp + 0x1f0], al
mov word [rbp + 0x210], r8w
mov dword [rbp + 0x214], r8d
mov qword [rbp + 0x218], r8
xorps xmm0, xmm0
movaps xmmword [rbp + 0x220], xmm0
movsd qword [rbp + 0x230], xmm13
mov byte [rbp + 0x238], al
mov qword [rbp + 0x23c], r8
mov dword [rsp + 0x70], esi
lea eax, [rsi + 0xb]
mov dword [rbp - 0x78], eax
lea r9, [0x180000000]
mov r11d, 0x1bb
movzx r14d, byte [rsp + 0x78]
mov byte [rsp + 0x74], r14b
cmp esi, eax
jae 0x1800c6317
lea ebx, [rsi - 0x8b]
mov dword [rbp - 0x68], ebx
lea r10d, [r8 + 0x45]
movsd xmm9, qword [0x18038bcb0]
movsd xmm7, qword [0x180378818]
movsd xmm8, qword [0x180375928]
movsd xmm10, qword [0x180376728]
movsd xmm11, qword [0x180377618]
movsd xmm12, qword [0x1803748e0]
movsd xmm15, qword [0x180374298]
mov r13d, dword [rbp - 0x64]
movsd xmm6, qword [rbp - 0x50]
mov ebx, dword [rbp - 0x64]
mov esi, dword [rbp - 0x64]
mov r12d, dword [rbp - 0x64]
mov r15d, dword [rbp - 0x64]
mov edx, dword [rbp - 0x68]
mov eax, dword [rsp + 0x70]
mov ecx, dword [rbp - 0x78]
nop dword [rax + rax]
cmp edx, 0x17
ja case.default.0x1800c5c16
mov eax, edx
mov ecx, dword [r9 + rax*4 + 0xc6c4c]
add rcx, r9
jmp rcx
mov byte [rbp - 0x70], 0x2b
mov edi, 0x54
cmp edi, 0xba
ja 0x1800c5cb5
je 0x1800c5c86
mov eax, edi
sub eax, 0x15
je 0x1800c5c70
sub eax, 0x3f
je 0x1800c5c49
cmp eax, 0x55
je 0x1800c5ceb
jmp 0x1800c5cce
cmp byte [rbp - 0x70], 0x2d
jne 0x1800c5c54
movaps xmm0, xmm7
jmp 0x1800c5c58
movaps xmm0, xmm8
movaps xmm6, xmm10
andps xmm6, xmm9
addsd xmm6, xmm11
mulsd xmm6, xmm0
mulsd xmm6, xmm12
jmp 0x1800c5cce
lea rdx, [rbp - 0x70]
mov ecx, 0xa6
call fcn.1800dfe00
mov byte [rbp - 0x60], al
xor r8d, r8d
jmp 0x1800c5cce
xor edx, edx
lea r8d, [rdx + 0x76]
lea rcx, [rbp - 0x14]
call fcn.180004d90
test al, al
je 0x1800c5ce7
cmp dword [rbp - 0x14], 2
jae 0x1800c5ce1
xor edx, edx
lea ecx, [rdx + 0x77]
call fcn.1800de0f0
cmp eax, 3
setae byte [rbp - 0x60]
xor r8d, r8d
jmp 0x1800c5cce
mov eax, edi
sub eax, 0xe8
je 0x1800c5cca
sub eax, 0x66
je 0x1800c5ceb
cmp eax, 0x2e
je 0x1800c5ceb
jmp 0x1800c5cce
mov dword [rbp - 0x60], r8d
add edi, 0x94
cmp edi, 0x460
jae 0x1800c5ceb
jmp 0x1800c5c21
mov byte [rbp - 0x60], 1
jmp 0x1800c5ceb
mov byte [rbp - 0x60], 0
mov r13d, dword [rbp - 0x60]
movsd qword [rbp - 0x48], xmm15
movsd xmm0, qword [0x180375a38]
movsd qword [rbp - 0x20], xmm0
movsd qword [rbp - 0x40], xmm6
lea rax, [rbp - 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
lea r9, str.eraTf2a
mov r8d, 0x103
mov rdx, qword [rbp - 0x30]
lea rcx, [0x18036deb0]
call fcn.1800e22b0
mov edi, 1
jmp 0x1800c62df
mov dword [rbp - 0x40], r8d
mov dword [rbp - 0x48], r13d
mov rax, qword [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x44
lea r8, str.eraTf2a
lea rdx, [0x18036da70]
lea rcx, [rbp - 0x40]
call fcn.1800bce50
jmp 0x1800c62df
mov word [rbp + 0x2b0], r11w
jmp case.0x1800c5c16.6
mov word [rbp + 0x45c], r8w
mov r8d, 3
lea rdx, [0x18036df38]
lea rcx, [rbp + 0x450]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8d, 2
lea rdx, [0x18036e04e]
lea rcx, [rbp + 0x450]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
movabs rax, 0x74006f006e0020
mov qword [rbp + 0x466], rax
jmp 0x1800c62df
mov dword [rbp + 0x46e], 0x650020
mov word [rbp + 0x472], r8w
jmp case.0x1800c5c16.6
mov dword [rbp + 0x450], 0x45
mov r8d, 2
lea rdx, [0x18036e06c]
lea rcx, [rbp + 0x452]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov eax, dword [str.FilterRegionKind]
mov dword [rbp + 0x456], eax
movzx eax, word [0x18036e0b4]
mov word [rbp + 0x45a], ax
jmp 0x1800c62df
movsd xmm0, qword [rbp + 0x408]
movsd xmm1, qword [rbp + 0x400]
mulsd xmm0, xmm0
mulsd xmm1, xmm1
addsd xmm0, xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrt
andps xmm0, xmm9
comisd xmm13, xmmword [rbp + 0x3e0]
jbe 0x1800c5e75
xorps xmm0, xmmword [0x18038bcc0]
xorps xmm0, xmmword [0x18038bcc0]
movsd xmm1, qword [rbp + 0x410]
call sub.api_ms_win_crt_math_l1_1_0.dll_atan2
mov rax, qword [rbp + 0x68]
jmp 0x1800c62db
mov r9d, 0xc2
lea r8, [0x1803961b8]
xor edx, edx
xor ecx, ecx
call fcn.180086800
test al, al
jne 0x1800c61ca
mov r14d, 0xe
cmp r14d, 0xe
ja case.default.0x1800c5ed4
mov eax, r14d
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0xc6cac]
add rcx, rdx
jmp rcx
mov eax, 0x72
mov word [rbp + 0x420], ax
jmp case.default.0x1800c5ed4
mov dword [rbp + 0x427], 0x74654e
mov eax, 0x77
mov word [rbp + 0x42a], ax
mov eax, 0x6f
mov word [rbp + 0x42b], ax
jmp case.default.0x1800c5ed4
mov eax, 0x43
mov word [rbp + 0x432], ax
mov eax, 0x6e6f
mov word [rbp + 0x433], ax
jmp case.default.0x1800c5ed4
mov eax, 0x65
mov word [rbp + 0x426], ax
jmp case.default.0x1800c5ed4
lea rax, [rbp + 0x440]
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x1800c5f50
xor eax, eax
mov dword [rbp - 0x5c], eax
mov dword [rbp - 0x58], eax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x38], rax
jmp case.default.0x1800c5ed4
xor edx, edx
mov ecx, edx
movzx eax, byte [rbp - 0x80]
cmp dword [rbp - 0x64], edx
cmove ecx, eax
movzx eax, cl
mov byte [rbp - 0x80], cl
cmp byte [rsp + 0x78], dl
je 0x1800c5ff8
mov ebx, 0xd1
nop dword [rax]
cmp ebx, 0xd1
je 0x1800c5fe3
cmp ebx, 0x86b5
je 0x1800c5fba
cmp ebx, 0x10c99
jne 0x1800c5fe6
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x1800c5fe6
call sub.RPCRT4.dll_MesHandleFree
xor edx, edx
jmp 0x1800c5fe6
mov qword [rbp + 0x50], rdx
lea rax, [rbp - 0x5c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
lea r9, [rbp + 0x50]
xor r8d, r8d
mov edx, r12d
mov rcx, qword [rbp - 0x28]
call sub.RPCRT4.dll_MesBufferHandleReset
xor edx, edx
jmp 0x1800c5fe6
mov r12d, edi
add ebx, 0x85e4
cmp ebx, 0x191ac
jbe 0x1800c5f90
movzx eax, byte [rbp - 0x80]
test al, al
je 0x1800c6051
mov ebx, 0xa2
mov eax, ebx
sub eax, 0xa2
je 0x1800c601f
cmp eax, 1
jne 0x1800c6042
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x1800c6042
call sub.RPCRT4.dll_MesHandleFree
jmp 0x1800c6042
mov qword [rbp + 0x40], rdx
lea rax, [rbp - 0x58]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
lea r9, [rbp + 0x40]
xor r8d, r8d
mov edx, edi
mov rcx, qword [rbp - 0x38]
call sub.RPCRT4.dll_MesBufferHandleReset
inc ebx
cmp ebx, 0xa4
mov edx, 0
jb 0x1800c6001
mov ebx, edi
jmp case.default.0x1800c5ed4
mov r8d, 4
lea rdx, str.t64A
lea rcx, [rbp + 0x440]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8, rdi
lea rdx, [0x18036dcf8]
lea rcx, [rbp + 0x440]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8, rdi
lea rdx, [0x18036dcf8]
lea rcx, [rbp + 0x440]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp case.default.0x1800c5ed4
mov eax, 0x72
mov word [rbp + 0x42c], ax
mov eax, 0x6b
mov word [rbp + 0x42d], ax
mov dword [rbp + 0x42e], 0x707954
mov eax, 0x65
mov word [rbp + 0x431], ax
jmp case.default.0x1800c5ed4
mov eax, 0x73
mov word [rbp + 0x422], ax
mov eax, 0x74
mov word [rbp + 0x423], ax
mov eax, 0x726f
mov word [rbp + 0x424], ax
jmp case.default.0x1800c5ed4
lea r9, [rbp - 0x28]
lea r8, [rbp - 0x5c]
mov edx, r15d
lea rcx, [rbp + 0x420]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov edi, eax
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
mov edx, esi
lea rcx, [rbp + 0x440]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov dword [rbp - 0x64], eax
test edi, edi
mov edi, 1
je case.default.0x1800c5ed4
mov byte [rsp + 0x78], 0
jmp case.default.0x1800c5ed4
mov r8d, 2
lea rdx, [0x18036e0dc]
lea rcx, [rbp + 0x440]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov byte [rsp + 0x78], 1
jmp case.default.0x1800c5ed4
mov dword [rbp + 0x435], 0x676966
movzx eax, word [0x18036e0e0]
mov word [rbp + 0x440], ax
mov eax, 0x6e
mov word [rbp + 0x442], ax
jmp case.default.0x1800c5ed4
mov eax, 0x65
mov word [rbp + 0x421], ax
jmp case.default.0x1800c5ed4
mov byte [rbp - 0x80], 1
lea rax, [rbp + 0x420]
mov r15, 0xffffffffffffffff
nop word [rax + rax]
inc r15
cmp byte [rax + r15], 0
jne 0x1800c61b0
dec r14d
lea eax, [r14 + 0x41]
cmp eax, 0x40
ja 0x1800c5eb6
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov r14b, 1
mov byte [rsp + 0x74], r14b
mov r8d, 0xb
lea rdx, str.oneplant.ca
lea rcx, [rbp + 0x250]
call fcn.18006b7a0
mov r8, rdi
lea rdx, [0x18036e0f4]
lea rcx, [rbp + 0x270]
call fcn.18006b7a0
jmp 0x1800c62df
mov r8d, 2
lea rdx, [0x18036e0fa]
lea rcx, [rbp + 0x472]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor ecx, ecx
mov word [rbp + 0x476], cx
lea r8d, [rcx + 2]
lea rdx, [0x18036e172]
lea rcx, [rbp + 0x450]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x1800c62df
mov rax, qword [rbp + 0x58]
movsd xmm0, qword [rax]
movsd qword [rbp - 0x40], xmm0
mov rax, qword [rbp - 0x30]
movsd xmm1, qword [rax]
movsd qword [rbp - 0x20], xmm1
lea r9, [rbp - 0x20]
mov r8d, 0xbe
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x3d0]
call fcn.1800c7c10
movsd xmm1, qword [rbp + 0x3e0]
movsd xmm0, qword [rbp + 0x3f8]
call sub.api_ms_win_crt_math_l1_1_0.dll_atan2
mov rax, qword [rbp + 0x60]
movsd qword [rax], xmm0
movsd qword [rbp - 0x20], xmm0
mov r9d, 0x92
lea r8, [rbp - 0x20]
xor edx, edx
lea rcx, [rbp + 0x3d0]
call fcn.18006e600
movsd xmm1, qword [rbp + 0x3f0]
movsd xmm0, qword [rbp + 0x3e8]
call sub.api_ms_win_crt_math_l1_1_0.dll_atan2
mov rax, qword [rbp - 0x50]
movsd qword [rax], xmm0
mov r11d, 0x1bb
mov r10d, 0x45
lea r9, [0x180000000]
xor r8d, r8d
mov edx, dword [rbp - 0x68]
mov eax, dword [rsp + 0x70]
mov ecx, dword [rbp - 0x78]
inc eax
mov dword [rsp + 0x70], eax
inc edx
mov dword [rbp - 0x68], edx
cmp eax, ecx
jb 0x1800c5c00
mov esi, dword [rbp - 0x7c]
jmp 0x1800c631a
mov ebx, dword [rbp - 0x64]
lea edi, [rsi + 0xa]
mov dword [rsp + 0x70], edi
cmp esi, edi
jae case.0x1800c638a.9
lea edi, [rsi - 0x8b]
mov dword [rbp - 0x58], edi
mov r13d, 0x10
mov esi, dword [rbp - 0x64]
movzx r15d, byte [rsp + 0x78]
movzx r12d, byte [rsp + 0x78]
mov eax, dword [rsp + 0x70]
mov ecx, dword [rbp - 0x7c]
mov r11d, 0x3b
mov r10d, 0x7078
lea r9d, [r11 + 0x2e]
mov r8d, 0x6e75
mov edx, 0x6563
cmp edi, 9
ja case.default.0x1800c638a
lea rcx, [0x180000000]
mov ecx, dword [rcx + rdi*4 + 0xc6ce8]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
xor eax, eax
mov ebx, eax
jmp 0x1800c689a
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
lea rcx, [rbp + 0x290]
call fcn.18001a780
jmp 0x1800c689a
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [0x18000bce0]
mov qword [rbp - 0x50], rax
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x12b
lea rdx, [rbp - 0x50]
xor ecx, ecx
call fcn.1800965a0
lea r9, [rbp + 0x120]
lea r8, [rbp - 0x10]
mov edx, 0xcc
lea rcx, [0x1803961b0]
call fcn.18007f030
xor eax, eax
mov ecx, eax
movzx eax, r14b
cmp qword [rbp - 0x30], rcx
cmovne ecx, eax
movzx r14d, cl
mov byte [rsp + 0x74], cl
jmp 0x1800c689a
mov edx, 0x37
lea rcx, [rbp + 0x120]
call fcn.180126260
test r14b, r14b
je 0x1800c6456
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.WINMM.dll_mmioSeek]
mov edx, r13d
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.WINMM.dll_mmioClose]
movzx r14d, byte [rsp + 0x74]
lea r9, [rbp + 0x48]
lea r8, [rbp + 0x70]
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x90]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorSacl]
jmp 0x1800c689a
xor eax, eax
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp - 0x10]
lea edx, [rax + 0x2e]
xor ecx, ecx
call fcn.18001a080
lea rax, [rbp + 0xe8]
mov qword [rbp - 0x50], rax
mov rdx, qword [rbp - 8]
cmp rdx, qword [rbp]
je 0x1800c64b9
lea rax, [rbp + 0xe8]
mov qword [rdx], rax
mov rdx, qword [rbp - 8]
add rdx, 8
mov qword [rbp - 8], rdx
jmp 0x1800c64ca
lea r8, [rbp - 0x50]
lea rcx, [rbp - 0x10]
call fcn.1800017f0
mov rdx, qword [rbp - 8]
lea rax, [rbp + 0xb8]
mov qword [rbp - 0x50], rax
cmp rdx, qword [rbp]
je 0x1800c64ef
lea rax, [rbp + 0xb8]
mov qword [rdx], rax
add qword [rbp - 8], 8
jmp 0x1800c689a
lea r8, [rbp - 0x50]
lea rcx, [rbp - 0x10]
call fcn.1800017f0
jmp 0x1800c689a
lea rax, [rbp - 0x10]
mov qword [rbp + 0x440], rax
mov eax, dword [0x180396260]
mov dword [rbp + 0x448], eax
mov eax, dword [0x180396264]
mov dword [rbp + 0x44c], eax
movaps xmm0, xmmword [rbp + 0x440]
movdqa xmmword [rbp + 0x80], xmm0
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x80]
lea r8, [0x18001bfc0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x38], rax
mov r8d, dword [rbp - 0x64]
lea rdx, [rbp + 0x360]
lea rcx, [rbp + 0x450]
call qword [sym.imp.WINMM.dll_mmioOpenW]
mov qword [rbp - 0x30], rax
jmp 0x1800c689a
xor eax, eax
mov dword [rbp - 0x64], eax
mov eax, dword [0x180396260]
mov dword [rbp - 0x40], eax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x10]
xor r8d, r8d
xor edx, edx
mov ecx, 0xa7
call fcn.180025a90
jmp 0x1800c689a
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], 0x19
mov qword [rsp + 0x30], rcx
lea rax, [rbp + 0x320]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x250]
call fcn.180012bc0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], rax
mov eax, 0x1bb
mov word [rsp + 0x78], ax
xor ecx, ecx
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
lea rax, [rbp + 0xe8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [0x180396218]
mov edx, 0x109
call fcn.1800ba6a0
mov eax, 0x1bb
mov word [rsp + 0x78], ax
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0xb
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [0x180396238]
lea rdx, [rsp + 0x78]
xor ecx, ecx
call fcn.18001f000
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x360], xmm0
movups xmmword [rbp + 0x370], xmm0
movups xmmword [rbp + 0x380], xmm0
movups xmmword [rbp + 0x390], xmm0
movups xmmword [rbp + 0x3a0], xmm0
movups xmmword [rbp + 0x3b0], xmm0
mov dword [rbp + 0x3c0], eax
jmp 0x1800c689a
cmp qword [rbp - 0x38], 0
jne 0x1800c689a
mov r14d, 0xa
cmp r14d, 0xa
ja case.default.0x1800c66ff
mov eax, r14d
lea rdi, [0x180000000]
mov ecx, dword [rdi + rax*4 + 0xc6d10]
add rcx, rdi
jmp rcx
lea rax, [rbp + 0x420]
mov rsi, 0xffffffffffffffff
nop
inc rsi
cmp byte [rax + rsi], 0
jne 0x1800c6710
xor eax, eax
mov dword [rbp - 0x5c], eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x2c0], xmm0
movups xmmword [rbp + 0x2d0], xmm0
movups xmmword [rbp + 0x2e0], xmm0
movups xmmword [rbp + 0x2f0], xmm0
movups xmmword [rbp + 0x300], xmm0
mov qword [rbp + 0x310], rax
mov dword [rbp + 0x318], eax
jmp case.default.0x1800c66ff
xor eax, eax
mov qword [rbp - 0x28], rax
jmp case.default.0x1800c66ff
mov dword [rbp + 0x420], 0x696e75
jmp case.default.0x1800c66ff
mov dword [rbp + 0x438], 0x3b7078
mov r12b, 1
movzx r15d, r12b
jmp case.default.0x1800c66ff
mov ecx, 0x73
mov word [rbp + 0x42e], cx
mov dword [rbp + 0x42f], 0x746f70
mov eax, 0x5f
mov word [rbp + 0x432], ax
mov word [rbp + 0x433], cx
jmp case.default.0x1800c66ff
xor eax, eax
mov qword [rbp - 0x48], rax
lea rdx, [rbp + 0x2c0]
mov rcx, qword [rbp - 0x28]
call sub.IMM32.dll_ImmGetCompositionFontW
mov edi, eax
lea r9, [rbp - 0x48]
lea r8, [rbp - 0x5c]
mov edx, esi
lea rcx, [rbp + 0x420]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
movzx r15d, r15b
test edi, edi
mov ecx, 0
cmove r15d, ecx
mov edx, 0x6563
mov r8d, 0x6e75
lea r9d, [rcx + 0x69]
mov r10d, 0x7078
lea r11d, [rcx + 0x3b]
test eax, eax
je case.default.0x1800c66ff
xor r12b, r12b
jmp case.default.0x1800c66ff
mov eax, 0x3f
mov word [rbp + 0x423], ax
mov eax, 0x6f
mov word [rbp + 0x424], ax
jmp case.default.0x1800c66ff
mov eax, 0x72
mov word [rbp + 0x425], ax
mov dword [rbp + 0x426], 0x6c66206d
mov dword [rbp + 0x42a], 0x74616f
mov eax, 0x20
mov word [rbp + 0x42d], ax
jmp case.default.0x1800c66ff
mov word [rbp + 0x436], dx
jmp case.default.0x1800c66ff
mov eax, 0x70
mov word [rbp + 0x434], ax
mov eax, 0x65
mov word [rbp + 0x435], ax
dec r14d
lea eax, [r14 + 0x9f]
cmp eax, 0x9e
ja 0x1800c66e1
mov edi, dword [rbp - 0x58]
movzx r14d, byte [rsp + 0x74]
mov ecx, dword [rbp - 0x7c]
mov eax, dword [rsp + 0x70]
inc ecx
mov dword [rbp - 0x7c], ecx
inc edi
mov dword [rbp - 0x58], edi
cmp ecx, eax
jb 0x1800c634e
mov esi, ebx
lea rcx, [rbp + 0x198]
call fcn.1800037c0
mov rbx, qword [rbp + 0x180]
test rbx, rbx
je 0x1800c69d6
mov rdi, qword [rbp + 0x188]
cmp rbx, rdi
je 0x1800c68f8
nop dword [rax]
mov rcx, rbx
call fcn.180069f90
add rbx, 0x20
cmp rbx, rdi
jne 0x1800c68e0
mov rbx, qword [rbp + 0x180]
mov rdx, qword [rbp + 0x190]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x1800c692b
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800c6a14
mov rcx, rbx
call fcn.18012bf88
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x180], xmm0
xor r14d, r14d
mov qword [rbp + 0x190], r14
jmp 0x1800c69d9
test r15b, r15b
je 0x1800c6962
lea rdx, [rbp + 0x2c0]
mov rcx, qword [rbp - 0x28]
call sub.IMM32.dll_ImmSetCompositionFontW
test r12b, r12b
je 0x1800c69cc
mov ebx, dword [rbp - 0x18]
mov edi, dword [rbp - 0x18]
mov rcx, qword [rbp - 0x48]
cmp r13d, 0x10
je 0x1800c69af
cmp r13d, 0xd7
jne 0x1800c69bc
lea rax, [rbp - 0x5c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
lea r9, [rbp - 0x50]
mov r8d, edi
mov edx, ebx
call sub.RPCRT4.dll_MesBufferHandleReset
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1800c69bc
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rbp - 0x48]
jmp 0x1800c69bc
mov ebx, 1
xor eax, eax
mov edi, eax
mov qword [rbp - 0x50], rax
add r13d, 0xc7
cmp r13d, 0x19e
jb 0x1800c6971
mov esi, 1
jmp 0x1800c68b5
xor r14d, r14d
mov rcx, qword [rbp + 0x168]
test rcx, rcx
je 0x1800c6a32
mov rdx, qword [rbp + 0x178]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800c6a1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800c6a1b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18012bf88
mov qword [rbp + 0x168], r14
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x170], xmm0
lea rcx, [rbp + 0x128]
call fcn.1800036f0
nop
mov rbx, qword [rbp + 8]
test rbx, rbx
je 0x1800c6ac9
mov rdi, qword [rbp + 0x10]
cmp rbx, rdi
je 0x1800c6a6a
mov rcx, rbx
call fcn.180003000
add rbx, 0x28
cmp rbx, rdi
jne 0x1800c6a55
mov rbx, qword [rbp + 8]
mov rcx, qword [rbp + 0x18]
sub rcx, rbx
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rax, rbx
cmp rdx, 0x1000
jb 0x1800c6ab5
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800c6b06
mov rcx, rbx
call fcn.18012bf88
mov qword [rbp + 8], r14
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x10], xmm0
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1800c6b1e
mov rax, qword [rbp]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800c6b0d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800c6b0d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18012bf88
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp], r14
mov rdx, qword [rbp + 0xda]
cmp rdx, 0x10
jb 0x1800c6b62
inc rdx
mov rcx, qword [rbp + 0xc2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800c6b5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800c6b5d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18012bf88
movdqa xmm0, xmmword [0x18037aa90]
movdqu xmmword [rbp + 0xd2], xmm0
mov byte [rbp + 0xc2], 0
mov rdx, qword [rbp + 0x10a]
cmp rdx, 0x10
jb 0x1800c6bbd
inc rdx
mov rcx, qword [rbp + 0xf2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800c6bb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800c6bb8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18012bf88
movdqa xmm0, xmmword [0x18037aa90]
movdqu xmmword [rbp + 0x102], xmm0
mov byte [rbp + 0xf2], 0
lea rcx, [rbp + 0x320]
call fcn.180003360
nop
lea rcx, [rbp + 0x250]
call fcn.180003410
mov eax, esi
mov rcx, qword [rbp + 0x480]
xor rcx, rsp
call fcn.18012c9a0
lea r11, [rsp + 0x620]
mov rbx, qword [r11 + 0x50]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm15, xmmword [r11 - 0x90]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret