Function at 0x180029240
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x820]
sub rsp, 0x920
mov rax, qword [0x180041118]
xor rax, rsp
mov qword [rbp + 0x818], rax
mov r13, r8
mov rdi, rdx
mov r12d, ecx
mov dword [rsp + 0x40], ecx
movdqa xmm0, xmmword [0x18003d1f0]
movdqa xmmword [rbp + 0x210], xmm0
mov byte [rbp + 0x200], 0
movdqa xmm1, xmm0
movdqa xmmword [rbp + 0x230], xmm0
mov byte [rbp + 0x220], 0
movdqa xmmword [rbp + 0x250], xmm0
mov byte [rbp + 0x240], 0
movdqa xmmword [rbp + 0x280], xmm0
mov byte [rbp + 0x270], 0
movdqa xmmword [rbp + 0x2a0], xmm0
mov byte [rbp + 0x290], 0
xor ebx, ebx
mov qword [rbp + 0x60], rbx
mov word [rbp + 0x68], bx
movdqu xmmword [rbp + 0x7a], xmm0
mov byte [rbp + 0x6a], bl
mov qword [rbp + 0x30], rbx
mov word [rbp + 0x38], bx
movdqu xmmword [rbp + 0x4a], xmm0
mov byte [rbp + 0x3a], bl
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], rbx
movdqa xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x30], rbx
mov qword [rbp + 0xd0], rbx
mov qword [rbp + 0xd8], rbx
mov qword [rbp + 0xe0], rbx
lea ecx, [rbx + 0x30]
call fcn.18003825c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0xd8], rax
mov qword [rbp + 0xe8], rbx
xorps xmm2, xmm2
movsd qword [rbp + 0xf0], xmm2
mov qword [rbp + 0xf8], rbx
mov r15d, 1
mov dword [rbp + 0x100], r15d
mov qword [rbp + 0x108], rbx
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x120], xmm1
movdqa xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], rbx
mov qword [rbp + 0x148], 0xffffffffffffffff
mov dword [rbp + 0x150], ebx
xor eax, eax
movups xmmword [rbp + 0x158], xmm0
movups xmmword [rbp + 0x168], xmm0
movups xmmword [rbp + 0x178], xmm0
movups xmmword [rbp + 0x188], xmm0
mov qword [rbp + 0x198], rax
movdqa xmm0, xmmword [0x18003d1f0]
movdqa xmmword [rbp + 0x1b0], xmm0
mov byte [rbp + 0x1a0], al
mov word [rbp + 0x1c0], bx
mov dword [rbp + 0x1c4], ebx
mov qword [rbp + 0x1c8], rbx
xorps xmm0, xmm0
movaps xmmword [rbp + 0x1d0], xmm0
movsd qword [rbp + 0x1e0], xmm2
mov byte [rbp + 0x1e8], al
mov qword [rbp + 0x1ec], rbx
lea esi, [r12 + 0xf]
lea r10, [0x180000000]
cmp r12d, esi
jae 0x180029966
lea ebx, [r12 - 0x3e]
mov edx, 0x6162
movabs r8, 0x320033005f0032
mov r14d, dword [rsp + 0x58]
nop dword [rax + rax]
cmp ebx, 0x2d
ja case.0x18002946d.15
movzx eax, byte [r10 + rbx + 0x2a414]
mov ecx, dword [r10 + rax*4 + 0x2a3d4]
add rcx, r10
jmp rcx
mov qword [rbp + 0x7bc], r8
xor eax, eax
mov word [rbp + 0x7c4], ax
mov r8, r15
lea rdx, [0x18003ae04]
lea rcx, [rbp + 0x7c4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov edx, 0x6162
movabs r8, 0x320033005f0032
lea r10, [0x180000000]
jmp case.0x18002946d.15
mov r8d, 0xa
lea rdx, [rbp + 0x808]
lea ecx, [r8 + 0x16]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ltow]
movsd xmm0, qword [str..dll]
movsd qword [rbp + 0x80c], xmm0
movzx eax, word [0x18003ae58]
mov word [rbp + 0x814], ax
mov r8d, 2
lea rdx, [0x18003ae66]
lea rcx, [rbp + 0x7b8]
jmp 0x180029490
mov word [rbp + 0x767], 0x72
jmp case.0x18002946d.15
mov word [rbp + 0x768], 0x67
mov r8d, 4
lea rdx, [0x18003af72]
lea rcx, [rbp + 0x740]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x744], 0
jmp 0x180029496
movzx eax, word [0x18003afa8]
mov word [rbp + 0x7ad], ax
movzx eax, byte [0x18003afaa]
mov byte [rbp + 0x7af], al
lea rcx, [rbp + 0x7a8]
dec rcx
nop
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x180029560
mov eax, dword [str.IsSet]
mov dword [rcx], eax
movzx eax, word [0x18003afb0]
mov word [rcx + 4], ax
jmp case.0x18002946d.15
xor eax, eax
mov word [rbp + 0x7c6], ax
jmp case.0x18002946d.15
xor eax, eax
mov word [rbp + 0x800], ax
lea r8d, [rax + 4]
lea rdx, str.ws2_
lea rcx, [rbp + 0x800]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x180029496
mov dword [rbp + 0x762], 0x2e687369
mov byte [rbp + 0x766], 0
mov r8, r15
lea rdx, [0x18003afcf]
lea rcx, [rbp + 0x758]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x180029496
mov dword [rbp + 0x75a], 0x2d636973
jmp case.0x18002946d.15
xor eax, eax
mov r14d, eax
jmp case.0x18002946d.15
mov dword [rbp + 0x75e], 0x6c676e65
mov byte [rbp + 0x762], 0
jmp case.0x18002946d.15
mov r8d, 4
lea rdx, [0x18003aff4]
lea rcx, [rbp + 0x7a8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
movzx eax, word [0x18003aff8]
mov word [rbp + 0x7ab], ax
movzx eax, byte [0x18003affa]
mov byte [rbp + 0x7ad], al
jmp 0x180029496
mov word [rbp + 0x758], dx
inc ebx
lea eax, [rbx + 0x3e]
cmp eax, esi
jb 0x180029450
cmp r12d, esi
jae 0x180029966
lea ebx, [r12 - 0x3e]
mov edx, 0x4132
mov r8d, 0x6c
movabs r9, 0x7200500078006f
mov r12, qword [rsp + 0x60]
mov r15d, dword [rsp + 0x58]
mov r14, qword [rsp + 0x60]
nop dword [rax + rax]
cmp ebx, 0x16
ja case.0x1800296a4.7
mov ecx, dword [r10 + rbx*4 + 0x2a444]
add rcx, r10
jmp rcx
mov dword [rsp + 0x38], 2
mov rax, qword [rdi]
mov qword [rsp + 0x68], rax
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x68]
mov ecx, 0x4d
call fcn.180029240
cmp al, 2
je case.0x1800299ca.28
nop
test al, al
je 0x18002970b
mov dword [rsp + 0x38], 2
mov rax, qword [rdi]
mov qword [rsp + 0x68], rax
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x68]
mov ecx, 0x4d
call fcn.180029240
cmp al, 2
jne 0x1800296d0
mov byte [rsp + 0x38], 1
mov r15d, dword [rsp + 0x38]
jmp 0x18002a13c
mov byte [rsp + 0x38], 0
mov r15d, dword [rsp + 0x38]
jmp 0x18002a13c
mov r8d, 0x91
mov rdx, rdi
xor ecx, ecx
call fcn.180035210
cmp eax, r14d
jb case.0x18002946d.13
xor edx, edx
div dword [r13]
mov r15d, edx
jmp 0x18002a13c
mov eax, dword [r13]
mov dword [rbp - 0x20], eax
jmp case.0x1800296a4.7
mov ecx, dword [rdi]
inc ecx
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x320]
xor r8d, r8d
lea rdx, [rbp + 0x530]
call r12
mov r15d, eax
jmp 0x180029931
cmp r15d, 0xffffffff
je 0x180029818
lea rdx, [rbp + 0x320]
mov rcx, qword [rdi]
call r14
test eax, eax
jne 0x180029818
lea rdx, [rbp + 0x530]
mov rcx, qword [rdi]
call r14
test eax, eax
je 0x180029931
mov byte [rsp + 0x38], 2
mov r15d, dword [rsp + 0x38]
jmp 0x18002a13c
xor eax, eax
mov qword [rbp - 0x20], rax
jmp case.0x1800296a4.7
mov r8d, 3
lea rdx, [0x18003b01e]
lea rcx, [rbp + 0x740]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x180029931
mov dword [rbp + 0x74a], 0x41627553
mov byte [rbp + 0x74e], 0
jmp case.0x1800296a4.7
mov word [rbp + 0x744], dx
mov byte [rbp + 0x746], 0
jmp case.0x1800296a4.7
cmp qword [rdi], 0xffffffffffffffff
jne case.0x1800296a4.7
mov byte [rsp + 0x38], 0
mov r15d, dword [rsp + 0x38]
jmp 0x18002a13c
xor eax, eax
mov word [rbp + 0x7d0], ax
lea r8d, [rax + 5]
lea rdx, [0x18003b056]
jmp 0x180029924
xor eax, eax
mov word [rbp + 0x7cc], ax
lea r8, [rbp + 0x800]
lea edx, [rax + 0x66]
lea rcx, [rbp + 0x7a8]
call fcn.18001c980
mov r14, rax
lea r8, [rbp + 0x7b8]
mov edx, 0x66
lea ecx, [rdx - 0x54]
call fcn.18001c980
mov r12, rax
jmp 0x180029931
mov word [rbp + 0x74e], 0x72
jmp case.0x1800296a4.7
mov rax, qword [rdi]
mov qword [rsp + 0x60], rax
lea r8, [rbp + 0x530]
lea rdx, [rsp + 0x60]
mov ecx, 0x77
call fcn.18001ff40
mov rax, qword [rdi]
mov qword [rsp + 0x60], rax
lea r8, [rbp + 0x320]
lea rdx, [rsp + 0x60]
mov ecx, 0x77
call fcn.18001ff40
jmp 0x180029931
mov dword [rbp + 0x7c6], 0x6c0064
mov word [rbp + 0x7ca], r8w
jmp case.0x1800296a4.7
mov byte [rbp + 0x746], 0x72
movzx eax, word [0x18003b089]
mov word [rbp + 0x747], ax
movzx eax, byte [0x18003b08b]
mov byte [rbp + 0x749], al
mov byte [rbp + 0x74a], 0
jmp case.0x1800296a4.7
mov qword [rbp + 0x7da], r9
xor eax, eax
mov word [rbp + 0x7e2], ax
lea r8d, [rax + 2]
lea rdx, [0x18003b0a8]
lea rcx, [rbp + 0x7d0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov edx, 0x4132
mov r8d, 0x6c
movabs r9, 0x7200500078006f
inc ebx
lea eax, [rbx + 0x3e]
cmp eax, esi
jae 0x18002995b
lea r10, [0x180000000]
jmp 0x180029690
mov r15d, 1
mov r12d, dword [rsp + 0x40]
lea eax, [r12 - 0xf]
mov dword [rsp + 0x44], eax
mov ebx, dword [rsp + 0x38]
cmp r12d, eax
jbe case.0x180029d51.0
lea edi, [r12 - 0x31]
mov dword [rsp + 0x50], edi
mov r8d, 0x1bb
movzx r14d, byte [rsp + 0x30]
movzx r13d, byte [rsp + 0x30]
mov esi, dword [rsp + 0x58]
movzx r12d, byte [rsp + 0x30]
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x44]
nop dword [rax]
cmp edi, 0x1c
ja case.default.0x1800299ca
lea rdx, [0x180000000]
mov ecx, dword [rdx + rdi*4 + 0x2a4a0]
add rcx, rdx
jmp rcx
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [0x18001dda0]
mov qword [rsp + 0x50], rax
mov edx, 0x2c
lea rcx, [rsp + 0x50]
call fcn.1800234d0
xor eax, eax
mov ecx, eax
movzx eax, r14b
cmp qword [rbp - 0x78], rcx
cmovne ecx, eax
movzx r14d, cl
jmp 0x18002a117
mov eax, dword [0x1800410d0]
mov dword [rsp + 0x50], eax
lea r8, [rsp + 0x50]
mov edx, 0x8e
lea rcx, [rbp - 0x70]
call fcn.1800325d0
lea rax, [rbp - 0x70]
mov qword [rbp], rax
mov eax, dword [0x1800410d0]
mov dword [rbp + 8], eax
mov eax, dword [0x1800410d4]
mov dword [rbp + 0xc], eax
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp + 0x10], xmm0
jmp 0x18002a117
mov byte [rsp + 0x30], 0
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x10]
lea r8, [0x180025380]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x18], rax
mov r8d, dword [rsp + 0x70]
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x740]
call qword [sym.imp.WINMM.dll_mmioOpenA]
mov qword [rbp - 0x78], rax
cmp qword [rbp - 0x18], 0
jne 0x18002a117
xor edx, edx
mov edi, edx
cmp edi, 0xf
ja case.0x180029ac0.10
mov ecx, edi
lea r8, [0x180000000]
mov eax, dword [r8 + rcx*4 + 0x2a514]
add rax, r8
jmp rax
mov ecx, edx
movzx eax, r13b
cmp dword [rsp + 0x78], 0
cmovne ecx, eax
movzx r13d, cl
jmp case.0x180029ac0.10
lea rax, [rbp + 0x770]
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], 0
jne 0x180029ae7
test r13b, r13b
je case.0x180029ac0.10
lea rdx, [rbp + 0x90]
mov rcx, qword [rbp - 0x10]
call sub.IMM32.dll_ImmSetCompositionFontA
xor edx, edx
jmp case.0x180029ac0.10
mov byte [rbp + 0x78b], 0
mov r8d, 2
lea rdx, [0x18003b12a]
lea rcx, [rbp + 0x78b]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
xor edx, edx
jmp case.0x180029ac0.10
mov eax, 0x44
mov word [rbp + 0x770], ax
mov dword [rbp + 0x771], 0x617461
mov eax, 0x56
mov word [rbp + 0x774], ax
mov eax, 0x69
mov word [rbp + 0x775], ax
jmp case.0x180029ac0.10
mov byte [rbp + 0x78d], 0
jmp case.0x180029ac0.10
mov byte [rbp + 0x791], 0
mov r8d, 3
lea rdx, [0x18003b15f]
lea rcx, [rbp + 0x791]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, 0x5f54
mov word [rbp + 0x794], ax
xor edx, edx
jmp case.0x180029ac0.10
movzx eax, word [0x18003b190]
mov word [rbp + 0x783], ax
movzx eax, byte [0x18003b192]
mov byte [rbp + 0x785], al
mov byte [rbp + 0x786], 0
mov r8d, 2
lea rdx, [0x18003b1bb]
lea rcx, [rbp + 0x780]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
movzx eax, word [0x18003b1f1]
mov word [rbp + 0x788], ax
movzx eax, byte [0x18003b1f3]
mov byte [rbp + 0x78a], al
xor edx, edx
jmp case.0x180029ac0.10
mov dword [rbp + 0x776], 0x65537765
mov eax, 0x74
mov word [rbp + 0x77a], ax
mov eax, 0x49
mov word [rbp + 0x77b], ax
mov eax, 0x746e
mov word [rbp + 0x77c], ax
jmp case.0x180029ac0.10
mov eax, 0x38
mov word [rbp + 0x77e], ax
movzx eax, word [0x18003b234]
mov word [rbp + 0x780], ax
movzx eax, byte [0x18003b236]
mov byte [rbp + 0x782], al
mov byte [rbp + 0x783], 0
jmp case.0x180029ac0.10
mov byte [rbp + 0x78d], 0x43
movzx eax, word [0x18003b254]
mov word [rbp + 0x78e], ax
movzx eax, byte [0x18003b256]
mov byte [rbp + 0x790], al
jmp case.0x180029ac0.10
lea rdx, [rbp + 0x90]
mov rcx, qword [rbp - 0x10]
call sub.IMM32.dll_ImmGetCompositionFontA
mov dword [rsp + 0x78], eax
xor edx, edx
jmp case.0x180029ac0.10
mov r13b, 1
mov dword [rsp + 0x58], edx
mov qword [rbp - 0x10], rdx
jmp case.0x180029ac0.10
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], rax
mov dword [rbp + 0xc8], eax
jmp case.0x180029ac0.10
mov dword [rbp + 0x796], 0x45505954
mov byte [rbp + 0x79a], 0
inc edi
lea eax, [rdi + 0xd]
cmp eax, 0x1d
jb 0x180029aa3
mov edi, dword [rsp + 0x50]
jmp 0x18002a117
xor r14d, r14d
mov word [rbp + 0x7fc], r14w
mov r8d, 0x151
lea rdx, [0x180041028]
xor ecx, ecx
call fcn.1800212b0
test al, al
jne 0x180029e89
mov edi, 7
cmp edi, 7
ja case.default.0x180029d51
mov eax, edi
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0x2a554]
add rcx, rdx
jmp rcx
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp - 8], r14
mov dword [rbp + 0x90], 0x30
mov dword [rbp - 0x80], r14d
jmp case.default.0x180029d51
lea r8, [rsp + 0x7c]
lea rdx, [rbp - 8]
lea rcx, [rbp + 0x780]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorGroup]
mov dword [rbp - 0x7c], eax
jmp case.default.0x180029d51
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
xor eax, eax
movups xmmword [rbp + 0x780], xmm1
movups xmmword [rbp + 0x790], xmm1
mov qword [rbp + 0x7a0], rax
jmp case.default.0x180029d51
mov r12b, 1
jmp case.default.0x180029d51
cmp byte [rsp + 0x48], r14b
je 0x180029deb
mov r8d, dword [rsp + 0x7c]
mov rdx, qword [rbp - 8]
lea rcx, [rbp + 0x780]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorGroup]
cmp qword [rsp + 0x68], r14
jne 0x180029dfe
xor r12b, r12b
mov ebx, r15d
mov dword [rsp + 0x38], ebx
jmp case.default.0x180029d51
test r12b, r12b
je 0x180029e2e
lea r8, [rsp + 0x60]
mov edx, r15d
mov rcx, qword [rsp + 0x68]
call sub.ADVAPI32.dll_LsaQueryInformationPolicy
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x180029e24
call sub.ADVAPI32.dll_LsaFreeMemory
mov rcx, qword [rsp + 0x68]
call sub.ADVAPI32.dll_LsaClose
mov ebx, r15d
mov dword [rsp + 0x38], ebx
jmp case.default.0x180029d51
mov byte [rsp + 0x48], 1
jmp case.default.0x180029d51
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], r14
lea r9, [rsp + 0x68]
mov r8d, dword [rbp - 0x80]
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x20]
call sub.ADVAPI32.dll_LsaOpenPolicy
mov ecx, r14d
movzx eax, byte [rsp + 0x48]
cmp dword [rbp - 0x7c], r14d
cmovne ecx, eax
mov byte [rsp + 0x48], cl
dec edi
lea eax, [rdi + 0x80]
cmp eax, 0x7f
ja 0x180029d35
mov edi, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov r14b, 1
jmp 0x18002a117
lea rdx, [rbp - 0x70]
mov ecx, 0x110
call fcn.180024720
lea rax, [rbp + 0x60]
mov qword [rsp + 0x70], rax
mov rdx, qword [rbp - 0x68]
cmp rdx, qword [rbp - 0x60]
je 0x180029ed5
lea rax, [rbp + 0x60]
mov qword [rdx], rax
mov rdx, qword [rbp - 0x68]
add rdx, 8
mov qword [rbp - 0x68], rdx
jmp 0x180029ee7
lea r8, [rsp + 0x70]
lea rcx, [rbp - 0x70]
call fcn.180019da0
mov rdx, qword [rbp - 0x68]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x70], rax
cmp rdx, qword [rbp - 0x60]
je 0x180029f0d
lea rax, [rbp + 0x30]
mov qword [rdx], rax
add qword [rbp - 0x68], 8
xor eax, eax
mov dword [rsp + 0x70], eax
jmp 0x18002a117
lea r8, [rsp + 0x70]
lea rcx, [rbp - 0x70]
call fcn.180019da0
xor eax, eax
mov dword [rsp + 0x70], eax
jmp 0x18002a117
mov word [rsp + 0x50], r8w
lea r9, [rbp + 0x60]
mov r8d, 0x13d
lea rdx, [rsp + 0x50]
lea rcx, [0x180041088]
call fcn.18002aa50
mov eax, 0x1bb
mov word [rsp + 0x50], ax
lea r9, [rsp + 0x50]
lea r8, [rbp + 0x30]
lea rdx, [0x1800410a8]
mov ecx, reloc.SHELL32.dll_SHSetFolderPathW
call fcn.1800368e0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x2b0], xmm0
movups xmmword [rbp + 0x2c0], xmm0
movups xmmword [rbp + 0x2d0], xmm0
movups xmmword [rbp + 0x2e0], xmm0
movups xmmword [rbp + 0x2f0], xmm0
movups xmmword [rbp + 0x300], xmm0
mov dword [rbp + 0x310], eax
jmp 0x18002a117
mov edx, 0xc2
lea rcx, [rbp + 0x240]
call fcn.180026450
lea r8, [rbp + 0x270]
lea rdx, [rbp + 0x200]
mov ecx, 0xdc
call fcn.18001d500
jmp 0x18002a117
lea rax, [rbp + 0x758]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180029fe1
lea rdx, [rbp + 0x758]
lea rcx, [rbp + 0x200]
call fcn.18002bad0
mov r8, r15
lea rdx, [0x18003b26c]
lea rcx, [rbp + 0x220]
call fcn.18002bad0
mov r8d, 0x1bb
mov word [rbp + 0x260], r8w
jmp case.0x1800299ca.14
mov r8d, 4
lea rdx, [0x18003b2f0]
lea rcx, [rbp + 0x7ee]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor eax, eax
mov word [rbp + 0x7f6], ax
jmp 0x18002a117
mov r8d, 4
lea rdx, [0x18003b362]
lea rcx, [rbp + 0x7d0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x18002a117
mov r8, r15
lea rdx, [0x18003b384]
lea rcx, [rbp + 0x7fa]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp 0x18002a117
lea r9, [rbp - 0x70]
lea r8, [rbp + 0xd0]
lea rdx, [0x180041020]
mov ecx, 0x82
call fcn.1800354a0
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp + 0xd0]
mov edx, 0x101
xor ecx, ecx
call fcn.18002e390
test r14b, r14b
je 0x18002a117
mov r8d, dword [rsp + 0x70]
lea rdx, [rbp + 0x2b0]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.WINMM.dll_mmioAdvance]
mov edx, 0x10
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.WINMM.dll_mmioClose]
jmp 0x18002a117
mov r8d, 2
lea rdx, [0x18003b3d8]
lea rcx, [rbp + 0x7f6]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor eax, eax
mov word [rbp + 0x7fa], ax
mov r8d, 0x1bb
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x44]
dec eax
mov dword [rsp + 0x40], eax
dec edi
mov dword [rsp + 0x50], edi
cmp eax, ecx
ja 0x1800299b0
mov r15d, ebx
lea rcx, [rbp + 0x148]
call fcn.18001be20
mov rbx, qword [rbp + 0x130]
test rbx, rbx
je 0x18002a1eb
mov rdi, qword [rbp + 0x138]
cmp rbx, rdi
je 0x18002a17c
mov rcx, rbx
call fcn.18002b580
add rbx, 0x20
cmp rbx, rdi
jne 0x18002a164
mov rbx, qword [rbp + 0x130]
mov r8, qword [rbp + 0x140]
sub r8, rbx
sar r8, 5
mov rdx, rbx
lea rcx, [rbp + 0x130]
call fcn.18002c620
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x130], xmm0
xor esi, esi
mov qword [rbp + 0x140], rsi
jmp 0x18002a1ed
mov r9d, esi
lea r8, [rbp + 0x780]
lea rdx, [rbp + 0x770]
mov ecx, dword [rsp + 0x58]
call qword [sym.imp.SHLWAPI.dll_StrIsIntlEqualA]
jmp 0x18002a13c
movzx edx, byte [rsp + 0x30]
lea rcx, [rbp + 0x7d0]
call qword [sym.imp.ADVAPI32.dll_SaferiIsExecutableFileType]
xor eax, eax
mov r15d, eax
jmp 0x18002a13c
xor esi, esi
mov rdx, qword [rbp + 0x118]
test rdx, rdx
je 0x18002a225
mov r8, qword [rbp + 0x128]
sub r8, rdx
sar r8, 4
lea rcx, [rbp + 0x118]
call fcn.18002c580
mov qword [rbp + 0x118], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x120], xmm0
lea rcx, [rbp + 0xd8]
call fcn.18001bd50
nop
mov rbx, qword [rbp - 0x58]
test rbx, rbx
je 0x18002a2c3
mov rdi, qword [rbp - 0x50]
cmp rbx, rdi
je 0x18002a25d
mov rcx, rbx
call fcn.18001b660
add rbx, 0x28
cmp rbx, rdi
jne 0x18002a248
mov rbx, qword [rbp - 0x58]
mov rcx, qword [rbp - 0x48]
sub rcx, rbx
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rax, rbx
cmp rdx, 0x1000
jb 0x18002a2af
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18002a2af
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.180038298
mov qword [rbp - 0x58], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
mov rdx, qword [rbp - 0x70]
test rdx, rdx
je 0x18002a2ec
mov r8, qword [rbp - 0x60]
sub r8, rdx
sar r8, 3
lea rcx, [rbp - 0x70]
call fcn.18002c530
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rsi
mov rdx, qword [rbp + 0x52]
cmp rdx, 0x10
jb 0x18002a32a
inc rdx
mov rcx, qword [rbp + 0x3a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002a325
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18002a325
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180038298
movdqa xmm0, xmmword [0x18003d1f0]
movdqu xmmword [rbp + 0x4a], xmm0
mov byte [rbp + 0x3a], 0
mov rdx, qword [rbp + 0x82]
cmp rdx, 0x10
jb 0x18002a37c
inc rdx
mov rcx, qword [rbp + 0x6a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002a377
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18002a377
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180038298
movdqa xmm0, xmmword [0x18003d1f0]
movdqu xmmword [rbp + 0x7a], xmm0
mov byte [rbp + 0x6a], 0
lea rcx, [rbp + 0x270]
call fcn.18001b9c0
nop
lea rcx, [rbp + 0x200]
call fcn.18001ba70
mov eax, r15d
mov rcx, qword [rbp + 0x818]
xor rcx, rsp
call fcn.1800387b0
mov rbx, qword [rsp + 0x960]
add rsp, 0x920
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret