Function at 0x180009dd0
Capabilities:
Impersonate user

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x8a0
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x8a0], rbx
mov rax, qword [0x180183c70]
xor rax, rbp
mov qword [rbp + 0x850], rax
mov r12, qword [rbp + 0x8c0]
lea eax, [rcx + 0xe]
mov esi, dword [rbp + 0x28]
mov r15, r9
mov edi, dword [rbp + 0x28]
mov r10, r8
mov qword [rbp + 0x50], r9
mov r11, rdx
mov qword [rbp + 0x40], r8
mov r13d, ecx
mov qword [rbp + 0x38], rdx
mov dword [rbp + 0x58], ecx
mov qword [rbp + 0x80], r12
mov dword [rbp + 0xa0], eax
mov qword [rbp + 0x90], rsi
cmp ecx, eax
jae 0x18000a6c0
mov eax, dword [rbp + 0x28]
mov r8, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x48]
mov ebx, dword [rbp + 0x40]
mov dword [rbp + 0x30], eax
movzx eax, byte [rbp + 8]
mov byte [rbp], al
mov qword [rbp + 0x98], r8
mov qword [rbp + 0x88], rdx
lea eax, [r13 - 0x5a]
mov r14d, 0x6567
mov r9d, 0x5f74
cmp eax, 0x46
ja case.0x180009ea6.92
lea rcx, [0x180000000]
movzx eax, byte [rcx + rax + 0xbba4]
mov ecx, dword [rcx + rax*4 + 0xbb68]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov r8d, 5
mov byte [rbp + 0x344], 0
lea rdx, [0x18016939d]
lea rcx, [rbp + 0x344]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp case.0x180009ea6.92
mov r9d, 0x2f
xor r8d, r8d
xor edx, edx
mov rcx, r12
call fcn.1800aa6a0
cmp al, 4
je 0x18000a13e
mov r13, qword [rbp + 0x50]
mov r15d, 0xac
nop dword [rax]
nop word [rax + rax]
mov eax, r15d
sub eax, 0xab
je 0x18000a0f8
cmp eax, 1
jne 0x18000a123
lea r9d, [rax + 0x2e]
xor r8d, r8d
xor edx, edx
mov rcx, r12
call fcn.1800aa6a0
cmp al, 0xa
jne 0x180009f74
mov r12, qword [r12]
mov r9d, 0x2f
add r12, 8
xor r8d, r8d
mov rcx, r12
mov qword [rbp + 0x80], r12
xor edx, edx
call fcn.1800aa6a0
cmp al, 4
jne 0x180009f74
mov ecx, 0x33
mov eax, ecx
sub eax, 0x33
je 0x180009f69
cmp eax, 1
je 0x18000a142
jmp 0x180009f6d
mov edi, dword [r12]
inc ecx
cmp ecx, 0x35
jb 0x180009f57
mov r9d, 0x2f
xor r8d, r8d
xor edx, edx
mov rcx, r12
call fcn.1800aa6a0
mov r14, qword [rbp + 0x38]
cmp al, 8
jne 0x18000a088
cmp r12, r14
jne 0x18000a088
mov rax, qword [r12]
mov rcx, qword [rax + 0x18]
cmp qword [rcx + 0x48], 0
je 0x18000a088
cmp qword [rcx + 0x50], 0
je 0x18000a088
mov r14d, 5
cmp r14d, 5
ja case.default.0x180009fde
lea rdx, [0x180000000]
mov eax, r14d
mov ecx, dword [rdx + rax*4 + 0xbbec]
add rcx, rdx
jmp rcx
mov rcx, qword [rbp + 0x78]
xor r8d, r8d
mov edx, 0xa4
call fcn.1800394a0
jmp case.default.0x180009fde
mov r13, qword [rbp + 0x78]
xor r8d, r8d
mov r9, qword [rbp + 0x50]
mov rdx, r13
mov qword [rsp + 0x20], r13
lea ecx, [r8 + 0x5a]
call fcn.180009dd0
mov rbx, rax
jmp case.default.0x180009fde
mov rax, qword [r12]
mov rcx, r12
mov rdx, qword [rbp + 0x78]
mov r8, qword [rax + 0x18]
call qword [r8 + 0x50]
jmp case.default.0x180009fde
mov dword [rbp + 0x60], ebx
jmp case.default.0x180009fde
mov rax, qword [r12]
lea rdx, [rbp + 0x378]
mov rcx, r12
mov r8, qword [rax + 0x18]
call qword [r8 + 0x48]
mov r13, rax
mov qword [rbp + 0x78], rax
test byte [rax + 9], 4
je case.default.0x180009fde
xor eax, eax
mov r9, r13
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, 0xb5
mov qword [rsp + 0x20], rax
xor ecx, ecx
call fcn.180050770
dec r14d
lea eax, [r14 + 0xd]
cmp eax, 0xc
ja 0x180009fc0
mov r13, qword [rbp + 0x50]
jmp 0x18000a123
mov r9d, 0x2f
xor r8d, r8d
xor edx, edx
mov rcx, r12
call fcn.1800aa6a0
cmp al, 8
jne 0x18000a123
mov rax, qword [r12]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0xd0]
test rax, rax
je 0x18000a123
mov r9, r13
mov r8, r12
mov rdx, r14
mov cl, 7
call rax
test eax, eax
jne 0x18000a123
mov ecx, 0x93
nop dword [rax]
mov eax, ecx
sub eax, 0x93
je 0x18000a0e4
cmp eax, 0x4c
je case.0x18000b6de.0
jmp 0x18000a0eb
mov dword [rbp + 0x60], 0
add ecx, 0x4c
cmp ecx, 0x12b
jb 0x18000a0d0
jmp 0x18000a123
xor eax, eax
mov r9, r12
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], 0x9d
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.180057310
mov rdi, rax
dec r15d
cmp r15d, 0xaa
ja 0x180009f00
mov r13d, 0x5a
jmp case.0x180009ea6.92
mov edi, dword [r12]
mov r13d, 0x5a
jmp case.0x180009ea6.92
mov qword [rbp + 0x48], r8
lea rcx, [rdx + 0x18]
lea r8, [r11 + 0x18]
mov edx, 0x126
lea r9, [rbp + 0x48]
call fcn.1800c06b0
mov dword [r15], 0
jmp case.0x180009ea6.92
mov r14d, 0xb2
nop dword [rax]
cmp r14d, 0xb2
je 0x18000a198
cmp r14d, 0x16f2
je case.0x18000b6de.0
jmp 0x18000a1a2
call qword [0x1801822a8]
mov qword [rbp + 0x60], rax
add r14d, 0x1640
cmp r14d, 0x2c80
jbe 0x18000a180
mov eax, dword [0x1801693f3]
mov dword [rbp + 0x349], eax
movzx eax, byte [0x1801693f7]
mov byte [rbp + 0x34d], al
jmp case.0x180009ea6.92
mov word [rbp + 0x342], r9w
jmp case.0x180009ea6.92
xor eax, eax
mov dword [rbp + 0x30], eax
jmp case.0x180009ea6.92
mov byte [rbp + 0x34e], 0
jmp case.0x180009ea6.92
mov byte [rbp + 8], 0x7d
jmp 0x18000a5c9
mov r9d, 0x2f
xor r8d, r8d
xor edx, edx
mov rcx, r15
call fcn.1800aa6a0
cmp al, 4
je 0x18000a356
mov r15d, 0x111
nop dword [rax]
cmp r15d, 0x111
je 0x18000a26e
cmp r15d, 0x19a
jne 0x18000a33d
mov r9, qword [rbp + 0x50]
xor eax, eax
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], 0x9d
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.180057310
mov rsi, rax
mov qword [rbp + 0x90], rax
jmp 0x18000a33d
mov r14, qword [rbp + 0x50]
mov r9d, 0x2f
mov rcx, r14
xor r8d, r8d
xor edx, edx
call fcn.1800aa6a0
cmp al, 0xa
jne 0x18000a2d7
mov r14d, 0x6f
nop
mov eax, r14d
sub eax, 0x6e
je 0x18000a2ae
cmp eax, 1
jne 0x18000a2ca
mov rax, qword [rbp + 0x50]
mov rax, qword [rax]
add rax, 8
mov qword [rbp + 0x50], rax
jmp 0x18000a2ca
mov rcx, qword [rbp + 0x50]
mov r9d, 0x2f
xor r8d, r8d
xor edx, edx
call fcn.1800aa6a0
cmp al, 4
je 0x18000a620
dec r14d
cmp r14d, 0x6d
ja 0x18000a290
mov r14, qword [rbp + 0x50]
mov r9d, 0x2f
xor r8d, r8d
xor edx, edx
mov rcx, r14
call fcn.1800aa6a0
cmp al, 8
jne 0x18000a33d
mov rax, qword [r14]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0xd0]
test rax, rax
je 0x18000a33d
mov rdx, qword [rbp + 0x38]
mov r9, r14
mov r8, r12
mov cl, 7
call rax
test eax, eax
jne 0x18000a33d
mov eax, 0x32
cmp eax, 0x32
je 0x18000a32a
cmp eax, 0xc80
je case.0x18000b6de.0
jmp 0x18000a331
mov dword [rbp + 0x60], 0
add eax, 0xc4e
cmp eax, 0x189c
jbe 0x18000a318
add r15d, 0x89
cmp r15d, 0x223
jb 0x18000a220
jmp case.0x180009ea6.92
mov esi, dword [r15]
mov qword [rbp + 0x90], rsi
jmp case.0x180009ea6.92
mov word [rbp + 0x340], r14w
jmp case.0x180009ea6.92
mov eax, dword [r10]
lea r9, [rbp + 0x68]
mov dword [rbp + 0x28], eax
mov r8, r11
lea rax, [rbp + 0x28]
mov dword [rbp + 0x68], 0
mov rdx, r12
mov qword [rsp + 0x20], rax
mov ecx, 0xaa
call fcn.180084cc0
jmp case.0x180009ea6.92
mov rcx, qword [r11 + 0x10]
mov r14d, 0xcd
mov rsi, qword [rbp + 0x88]
movabs r12, 0xffffffffffffff0
mov qword [rbp + 0x98], rcx
nop dword [rax]
nop word [rax + rax]
mov eax, r14d
sub eax, 0xcb
je 0x18000a479
sub eax, 1
je 0x18000a459
cmp eax, 1
jne 0x18000a47d
lea rax, [rcx + 0x20]
and rax, 0xfffffffffffffff8
cmp rax, 0x8000
seta byte [rbp]
jbe 0x18000a42a
lea rdx, [rbp + 0xc0]
mov qword [rbp + 0xc0], rax
mov ecx, 0x123
call fcn.18001bc40
mov rcx, qword [rbp + 0x98]
mov rsi, rax
mov dword [rax], 1
jmp 0x18000a47d
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x18000a436
mov rcx, r12
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.18015c450
sub rsp, rcx
mov rcx, qword [rbp + 0x98]
lea rsi, [rsp + 0x40]
mov dword [rsi], 1
jmp 0x18000a47d
xor r8d, r8d
mov dword [rsi + 4], 6
mov rdx, rsi
mov ecx, 0x8e
call fcn.1800d6c00
mov rcx, qword [rbp + 0x98]
jmp 0x18000a47d
mov qword [rsi + 0x10], rcx
dec r14d
cmp r14d, 0xca
ja 0x18000a3d0
mov r12, qword [rbp + 0x80]
mov qword [rbp + 0x88], rsi
mov rsi, qword [rbp + 0x90]
jmp case.0x180009ea6.92
movzx eax, word [r12]
cmp ax, 0x40
jne 0x18000a5b7
mov r15d, 0xdd
nop dword [rax]
mov eax, r15d
sub eax, 0xdd
je 0x18000a585
cmp eax, 1
jne 0x18000a5a1
mov r14, qword [rbp + 0x70]
lea r9d, [rax + 0x2e]
mov rcx, r14
xor r8d, r8d
xor edx, edx
call fcn.1800aa6a0
cmp al, 6
jne 0x18000a5a1
mov rcx, qword [r14]
lea r9, [rbp + 0x48]
mov qword [rsp + 0x28], 0
xor edx, edx
mov r8d, 0x12d
mov rax, qword [rcx + 0x10]
mov qword [rbp + 0x48], rax
lea rax, [rcx + 0x18]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.1800b61d0
test eax, eax
je 0x18000a5a1
mov r14d, 0xfb
nop
mov eax, r14d
sub eax, 0xfb
je 0x18000a545
cmp eax, 0x60
je case.0x18000b6de.0
jmp 0x18000a576
mov rax, qword [rbp + 0x70]
lea r8, [rbp + 8]
mov rcx, qword [rbp + 0x38]
mov r9d, 0xa1
xor edx, edx
mov byte [rbp + 8], 0
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call fcn.1800a74e0
add r14d, 0x60
cmp r14d, 0x1bb
jb 0x18000a530
jmp 0x18000a5a1
xor r9d, r9d
mov dword [rsp + 0x20], 0xc6
xor r8d, r8d
mov rdx, r12
xor ecx, ecx
call fcn.180121cc0
mov qword [rbp + 0x70], rax
inc r15d
cmp r15d, 0xdf
jb 0x18000a4c0
mov r11, qword [rbp + 0x38]
jmp 0x18000a5c5
mov ecx, 0x100
cmp ax, cx
je 0x18000a690
mov byte [rbp + 8], 0x7b
mov r9d, 0x52
mov byte [rbp + 0x18], 0
lea r8, [rbp + 8]
mov rcx, r11
lea rdx, [rbp + 0x18]
call fcn.1800ffd70
mov r15, qword [rbp + 0x50]
inc r13d
mov r10, qword [rbp + 0x40]
mov r11, qword [rbp + 0x38]
cmp r13d, dword [rbp + 0xa0]
jae 0x18000a6e5
mov rdx, qword [rbp + 0x88]
mov r8, qword [rbp + 0x98]
jmp 0x180009e6d
mov rax, qword [rbp + 0x50]
mov r12, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x48]
mov r13, qword [rbp + 0x48]
mov esi, dword [rax]
mov rax, qword [rbp + 0x48]
mov r11, qword [rbp + 0x38]
mov qword [rbp + 0x70], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x90], rsi
mov qword [rbp + 0xa8], r12
mov qword [rbp + 0xb0], rcx
mov r14d, 0x5a
cmp qword [rbp + 0x80], r11
jne 0x18000a98c
xor r9d, r9d
mov dword [rsp + 0x20], 0xce
xor r8d, r8d
xor edx, edx
mov rcx, r11
call fcn.18013b910
jmp 0x18000a988
mov eax, dword [r10]
lea r9, [rbp + 0x68]
mov dword [rbp + 0x68], eax
mov r8d, 0x6d
lea rax, [rbp + 0x28]
mov dword [rbp + 0x28], 0
mov rdx, r11
mov qword [rsp + 0x20], rax
mov rcx, r12
call fcn.1800b8a80
jmp case.0x18000b6de.0
mov rax, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x48]
movzx edx, byte [rbp + 8]
mov qword [rbp + 0x98], rax
mov eax, dword [rbp + 0x28]
mov dword [rbp + 0x30], eax
mov qword [rbp + 0x88], rcx
mov byte [rbp], dl
jmp 0x18000a6f0
mov rcx, qword [rbp + 0x88]
movzx edx, byte [rbp]
mov r12, qword [rbp + 0x48]
mov rbx, qword [rbp + 0x48]
mov r8, qword [rbp + 0x48]
mov r9, qword [rbp + 0x48]
mov eax, dword [rbp + 0x58]
mov r14d, eax
mov r13, qword [rbp + 0x48]
mov qword [rbp + 0xa8], r12
mov qword [rbp + 0x70], rbx
mov qword [rbp + 0x78], r8
mov qword [rbp + 0xb0], r9
add eax, 0x75f
mov dword [rbp + 0x5c], r14d
cmp r14d, eax
jae 0x18000af8c
cmp r14d, 0x17c
ja 0x18000aeaa
je 0x18000ae87
cmp r14d, 0xeb
ja 0x18000ae0c
je 0x18000ade6
mov eax, r14d
sub eax, 0x5a
je 0x18000a65b
sub eax, 0x22
je 0x18000add5
sub eax, 0x22
je 0x18000a8c1
cmp eax, 0x2b
jne 0x18000a990
cmp esi, 0x20
jb 0x18000a879
test esi, esi
jle 0x18000a801
mov edx, 0x124
cmp edx, 0x124
je 0x18000a7b8
cmp edx, 0x5468
je 0x18000a7af
cmp edx, 0xa7ac
je case.0x18000b6de.0
jmp 0x18000a7f1
mov dword [rbp + 0x60], 0
jmp 0x18000a7f1
mov ecx, 0x11d
nop dword [rax]
mov eax, ecx
sub eax, 0x11d
je 0x18000a7d8
cmp eax, 1
jne 0x18000a7e3
mov dword [r8 + 8], 4
jmp 0x18000a7e3
mov eax, edi
mov r8, r11
sar eax, 0x1f
mov dword [r11], eax
inc ecx
cmp ecx, 0x11f
jb 0x18000a7c0
mov qword [rbp + 0x78], r8
add edx, 0x5344
cmp edx, 0xf9cc
jbe 0x18000a791
jmp 0x18000a879
mov ebx, 0x9a
mov eax, ebx
sub eax, 0x9a
je 0x18000a820
cmp eax, 0x1b
jne 0x18000a867
mov dword [rbp + 0x60], 0xffffffff
jmp case.0x18000b6de.0
cmp qword [0x1801d5a60], 0
je 0x18000a84a
cmp byte [0x1801d4ee9], 0
jne 0x18000a84a
mov rcx, qword [0x1801d4d88]
lea r8, str.MrtGetDefaultPlatformVersion
xor edx, edx
call fcn.18013dc10
jmp 0x18000a85b
lea rdx, str.Creating_registry_entry__key
mov ecx, 1
call fcn.1800eba40
mov r11, qword [rbp + 0x38]
mov dword [r11 + 8], 0
add ebx, 0x1b
cmp ebx, 0xd0
jb 0x18000a806
mov r9, qword [rbp + 0xb0]
mov edx, 0x118
nop
mov eax, edx
sub eax, 0x118
je 0x18000a8a8
sub eax, 1
je 0x18000a89d
cmp eax, 1
jne 0x18000a8ab
mov dword [r9 + 8], 4
jmp 0x18000a8ab
mov eax, edi
mov ecx, esi
sar eax, cl
mov dword [r9], eax
jmp 0x18000a8ab
mov r9, r11
inc edx
cmp edx, 0x11b
jb 0x18000a880
mov qword [rbp + 0xb0], r9
jmp 0x18000a98c
mov rax, qword [rcx + 0x10]
cmp rax, 4
jne 0x18000a9ba
cmp dword [rcx + 0x18], 0x666c6573
jne 0x18000abe4
cmp qword [0x1801d5a68], 0
jne 0x18000a910
test r10, r10
je 0x18000a990
lea r8, str._____msg.autoinstall.win_enterprise__Enterprise
xor edx, edx
lea ecx, [rax + 0x7d]
call fcn.18001c500
mov r10, qword [rbp + 0x40]
mov r11, qword [rbp + 0x38]
mov qword [r10], rax
jmp 0x18000a990
mov r12, qword [rbp + 0x80]
mov ebx, 0x3f
nop dword [rax]
mov eax, ebx
sub eax, 0x3f
je 0x18000a958
cmp eax, 1
jne 0x18000a97a
cmp qword [r12 + 0x20], 0
jne 0x18000a94f
mov r8, qword [0x1801d5a60]
xor r9d, r9d
xor edx, edx
mov ecx, 0x135
call fcn.180020350
mov qword [r12 + 0x20], rax
mov dword [rbp + 0x30], 1
jmp 0x18000a97a
mov rcx, qword [0x1801d5a60]
mov edx, 0x119
call fcn.1800f5540
mov qword [r12 + 0x18], rax
mov rax, qword [0x1801d5a68]
mov qword [r12 + 0x10], rax
inc ebx
cmp ebx, 0x41
jb 0x18000a920
mov r12, qword [rbp + 0xa8]
mov r11, qword [rbp + 0x38]
mov r10, qword [rbp + 0x40]
mov r8, qword [rbp + 0x78]
add r14d, 0x6f
mov rbx, qword [rbp + 0x70]
mov r9, qword [rbp + 0xb0]
mov r15, qword [rbp + 0x50]
mov rcx, qword [rbp + 0x88]
movzx edx, byte [rbp]
mov eax, dword [rbp + 0x58]
jmp 0x18000a720
cmp rax, 6
jne 0x18000abe4
cmp dword [rcx + 0x18], 0x65726170
jne 0x18000aacf
cmp word [rcx + 0x1c], 0x746e
jne 0x18000aacf
cmp qword [0x1801d5a68], 0
jne 0x18000aa0a
test r10, r10
je 0x18000a990
lea r8, str.uchar4___OVERLOADABLE___convert_uchar_rtn_ushort4__
xor edx, edx
lea ecx, [rax + 0x7b]
call fcn.18001c500
mov r10, qword [rbp + 0x40]
mov qword [r10], rax
mov r11, qword [rbp + 0x38]
jmp 0x18000a990
mov rax, qword [0x1801d5a68]
cmp qword [rax + 0x10], 0
jne 0x18000aa44
test r10, r10
je 0x18000a990
lea r8, str.int___OVERLOADABLE___atom_xchg___local_volatile__int___int__
xor edx, edx
mov ecx, 0x81
call fcn.18001c500
mov r10, qword [rbp + 0x40]
mov r11, qword [rbp + 0x38]
mov qword [r10], rax
jmp 0x18000a990
mov r12, qword [rbp + 0x80]
mov ebx, 0x55
mov eax, ebx
sub eax, 0x52
je 0x18000aabc
sub eax, 1
je 0x18000aa90
sub eax, 1
je 0x18000aa7e
cmp eax, 1
jne 0x18000aac3
mov rcx, qword [0x1801d5a60]
mov edx, 0x119
call fcn.1800f5540
mov qword [r12 + 0x18], rax
jmp 0x18000aac3
mov rax, qword [0x1801d5a68]
mov rcx, qword [rax + 0x10]
mov qword [r12 + 0x10], rcx
jmp 0x18000aac3
cmp qword [r12 + 0x20], 0
jne 0x18000aab3
mov r8, qword [0x1801d5a60]
xor r9d, r9d
xor edx, edx
mov ecx, 0x135
call fcn.180020350
mov qword [r12 + 0x20], rax
mov dword [r15], 1
jmp 0x18000aac3
mov dword [rbp + 0x30], 1
dec ebx
cmp ebx, 0x51
ja 0x18000aa50
jmp 0x18000a981
cmp dword [rcx + 0x18], 0x74617473
jne 0x18000abe4
cmp word [rcx + 0x1c], 0x6369
jne 0x18000abe4
mov r14d, 0x11e
nop
mov eax, r14d
sub eax, 0x11e
je 0x18000aba4
cmp eax, 1
jne 0x18000abbc
test r12, r12
jne 0x18000ab34
test r10, r10
je 0x18000abbc
lea r8, str.VMODL_CONVERTER_PARAMS_STORAGE_PARAMS_COMPRESSEDVMDK
xor edx, edx
mov ecx, 0x81
call fcn.18001c500
mov r10, qword [rbp + 0x40]
mov qword [r10], rax
jmp 0x18000abbc
mov ebx, 0xb3
nop dword [rax]
mov eax, ebx
sub eax, 0xb3
je 0x18000ab85
sub eax, 1
je 0x18000ab5b
cmp eax, 1
jne 0x18000ab94
mov dword [r15], eax
mov dword [rbp + 0x30], eax
jmp 0x18000ab94
mov r15, qword [rbp + 0x80]
cmp qword [r15 + 0x20], 0
jne 0x18000ab94
mov r8, qword [0x1801d5a60]
xor r9d, r9d
xor edx, edx
mov ecx, 0x135
call fcn.180020350
mov qword [r15 + 0x20], rax
jmp 0x18000ab94
mov r15, qword [rbp + 0x80]
mov qword [r15 + 0x18], r12
mov qword [r15 + 0x10], r12
mov r15, qword [rbp + 0x50]
inc ebx
cmp ebx, 0xb6
jb 0x18000ab40
jmp 0x18000abb8
mov rcx, qword [0x1801d5a60]
mov edx, 0x119
call fcn.1800f5540
mov r12, rax
mov r10, qword [rbp + 0x40]
mov r15, qword [rbp + 0x50]
inc r14d
cmp r14d, 0x120
jb 0x18000aaf0
mov r14d, dword [rbp + 0x5c]
mov r11, qword [rbp + 0x38]
mov qword [rbp + 0xa8], r12
jmp 0x18000a990
xor r8d, r8d
mov dword [rbp + 0x28], 1
mov r9, r11
lea rdx, [rbp + 0x28]
lea ecx, [r8 + 0x6a]
call fcn.18011c7c0
mov r15, rax
test rax, rax
je 0x18000ad9e
mov r12, qword [rbp + 0x80]
mov r14d, 0x10d
mov rsi, qword [rbp + 0x50]
nop dword [rax + rax]
mov ecx, r14d
sub ecx, 0x109
je 0x18000ad77
sub ecx, 1
je 0x18000aca2
sub ecx, 1
je 0x18000ac98
sub ecx, 1
je 0x18000ac77
cmp ecx, 1
jne 0x18000ad7e
mov r13, qword [0x1801d5a60]
test r13, r13
je 0x18000ad7e
mov rax, qword [r13 + 0x18]
test rax, rax
je 0x18000ac69
test byte [rax], 1
je 0x18000ad7e
mov r13, qword [r13 + 0x38]
test r13, r13
jne 0x18000ac57
jmp 0x18000ad7e
test r13, r13
je 0x18000ac8d
mov rax, qword [r13 + 0x18]
mov rbx, qword [rax + 0x10]
mov qword [rbp + 0x70], rbx
jmp 0x18000ad7e
xor ebx, ebx
mov qword [rbp + 0x70], rbx
jmp 0x18000ad7e
mov qword [r12 + 0x10], r15
jmp 0x18000ad7e
test rbx, rbx
je 0x18000ad4a
cmp qword [r12 + 0x20], 0
jne 0x18000ad4a
mov r8, qword [0x1801d5a60]
xor r9d, r9d
xor edx, edx
mov ecx, 0x135
call fcn.180020350
mov rbx, rax
test rax, rax
je 0x18000ad34
mov r9, qword [rbp + 0x70]
xor r8d, r8d
mov rdx, qword [rax + 0x10]
mov ecx, 0x117
mov qword [rsp + 0x20], 0
call fcn.1800cc9c0
test al, al
je 0x18000ad34
mov r9, qword [r12 + 0x10]
xor r8d, r8d
mov rdx, qword [rbp + 0x70]
mov ecx, 0x117
mov qword [rsp + 0x20], 0
call fcn.1800cc9c0
test al, al
je 0x18000ad34
mov qword [r12 + 0x20], rbx
mov rax, qword [rbx + 0x10]
mov rbx, qword [rbp + 0x70]
mov qword [r12 + 0x18], rax
mov dword [rsi], 1
jmp 0x18000ad7e
mov rax, qword [r12 + 0x10]
mov rbx, qword [rbp + 0x70]
mov qword [r12 + 0x18], rax
mov dword [rsi], 1
jmp 0x18000ad7e
mov rax, qword [r12 + 0x20]
test rax, rax
je 0x18000ad65
mov rcx, qword [rax + 0x10]
mov qword [r12 + 0x18], rcx
mov dword [rsi], 1
jmp 0x18000ad7e
mov rcx, qword [r12 + 0x10]
mov qword [r12 + 0x18], rcx
mov dword [rsi], 1
jmp 0x18000ad7e
mov dword [rbp + 0x30], 1
dec r14d
cmp r14d, 0x108
ja 0x18000ac20
mov rsi, qword [rbp + 0x90]
mov r14d, dword [rbp + 0x5c]
jmp 0x18000a981
mov r10, qword [rbp + 0x40]
test r10, r10
je 0x18000aa04
mov rax, qword [rbp + 0x38]
lea r8, str.org.gnu.gdb.mips.linux
mov r9, qword [rbp + 0x98]
add rax, 0x18
xor edx, edx
mov qword [rsp + 0x20], rax
mov rcx, r10
call fcn.18012c010
jmp 0x18000a988
mov eax, 0x694c
mov word [rbp + 0x34e], ax
jmp 0x18000a990
mov r8d, 3
mov byte [rbp + 0x350], 0
lea rdx, [0x1801695c9]
lea rcx, [rbp + 0x340]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x18000a988
mov eax, r14d
sub eax, 0x10d
je 0x18000ae6b
sub eax, 0x2b
je 0x18000ae35
cmp eax, 0x22
jne 0x18000a990
mov eax, 0x6f43
mov word [rbp + 0x353], ax
jmp 0x18000a990
mov eax, 0x1c
nop word [rax + rax]
cmp eax, 0x1c
je 0x18000ae50
cmp eax, 0x31
je case.0x18000b6de.0
jmp 0x18000ae57
mov dword [rbp + 0x60], 0
add eax, 0x15
cmp eax, 0x46
jb 0x18000ae40
mov byte [rbp + 0x32a], 0
jmp 0x18000a990
test dl, dl
je 0x18000a990
mov r8, rcx
mov edx, 0xcd
xor ecx, ecx
call fcn.1800055b0
jmp 0x18000a988
mov eax, 0x28
nop dword [rax]
cmp eax, 0x28
je 0x18000af81
add eax, 0xf00
cmp eax, 0xf00
jbe 0x18000ae90
jmp 0x18000a990
cmp r14d, 0x385
ja 0x18000af1d
je 0x18000af11
mov eax, r14d
sub eax, 0x1c9
je 0x18000af05
sub eax, 0x6f
je 0x18000aeef
sub eax, 0x6f
je 0x18000aee1
cmp eax, 0x6f
jne 0x18000a990
mov dword [rbp + 0x320], 0x5f444642
jmp 0x18000a990
mov word [rbp + 0x359], 0x6c
jmp 0x18000a990
mov dword [rbp + 0x355], 0x6f72746e
mov byte [rbp + 0x359], 0
jmp 0x18000a990
mov byte [rbp + 0x355], 0
jmp 0x18000a990
mov byte [rbp + 0x324], 0
jmp 0x18000a990
mov eax, r14d
sub eax, 0x3f4
je 0x18000af61
sub eax, 0x6f
je 0x18000af41
cmp eax, 0x6f
jne 0x18000a990
mov byte [rbp + 0x32a], 0
jmp 0x18000a990
movzx eax, word [0x180169417]
mov word [rbp + 0x327], ax
movzx eax, byte [0x180169419]
mov byte [rbp + 0x329], al
jmp 0x18000a990
movzx eax, word [0x180169584]
mov word [rbp + 0x324], ax
movzx eax, byte [0x180169586]
mov byte [rbp + 0x326], al
jmp 0x18000a990
mov eax, dword [rbp + 0x30]
mov dword [rbp + 0x60], eax
jmp case.0x18000b6de.0
mov r14d, dword [rbp + 0x58]
lea eax, [r14 - 0xe]
cmp r14d, eax
jbe 0x18000b11f
mov edi, 0xe
lea ebx, [r14 - 0x6f]
mov r15d, 0x7075
lea esi, [rdi + 0x20]
lea r12d, [rdi + 0x69]
cmp ebx, 0xd
ja case.default.0x18000afcd
lea rdx, [0x180000000]
mov ecx, dword [rdx + rbx*4 + 0xbc04]
add rcx, rdx
jmp rcx
mov byte [rbp + 0x332], 0x43
jmp case.default.0x18000afcd
mov dword [rbp + 0x388], 0x53415357
jmp case.default.0x18000afcd
mov word [rbp + 0x32a], 0x52
jmp case.default.0x18000afcd
mov byte [rbp + 0x333], 0
jmp case.default.0x18000afcd
mov r8d, 3
lea rdx, [0x1801695eb]
lea rcx, [rbp + 0x320]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 2
lea rdx, [0x1801695fe]
lea rcx, [rbp + 0x320]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp case.default.0x18000afcd
xor eax, eax
mov word [rbp + 0x3ac], ax
jmp case.default.0x18000afcd
mov dword [rbp + 0x32e], 0x56525f56
jmp case.default.0x18000afcd
xor eax, eax
lea rdx, [0x180169630]
lea rcx, [rbp + 0x398]
mov word [rbp + 0x39a], ax
lea r8d, [rax + 5]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp case.default.0x18000afcd
lea rcx, [rbp + 0x360]
mov byte [rbp + 0x360], 0
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18000b091
movzx eax, word [0x180169650]
mov word [rcx], ax
jmp case.default.0x18000afcd
mov word [rbp + 0x3a4], si
jmp case.default.0x18000afcd
mov eax, dword [0x1801696d0]
mov dword [rbp + 0x3a6], eax
movzx eax, word [0x1801696d4]
mov word [rbp + 0x3aa], ax
jmp case.default.0x18000afcd
movzx eax, word [0x180169730]
mov word [rbp + 0x32b], ax
movzx eax, byte [0x180169732]
mov byte [rbp + 0x32d], al
mov byte [rbp + 0x32e], 0
jmp case.default.0x18000afcd
mov dword [rbp + 0x38c], 0x74726174
mov word [rbp + 0x390], r15w
jmp case.default.0x18000afcd
mov byte [rbp + 0x392], 0
mov word [rbp + 0x398], r12w
dec ebx
sub rdi, 1
jne 0x18000afb3
cmp r14d, dword [rbp + 0xa0]
jae case.0x18000b6de.0
mov r13, qword [rbp + 0x78]
mov edi, 0x75
movzx r15d, byte [rbp]
mov ebx, 0x7371
mov r12d, dword [rbp + 0x30]
movabs r8, 0x6973736553796f
lea edx, [rdi - 7]
lea r9d, [rdi - 3]
nop dword [rax]
nop dword [rax + rax]
lea eax, [r14 - 0x7c]
cmp eax, 0xd
ja case.0x18000b17f.129
lea r10, [0x180000000]
mov ecx, dword [r10 + rax*4 + 0xbc3c]
add rcx, r10
jmp rcx
mov ecx, 0x202
mov dword [rbp + 0x40], 5
lea rdx, [rbp + 0x180]
call qword [rbp + 0xf0]
test eax, eax
je 0x18000b5c9
mov esi, 0x35
mov dword [rbp + 0x58], esi
nop word [rax + rax]
cmp esi, 0xd53e
ja 0x18000b29f
je 0x18000b290
cmp esi, 0x5b82
ja 0x18000b229
je 0x18000b21d
cmp esi, 0x35
je 0x18000b200
cmp esi, 0x1ea4
je 0x18000b1f1
cmp esi, 0x3d13
jne 0x18000b5b4
mov word [rbp + 0x37e], bx
jmp 0x18000b5b4
mov dword [rbp + 0x37a], 0x5f316275
jmp 0x18000b5b4
mov eax, 0x71
mov word [rbp + 0x378], ax
mov eax, 0x73
mov word [rbp + 0x379], ax
jmp 0x18000b5b4
mov word [rbp + 0x380], di
jmp 0x18000b5b4
cmp esi, 0x79f1
je 0x18000b27f
cmp esi, 0x9860
je 0x18000b26a
cmp esi, 0xb6cf
jne 0x18000b5b4
movups xmm0, xmmword [str.MS.Internal.Media]
movzx eax, word [0x180169758]
mov byte [rbp + 0x10], 1
movups xmmword [rbp + 0x408], xmm0
mov word [rbp + 0x418], ax
jmp 0x18000b5b4
mov eax, 0x32
mov byte [rbp + 0x20], 1
mov word [rbp + 0x382], ax
jmp 0x18000b5b4
mov eax, 0x3f
mov word [rbp + 0x381], ax
jmp 0x18000b5b4
mov dword [rbp + 0xc8], 0x104
jmp 0x18000b5b4
cmp esi, 0x14efa
ja 0x18000b392
je 0x18000b36a
cmp esi, 0xf3ad
je 0x18000b330
cmp esi, 0x1121c
je 0x18000b31c
cmp esi, 0x1308b
jne 0x18000b5b4
mov r9, qword [rbp + 0xe0]
lea rdx, [rbp + 0x420]
mov r8d, dword [rbp + 0xc8]
lea rcx, [rbp + 0x408]
call qword [sym.imp.WINMM.dll_mciSendStringA]
mov r8d, dword [rbp + 0xcc]
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0x378]
mov dword [rbp + 0xb8], eax
call qword [sym.imp.WINMM.dll_mmioOpenA]
mov r13, rax
mov qword [rbp + 0x78], rax
jmp 0x18000b5b4
xor edx, edx
mov qword [rbp + 0xe0], rdx
mov dword [rbp + 0xcc], edx
jmp 0x18000b5b4
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x110], xmm0
mov dword [rbp + 0x170], eax
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
jmp 0x18000b5b4
movzx eax, byte [rbp + 0x20]
xor edx, edx
cmp dword [rbp + 0xb8], edx
mov ecx, edx
cmovne ecx, eax
movzx eax, byte [rbp + 0x10]
mov byte [rbp + 0x20], cl
test r13, r13
mov ecx, edx
cmovne ecx, eax
mov byte [rbp + 0x10], cl
jmp 0x18000b5b4
cmp esi, 0x16d69
je 0x18000b595
cmp esi, 0x18bd8
je 0x18000b3b7
cmp esi, 0x1aa47
je case.0x18000b6de.0
jmp 0x18000b5b4
movzx edx, byte [rbp + 0x10]
test dl, dl
je 0x18000b58f
mov esi, dword [rbp + 0xa8]
mov edi, 0x11e
mov r12d, dword [rbp + 0x5c]
movzx r15d, byte [rbp + 8]
nop word [rax + rax]
mov eax, edi
sub eax, 0x11e
je 0x18000b54c
sub eax, 1
je 0x18000b535
sub eax, 1
je 0x18000b4fe
sub eax, 1
je 0x18000b46b
cmp eax, 1
jne 0x18000b561
test dl, dl
je 0x18000b561
mov ebx, 0x107
nop word [rax + rax]
mov eax, ebx
sub eax, 0x106
je 0x18000b446
cmp eax, 1
jne 0x18000b454
mov r8d, esi
lea rdx, [rbp + 0x3e8]
mov rcx, r13
call qword [sym.imp.WINMM.dll_mmioAscend]
mov dword [rbp + 0x5c], eax
jmp 0x18000b454
mov edx, 0x10
mov rcx, r13
call qword [sym.imp.WINMM.dll_mmioClose]
dec ebx
cmp ebx, 0x105
ja 0x18000b420
mov r12d, dword [rbp + 0x5c]
movzx edx, byte [rbp + 0x10]
jmp 0x18000b561
xor r8d, r8d
movzx eax, dl
test r12d, r12d
mov ecx, r8d
cmove ecx, eax
mov byte [rbp + 0x10], cl
movzx edx, cl
test r15b, r15b
je 0x18000b561
mov r13d, dword [rbp + 0xd8]
mov ebx, 0xea
cmp ebx, 0xea
je 0x18000b4d8
cmp ebx, 0x8832
je 0x18000b4c9
cmp ebx, 0x10f7a
jne 0x18000b4df
mov rcx, qword [rbp + 0xe8]
lea rdx, [rbp + 0xd0]
mov r8d, r13d
call qword [sym.imp.WINMM.dll_mixerGetID]
xor r8d, r8d
jmp 0x18000b4df
mov dword [rbp + 0xd0], r8d
mov r13d, 0x80000000
jmp 0x18000b4df
mov qword [rbp + 0xe8], r8
add ebx, 0x8748
cmp ebx, 0x195d8
jbe 0x18000b495
movzx edx, byte [rbp + 0x10]
mov dword [rbp + 0xd8], r13d
mov r13, qword [rbp + 0x78]
jmp 0x18000b561
mov r9d, esi
lea rdx, [rbp + 0x3e8]
xor r8d, r8d
mov rcx, r13
call qword [sym.imp.WINMM.dll_mmioDescend]
movzx edx, byte [rbp + 0x10]
mov r12d, eax
mov dword [rbp + 0x5c], eax
xor eax, eax
mov ecx, eax
movzx eax, r15b
cmp dword [rbp + 0xb0], ecx
cmovne ecx, eax
movzx r15d, cl
jmp 0x18000b561
mov esi, 0x10
call qword [sym.imp.WINMM.dll_mixerGetNumDevs]
movzx edx, byte [rbp + 0x10]
mov dword [rbp + 0xb0], eax
jmp 0x18000b561
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x3e8], xmm0
mov dword [rbp + 0x3f8], eax
mov r15b, 1
inc edi
cmp edi, 0x123
jb 0x18000b3e0
mov r12d, dword [rbp + 0x30]
mov ebx, 0x7371
mov byte [rbp + 8], r15b
mov edi, 0x75
movzx r15d, byte [rbp]
mov dword [rbp + 0xa8], esi
mov esi, dword [rbp + 0x58]
mov byte [rbp + 0x60], 0
jmp 0x18000b5b4
cmp byte [rbp + 0x20], 0
je 0x18000b5b4
mov ecx, dword [rbp + 0xb8]
lea rdx, [rbp + 0x530]
mov r8d, 0x104
call qword [sym.imp.WINMM.dll_mciGetErrorStringA]
add esi, 0x1e6f
mov dword [rbp + 0x58], esi
cmp esi, 0x1c881
jbe 0x18000b1b0
mov edx, 0x6e
movabs r8, 0x6973736553796f
lea r9d, [rdx + 4]
jmp case.0x18000b17f.129
mov word [rbp + 0x367], r9w
jmp case.0x18000b17f.129
mov eax, dword [str.vcDe]
mov dword [rbp + 0x361], eax
movzx eax, word [0x180169764]
mov word [rbp + 0x365], ax
movzx eax, byte [0x180169766]
mov byte [rbp + 0x367], al
jmp case.0x18000b17f.129
mov word [rbp + 0x370], dx
jmp case.0x18000b17f.129
mov r9d, 0x110
lea rdx, [rbp + 0x388]
xor r8d, r8d
lea rcx, [rbp + 0x398]
call fcn.18002fce0
mov qword [rbp + 0xf0], rax
jmp 0x18000b5c9
mov qword [rbp + 0x368], r8
jmp case.0x18000b17f.129
mov ebx, 0xbb
nop
mov eax, ebx
sub eax, 0xba
je case.0x18000b6de.0
cmp eax, 1
jne 0x18000b684
xor r8d, r8d
mov edx, 0x98
xor ecx, ecx
call fcn.180158260
mov byte [rbp + 0x60], al
dec ebx
cmp ebx, 0xb9
ja 0x18000b660
mov r8, qword [rbp + 0x38]
xor ebx, ebx
mov qword [rsp + 0x28], rbx
mov r9d, 0xe6
xor edx, edx
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call fcn.180127820
test al, al
jne 0x18000b5c9
mov r14d, 8
mov dword [rbp + 0x28], r14d
nop
cmp r14d, 8
ja case.default.0x18000b6de
lea rdx, [0x180000000]
mov eax, r14d
mov ecx, dword [rdx + rax*4 + 0xbc74]
add rcx, rdx
jmp rcx
mov r8d, dword [rbp + 0x90]
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0x3e8]
call qword [sym.imp.WINMM.dll_mmioOpenA]
mov qword [rbp + 0xc0], rax
jmp case.default.0x18000b6de
cmp dword [rbp + 0x98], 0
mov ecx, ebx
movzx eax, r15b
cmovne ecx, eax
movzx eax, byte [rbp + 0x18]
cmp qword [rbp + 0xc0], 0
movzx r15d, cl
mov byte [rbp], cl
mov ecx, ebx
cmovne ecx, eax
mov byte [rbp + 0x18], cl
jmp case.default.0x18000b6de
call qword [sym.imp.WINMM.dll_mixerGetNumDevs]
mov dword [rbp + 0x98], eax
jmp case.default.0x18000b6de
mov dword [rbp + 0x90], ebx
jmp case.default.0x18000b6de
cmp byte [rbp + 0x18], 0
je case.default.0x18000b6de
mov r13, qword [rbp + 0xc0]
mov ebx, 0x5e
nop dword [rax]
cmp ebx, 0x5e
je 0x18000b78d
cmp ebx, 0x3f28
jne 0x18000b7a0
mov edx, 0x10
mov rcx, r13
call qword [sym.imp.WINMM.dll_mmioClose]
jmp 0x18000b7a0
xor r8d, r8d
lea rdx, [rbp + 0x110]
mov rcx, r13
call qword [sym.imp.WINMM.dll_mmioGetInfo]
add ebx, 0x3eca
cmp ebx, 0x7d94
jbe 0x18000b770
mov r13, qword [rbp + 0x78]
jmp case.default.0x18000b6de
mov eax, dword [0x180169780]
movups xmm0, xmmword [str.SelectionP_tternOnInvalidated]
mov dword [rbp + 0x400], eax
movzx eax, word [0x180169784]
movsd xmm1, qword [0x180169778]
movups xmmword [rbp + 0x3e8], xmm0
mov word [rbp + 0x404], ax
mov byte [rbp + 0x18], 1
movsd qword [rbp + 0x3f8], xmm1
jmp case.default.0x18000b6de
xorps xmm0, xmm0
mov r15b, 1
xor eax, eax
mov byte [rbp], r15b
movups xmmword [rbp + 0x110], xmm0
mov dword [rbp + 0x170], eax
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
jmp case.default.0x18000b6de
test r15b, r15b
je 0x18000ba70
mov r13d, dword [rbp + 0x80]
mov edi, 0x10
mov r14d, dword [rbp + 0x70]
lea esi, [rdi + 1]
cmp edi, 0x10
ja case.default.0x18000b86a
mov eax, edi
mov ecx, dword [rdx + rax*4 + 0xbc98]
add rcx, rdx
jmp rcx
mov dword [rbp + 0x3da], 0x74
jmp case.default.0x18000b86a
movabs rax, 0x6e004500650068
mov qword [rbp + 0x3d2], rax
jmp case.default.0x18000b86a
mov r13d, ebx
jmp case.default.0x18000b86a
mov dword [rbp + 0x88], 0x80000000
mov r14d, ebx
jmp case.default.0x18000b86a
mov dword [rbp + 0x68], ebx
jmp case.default.0x18000b86a
mov r8d, 5
lea rdx, str.BackendRuleKey
lea rcx, [rbp + 0x3b0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov word [rbp + 0x3ba], bx
lea rdx, [0x180000000]
jmp case.default.0x18000b86a
mov r8d, dword [rbp + 0x88]
lea rdx, [rbp + 0x68]
mov rcx, qword [rbp + 0xf8]
call qword [sym.imp.WINMM.dll_mixerGetID]
mov r12d, eax
lea rdx, [0x180000000]
jmp case.default.0x18000b86a
mov dword [rbp + 0x3de], 0x79
jmp case.default.0x18000b86a
mov word [rbp + 0x3ce], bx
lea rdx, [0x1801697e4]
mov r8d, 2
lea rcx, [rbp + 0x3b0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
lea rdx, [0x180000000]
jmp case.default.0x18000b86a
mov word [rbp + 0x3da], bx
jmp case.default.0x18000b86a
movzx eax, r15b
test r12d, r12d
mov ecx, ebx
cmove ecx, eax
movzx r15d, cl
jmp case.default.0x18000b86a
movsd xmm0, qword [0x1801698b2]
movzx eax, word [0x1801698ba]
movsd qword [rbp + 0x3bc], xmm0
mov word [rbp + 0x3c4], ax
jmp case.default.0x18000b86a
mov r8d, r13d
lea rcx, [rbp + 0x3b0]
mov edx, r14d
call qword [sym.imp.ADVAPI32.dll_CredDeleteW]
test r15b, r15b
je 0x18000b8d4
mov ebx, 0x17
mov eax, ebx
sub eax, 0x17
je 0x18000b9f9
sub eax, 1
je 0x18000b9db
cmp eax, 1
jne 0x18000b9ff
xor eax, eax
mov ecx, eax
test r12d, r12d
movzx eax, r15b
cmove ecx, eax
movzx r15d, cl
test cl, cl
je 0x18000b9ff
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.WINMM.dll_mixerClose]
jmp 0x18000b9ff
mov edx, dword [rbp + 0x68]
lea rcx, [rbp + 0x48]
xor eax, eax
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], eax
call qword [sym.imp.WINMM.dll_mixerOpen]
mov r12d, eax
jmp 0x18000b9ff
xor eax, eax
mov qword [rbp + 0x48], rax
inc ebx
cmp ebx, 0x1a
jb 0x18000b9a8
xor ebx, ebx
lea rdx, [0x180000000]
jmp case.default.0x18000b86a
mov r8d, 1
lea rdx, [0x18016995c]
jmp 0x18000b92a
movabs rax, 0x43006c006c0061
mov qword [rbp + 0x3c6], rax
jmp case.default.0x18000b86a
mov dword [rbp + 0x3ba], 0x6e
jmp case.default.0x18000b86a
mov qword [rbp + 0xf8], rbx
dec edi
sub rsi, 1
jne 0x18000b855
mov dword [rbp + 0x70], r14d
mov r14d, dword [rbp + 0x28]
mov dword [rbp + 0x80], r13d
mov r13, qword [rbp + 0x78]
mov dword [rbp + 0x30], r12d
mov byte [rbp], r15b
mov byte [rbp + 0x60], 0
dec r14d
mov ebx, 0
mov dword [rbp + 0x28], r14d
lea eax, [r14 + 0x35]
cmp eax, 0x34
ja 0x18000b6c0
mov r14d, dword [rbp + 0x58]
jmp 0x18000b5c9
xor eax, eax
mov dword [rbp + 0xd4], 0x104
mov dword [rbp + 0x50], eax
jmp case.0x18000b17f.129
lea r9, [rbp + 0xd4]
xor ecx, ecx
lea r8, [rbp + 0x640]
lea rdx, [rbp + 0x100]
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameW]
mov r9d, dword [rbp + 0x40]
lea rax, [rbp + 0x108]
mov qword [rsp + 0x28], rax
lea r8, [rbp + 0x360]
mov eax, dword [rbp + 0x50]
lea rdx, [rbp + 0x320]
lea rcx, [rbp + 0x340]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_LogonUserA]
jmp 0x18000b5c9
mov eax, 0x6f
mov word [rbp + 0x36f], ax
jmp case.0x18000b17f.129
xor eax, eax
mov qword [rbp + 0x100], rax
jmp case.0x18000b17f.129
xor eax, eax
mov qword [rbp + 0x108], rax
inc r14d
mov ebx, 0x7371
mov edi, 0x75
mov dword [rbp + 0x58], r14d
cmp r14d, dword [rbp + 0xa0]
jb 0x18000b160
mov rax, qword [rbp + 0x60]
mov rcx, qword [rbp + 0x850]
xor rcx, rbp
call fcn.18015c4c0
mov rbx, qword [rbp + 0x8a0]
lea rsp, [rbp + 0x860]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret