Function at 0x18001cdb0
Capabilities:
Delete registry key
Log keystrokes via input method manager

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x428]
sub rsp, 0x528
lea edi, [rcx - 0x12]
xor r11d, r11d
lea r10, [0x180000000]
mov r9, rdx
mov edx, ecx
cmp ecx, edi
jbe 0x18001cf70
lea ebx, [rcx - 0xe2]
mov esi, 0x7264
mov r14d, 0x6e69
cmp ebx, 0x37
ja case.0x18001ce21.17
movzx eax, byte [r10 + rbx + 0x1df6c]
mov ecx, dword [r10 + rax*4 + 0x1df24]
add rcx, r10
jmp rcx
movzx eax, word [r8 + 0x3c]
mov word [rsp + 0x3c], ax
jmp case.0x18001ce21.17
movsd xmm0, qword [0x180085872]
movzx eax, word [0x18008587a]
movsd qword [rbp + 0x24], xmm0
mov word [rbp + 0x2c], ax
jmp case.0x18001ce21.17
mov r8d, 5
lea rdx, str.DriverPackageOpenW
lea rcx, [rbp + 0x68]
call fcn.180066f10
jmp 0x18001cf42
mov dword [rbp + 0x32], 0x6c
jmp case.0x18001ce21.17
mov r8d, 2
mov word [rbp + 0x2e], r11w
lea rdx, [0x1800858dc]
lea rcx, [rbp + 0x2e]
call fcn.180066f10
jmp 0x18001cf42
movzx eax, word [0x18008591a]
mov word [rbp - 0x51], ax
movzx eax, byte [0x18008591c]
mov byte [rbp - 0x4f], al
jmp case.0x18001ce21.17
mov eax, dword [0x180085931]
mov dword [rsp + 0x7a], eax
movzx eax, byte [0x180085935]
mov byte [rsp + 0x7e], al
jmp case.0x18001ce21.17
mov byte [rbp - 0x53], 0
lea rdx, [0x18008594a]
mov r8d, 2
lea rcx, [rbp - 0x53]
jmp 0x18001cf3d
mov byte [rsp + 0x7f], 0
jmp case.0x18001ce21.17
mov dword [rbp + 0x20], 0x730077
jmp case.0x18001ce21.17
mov word [rsp + 0x7f], si
mov byte [rbp - 0x7f], 0
jmp case.0x18001ce21.17
mov word [rsp + 0x78], r14w
mov byte [rsp + 0x7a], 0
jmp case.0x18001ce21.17
mov eax, dword [r9]
and eax, 0x1fffff80
or eax, dword [r8]
movabs dword [0xe000ed08], eax
jmp case.0x18001ce21.17
mov byte [rbp - 0x51], 0
jmp case.0x18001ce21.17
mov word [rbp + 0x32], r11w
jmp case.0x18001ce21.17
mov r8d, 5
lea rdx, [0x180085971]
lea rcx, [rbp - 0x58]
call fcn.1800672d0
mov r9, qword [rbp + 0x478]
lea r10, [0x180000000]
mov r8, qword [rbp + 0x480]
xor r11d, r11d
dec ebx
lea eax, [rbx + 0xe2]
cmp eax, edi
ja 0x18001ce04
mov edx, dword [rbp + 0x470]
lea edi, [rdx + 0x330]
mov ebx, edx
cmp edx, edi
jae 0x18001d14f
mov esi, 0x57
nop word [rax + rax]
cmp ebx, 0x206
ja 0x18001d0ac
je 0x18001d0a3
lea eax, [rbx - 0x107]
cmp eax, 0xde
ja case.0x18001cfc7.273
movzx eax, byte [r10 + rax + 0x1dfd0]
mov ecx, dword [r10 + rax*4 + 0x1dfa4]
add rcx, r10
jmp rcx
movsd xmm0, qword [0x180085a0a]
movzx eax, word [0x180085a12]
movsd qword [rbp + 0x78], xmm0
mov word [rbp + 0x80], ax
jmp case.0x18001cfc7.273
mov dword [rbp - 0x4c], 0x20736369
mov byte [rbp - 0x48], 0
jmp case.0x18001cfc7.273
mov r8d, 2
mov byte [rbp - 0x4e], 0
lea rdx, str._houghCircles_gpu_cv__YAXABVGpuMat_12_AAV312_AAUHoughCirclesBuf_12_HMMHHHHH_Z
lea rcx, [rbp - 0x4e]
call fcn.1800672d0
xor r11d, r11d
jmp case.0x18001cfc7.273
mov word [rbp + 0x82], r11w
jmp case.0x18001cfc7.273
mov word [rbp + 0x78], r11w
jmp case.0x18001cfc7.273
mov byte [rbp - 0x4c], 0
jmp case.0x18001cfc7.273
mov r8d, 4
mov byte [rbp - 0x45], 0
lea rdx, [0x180085ae7]
lea rcx, [rbp - 0x45]
call fcn.1800672d0
xor r11d, r11d
jmp case.0x18001cfc7.273
mov r8d, 3
lea rdx, [0x180085afe]
lea rcx, [rbp - 0x48]
call fcn.1800672d0
xor r11d, r11d
jmp case.0x18001cfc7.273
mov r8d, 3
lea rdx, [0x180085b5a]
lea rcx, [rbp + 0x72]
call fcn.180066f10
xor r11d, r11d
jmp case.0x18001cfc7.273
mov word [rbp + 0x72], r11w
jmp case.0x18001cfc7.273
mov byte [rbp - 0x41], 0x72
jmp case.0x18001cfc7.273
mov eax, ebx
sub eax, 0x218
je 0x18001d113
sub eax, 0x21
je 0x18001d108
sub eax, 0x12
je 0x18001d0fc
sub eax, 0x21
je 0x18001d0ed
sub eax, 0x12
jne case.0x18001cfc7.273
lea r8d, [rax + 5]
lea rdx, [0x180085a90]
lea rcx, [rbp + 0x86]
call fcn.180066f10
xor r11d, r11d
mov word [rbp + 0x90], r11w
jmp case.0x18001cfc7.273
mov dword [rsp + 0x69], 0x534153
mov byte [rsp + 0x6c], 0x74
jmp case.0x18001cfc7.273
mov dword [rbp + 0x84], 0x66
jmp case.0x18001cfc7.273
mov byte [rbp - 0x40], 0
mov word [rsp + 0x68], si
jmp case.0x18001cfc7.273
mov r8d, 1
lea rdx, [0x180085b70]
lea rcx, [rbp + 0x82]
call fcn.180066f10
xor r11d, r11d
mov word [rbp + 0x84], r11w
add ebx, 0x33
lea r10, [0x180000000]
cmp ebx, edi
jb 0x18001cf90
mov edx, dword [rbp + 0x470]
mov r10, qword [rbp + 0x488]
mov ebx, edx
imul edi, edx, 0x2c0
mov qword [rbp - 0x60], r10
cmp edx, edi
ja 0x18001d3c4
movzx eax, word [rbp + 0x470]
mov r13d, 0x61
mov dword [rsp + 0x34], eax
movabs r14, 0x690072006f006e
movzx eax, byte [rbp + 0x470]
movabs r15, 0x320033005f0032
mov byte [rbp + 0x488], al
lea r12d, [r13 + 0xf]
imul esi, edx, 0x2c
cmp ebx, 0xb5d7
ja 0x18001d2f2
je 0x18001d2e1
cmp ebx, 0x5b6f
ja 0x18001d294
je 0x18001d250
mov eax, ebx
sub eax, 0x107
je 0x18001d246
sub eax, 0x12
je 0x18001d227
sub eax, 0x2d22
je 0x18001d201
mov r8d, dword [rsp + 0x34]
movzx r9d, byte [rbp + 0x488]
cmp eax, 0x32a
jne 0x18001d3ac
mov word [rbp + 0x96], r11w
jmp 0x18001d3ac
mov r8d, 1
mov word [rsp + 0x6d], r13w
lea rdx, [0x180080d60]
lea rcx, [rsp + 0x68]
call fcn.180067120
mov r10, qword [rbp - 0x60]
jmp 0x18001d39f
mov eax, dword [0x180085bb8]
mov dword [rbp + 0x90], eax
movzx eax, word [0x180085bbc]
mov word [rbp + 0x94], ax
jmp 0x18001d39f
mov byte [rsp + 0x6d], 0
jmp 0x18001d39f
lea rcx, [rsp + 0x68]
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18001d260
movzx eax, word [0x180082014]
lea rdx, [0x1800836ec]
mov word [rcx], ax
mov r8d, 2
lea rcx, [rsp + 0x70]
call fcn.1800672d0
mov r10, qword [rbp - 0x60]
jmp 0x18001d39f
cmp ebx, 0x61b1
je 0x18001d2d5
cmp ebx, 0x88a3
je 0x18001d2ca
mov r8d, dword [rsp + 0x34]
movzx r9d, byte [rbp + 0x488]
cmp ebx, 0x91fd
jne 0x18001d3ac
mov word [rbp + 0x9e], r11w
jmp 0x18001d3ac
mov word [rsp + 0x71], r12w
jmp 0x18001d39f
mov qword [rbp + 0x96], r14
jmp 0x18001d39f
mov dword [rbp + 8], 0x730077
mov word [rbp + 0xc], r11w
jmp 0x18001d39f
cmp ebx, 0x1103f
ja 0x18001d357
je 0x18001d34e
cmp ebx, 0xc249
je 0x18001d33a
cmp ebx, 0xe30b
je 0x18001d32f
cmp ebx, 0xf295
jne 0x18001d39f
mov r9b, 1
mov r8d, 0x100
mov byte [rbp + 0x488], r9b
mov dword [rsp + 0x34], r8d
jmp 0x18001d3ac
mov qword [rbp + 0xc], r15
mov word [rbp + 0x14], r11w
jmp 0x18001d39f
mov dword [rbp + 0x9e], 0x67006e
mov word [rbp + 0xa2], r11w
jmp 0x18001d39f
mov dword [rbp + 0x14], 0x64002e
jmp 0x18001d39f
cmp ebx, 0x122e1
je 0x18001d384
cmp ebx, 0x13d73
je 0x18001d37d
cmp ebx, 0x16aa7
jne 0x18001d39f
mov dword [rbp + 0x18], 0x6c006c
mov word [rbp + 0x1c], r11w
jmp 0x18001d39f
mov word [rbp + 0x18], r11w
jmp 0x18001d39f
mov r8d, 0x10e
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x78]
call fcn.180012b30
mov r10, rax
mov qword [rbp - 0x60], rax
mov r8d, dword [rsp + 0x34]
movzx r9d, byte [rbp + 0x488]
add ebx, esi
mov r11d, 0
cmp ebx, edi
jbe 0x18001d1a3
mov edx, dword [rbp + 0x470]
jmp 0x18001d3e0
movzx r8d, word [rbp + 0x470]
movzx r9d, byte [rbp + 0x470]
mov dword [rsp + 0x34], r8d
mov byte [rbp + 0x488], r9b
lea eax, [rdx + rdx*4]
mov dword [rsp + 0x40], edx
shl eax, 5
mov ecx, edx
mov dword [rbp - 0x18], eax
cmp edx, eax
ja case.0x18001ce21.0
mov r14d, dword [rbp + 0x470]
movzx r13d, byte [rsp + 0x32]
mov r15, qword [rbp - 0x10]
mov r12d, dword [rsp + 0x60]
movzx esi, byte [rsp + 0x30]
mov qword [rbp + 0x40], r14
mov eax, 0x42
lea ebx, [rax + 0x36]
cmp ecx, 0x2a1f
ja 0x18001d630
je 0x18001d5f6
cmp ecx, 0x1593
ja 0x18001d51b
je 0x18001d4f7
mov eax, ecx
sub eax, 0x107
je 0x18001d4ea
sub eax, 0x12
je 0x18001d4ce
sub eax, 0xa34
je 0x18001dc4f
cmp eax, 0xc6
jne 0x18001de04
movsx eax, r8w
lea rcx, [rbp + 0x68]
mov qword [rsp + 0x28], rcx
lea r8d, [rbx - 0x74]
xor edx, edx
mov dword [rsp + 0x20], eax
xor r9d, r9d
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbp - 0x38], rax
mov rax, qword [rbp + 0x478]
cmp dword [rax], 0xffffffff
je 0x18001d4c5
mov edx, 0x6f
mov ecx, edx
sub ecx, 0x6f
je 0x18001d4b5
cmp ecx, 0x7e
je case.0x18001ce21.0
jmp 0x18001d4ba
mov byte [rsp + 0x3c], 1
add edx, 0x7e
cmp edx, 0x16b
jb 0x18001d4a3
mov ecx, dword [rsp + 0x40]
jmp 0x18001ddfe
mov rcx, qword [rbp + 0x480]
call r10
mov rcx, qword [rbp + 0x478]
mov dword [rcx], eax
mov ecx, dword [rsp + 0x40]
jmp 0x18001ddfe
mov sil, 1
mov byte [rsp + 0x30], sil
jmp 0x18001de04
mov r8d, 0x10e
lea rdx, [rbp + 8]
lea rcx, [rsp + 0x68]
call fcn.180012b30
mov ecx, dword [rsp + 0x40]
mov qword [rbp + 0xb0], rax
jmp 0x18001ddfe
cmp ecx, 0x170d
je 0x18001d54e
cmp ecx, 0x1fd9
je 0x18001d53c
cmp ecx, 0x2207
je 0x18001dc06
jmp 0x18001de04
call qword [sym.imp.WINMM.dll_midiOutGetNumDevs]
mov ecx, dword [rsp + 0x40]
mov dword [rbp], eax
jmp 0x18001ddfe
mov r10, qword [rbp - 0x38]
xor ecx, ecx
test r10, r10
movzx eax, r9b
cmovne ecx, eax
mov byte [rbp + 0x488], cl
test cl, cl
je 0x18001d5ed
movsxd r13, dword [rsp + 0x34]
mov ebx, 0x5a
mov eax, ebx
sub eax, 0x58
je 0x18001d5cd
sub eax, 1
je 0x18001d5b6
cmp eax, 1
jne 0x18001d5da
movsx rax, r13w
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0xf001f
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rax
mov qword [rbp + 0xa8], rax
call qword [sym.imp.dbghelp.dll_GetTimestampForLoadedLibrary]
jmp 0x18001d5d6
mov rdi, qword [rbp + 0xa8]
test rdi, rdi
je 0x18001d5da
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x18001d5d6
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r10, qword [rbp - 0x38]
dec ebx
cmp ebx, 0x57
ja 0x18001d576
movzx r13d, byte [rsp + 0x32]
mov edx, dword [rbp + 0x470]
mov ecx, dword [rsp + 0x40]
jmp 0x18001de04
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x100], xmm0
mov dword [rbp + 0x160], eax
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
jmp 0x18001de04
cmp ecx, 0x5337
ja 0x18001dbad
je 0x18001d970
cmp ecx, 0x3465
je 0x18001d964
cmp ecx, 0x3eab
je 0x18001d687
cmp ecx, 0x48f1
jne 0x18001de04
mov r8d, dword [rbp + 4]
lea rdx, [rbp + 0x100]
lea rcx, [rbp - 0x58]
call qword [sym.imp.WINMM.dll_mmioOpenA]
mov ecx, dword [rsp + 0x40]
mov r15, rax
mov qword [rbp - 0x10], rax
jmp 0x18001ddfe
mov ecx, 0x202
lea rdx, [rbp + 0x280]
call qword [rbp + 0xb0]
test eax, eax
je 0x18001d947
xor r8d, r8d
mov edi, r8d
mov dword [rbp - 0x70], r8d
nop dword [rax + rax]
cmp edi, 0xd
ja case.0x18001d6cc.6
lea rdx, [0x180000000]
mov eax, edi
mov ecx, dword [rdx + rax*4 + 0x1e0b0]
add rcx, rdx
jmp rcx
mov eax, dword [str.ory_:]
mov dword [rsp + 0x4e], eax
movzx eax, word [0x180085bd8]
mov word [rsp + 0x52], ax
mov eax, 0x20
mov word [rsp + 0x53], ax
jmp case.0x18001d6cc.6
mov dword [rsp + 0x54], 0x73255b
jmp case.0x18001d6cc.6
lea rcx, [rsp + 0x48]
call qword [sym.imp.WINMM.dll_mciGetDeviceIDA]
xor r8d, r8d
mov dword [rbp - 0x78], eax
mov qword [rbp + 0x48], r8
jmp case.0x18001d6cc.6
mov byte [rsp + 0x31], 1
jmp case.0x18001d6cc.6
lea r9, [rbp + 0x48]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov dword [rbp - 0x74], eax
xor r8d, r8d
jmp case.0x18001d6cc.6
mov byte [rsp + 0x38], 1
jmp case.0x18001d6cc.6
mov eax, dword [str.dire]
lea rdx, [0x180085be4]
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x48]
movzx eax, byte [0x180085be0]
mov r8d, 2
mov byte [rsp + 0x4c], al
call fcn.180067120
xor r8d, r8d
jmp case.0x18001d6cc.6
cmp dword [rbp - 0x78], 0
mov ecx, r8d
movzx eax, byte [rsp + 0x31]
cmovne ecx, eax
mov byte [rsp + 0x31], cl
movzx edx, cl
test cl, cl
je case.0x18001d6cc.6
mov r15d, dword [rbp - 4]
mov ebx, 0x2c
mov edi, dword [rbp - 8]
mov esi, dword [rbp - 0x78]
mov byte [rsp + 0x31], cl
nop
cmp ebx, 0x2c
je 0x18001d850
cmp ebx, 0x17e4
je 0x18001d812
cmp ebx, 0x2f9c
je 0x18001d7fd
cmp ebx, 0x4754
jne 0x18001d860
test dl, dl
je 0x18001d860
mov r8d, 0x104
lea rdx, [rbp + 0x170]
mov ecx, r12d
call qword [sym.imp.WINMM.dll_mciGetErrorStringA]
movzx edx, byte [rsp + 0x31]
xor r8d, r8d
jmp 0x18001d860
movzx eax, dl
test r12d, r12d
mov ecx, r8d
cmovne ecx, eax
movzx edx, cl
mov byte [rsp + 0x31], cl
jmp 0x18001d860
xor eax, eax
mov r8d, edi
xorps xmm0, xmm0
mov qword [rbp + 0xf0], rax
lea r9, [rbp + 0xe0]
mov dword [rbp + 0xf8], eax
mov r9d, r9d
mov edx, r15d
mov ecx, esi
movups xmmword [rbp + 0xe0], xmm0
call qword [sym.imp.WINMM.dll_mciSendCommandA]
movzx edx, byte [rsp + 0x31]
xor r8d, r8d
mov r12d, eax
jmp 0x18001d860
mov edi, 0x400
mov r15d, 0x810
nop dword [rax + rax]
add ebx, 0x17b8
cmp ebx, 0x5ee0
jbe 0x18001d7b0
movzx esi, byte [rsp + 0x30]
mov dword [rbp - 8], edi
mov edi, dword [rbp - 0x70]
mov dword [rbp - 4], r15d
mov r15, qword [rbp - 0x10]
mov dword [rsp + 0x60], r12d
jmp case.0x18001d6cc.6
mov rcx, qword [rbp + 0xb8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.GDI32.dll_GetEnhMetaFileDescriptionA]
cmp byte [rsp + 0x38], 0
je 0x18001d737
mov ebx, ILRemoveLastID
cmp ebx, 0xf
je 0x18001d8d9
cmp ebx, 0x57
jne 0x18001d8f1
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x18001d8c9
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x18001d8f1
call sub.RPCRT4.dll_MesHandleFree
jmp 0x18001d8f1
lea r8, [rbp + 0x50]
mov qword [rbp + 0x50], 0
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
mov dword [rbp - 0x74], eax
add ebx, 0x48
cmp ebx, 0x9f
jb 0x18001d8b1
xor r8d, r8d
jmp case.0x18001d6cc.6
movzx eax, byte [rsp + 0x38]
mov ecx, r8d
cmp dword [rbp - 0x74], 0
cmove ecx, eax
mov byte [rsp + 0x38], cl
jmp case.0x18001d6cc.6
movzx eax, word [0x180085be8]
mov word [rsp + 0x57], ax
movzx eax, byte [0x180085bea]
mov byte [rsp + 0x59], al
jmp case.0x18001d6cc.6
mov qword [rbp + 0xb8], r8
inc edi
mov dword [rbp - 0x70], edi
lea eax, [rdi + 0x13]
cmp eax, 0x21
jb 0x18001d6b0
xor ecx, ecx
movzx eax, r13b
cmp dword [rbp], ecx
cmovne ecx, eax
movzx r13d, cl
mov byte [rsp + 0x32], cl
mov ecx, dword [rsp + 0x40]
jmp 0x18001ddfe
mov dword [rbp + 4], 0
jmp 0x18001de04
mov rcx, qword [rbp + 0x480]
xor edx, edx
mov r8d, 0x8b
call fcn.180034770
test al, al
jne 0x18001db91
mov edi, 0x5e
cmp edi, 0xd090
ja 0x18001da5d
je 0x18001da4d
cmp edi, 0x5998
ja 0x18001da08
je 0x18001d9f4
cmp edi, 0x5e
je 0x18001d9e7
cmp edi, 0x1e1c
je 0x18001d9d8
cmp edi, 0x3bda
jne 0x18001db7f
mov word [rsp + 0x4d], bx
mov dword [rsp + 0x4e], 0x305569
jmp 0x18001db7f
mov eax, 0x42
mov word [rsp + 0x4c], ax
jmp 0x18001db7f
mov dword [rsp + 0x48], 0x3478354a
jmp 0x18001db7f
mov eax, 0x67
mov word [rsp + 0x51], ax
mov word [rsp + 0x52], bx
jmp 0x18001db7f
cmp edi, 0x7756
je 0x18001da3b
cmp edi, 0x9514
je 0x18001da2e
cmp edi, 0xb2d2
jne 0x18001db7f
mov byte [rsp + 0x39], 1
jmp 0x18001db7f
mov dword [rsp + 0x57], 0x354b6f
jmp 0x18001db7f
mov dword [rsp + 0x53], 0x4e6345
mov word [rsp + 0x56], bx
jmp 0x18001db7f
mov qword [rbp + 0xc0], 0
jmp 0x18001db7f
cmp edi, 0x14788
ja 0x18001daf9
je 0x18001dae3
cmp edi, 0xee4e
je 0x18001dac3
cmp edi, 0x10c0c
je 0x18001dab5
cmp edi, 0x129ca
jne 0x18001db7f
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.GDI32.dll_GetObjectType]
lea r9, [rbp + 0x58]
mov edx, r14d
lea r8, [rbp - 0x30]
lea rcx, [rsp + 0x48]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov dword [rbp - 0x68], eax
jmp 0x18001db7f
xor eax, eax
mov dword [rbp - 0x30], eax
mov qword [rbp + 0x58], rax
jmp 0x18001db7f
lea rax, [rsp + 0x48]
mov r14, 0xffffffffffffffff
nop
inc r14
cmp byte [rax + r14], 0
jne 0x18001dad0
mov qword [rbp + 0x40], r14
jmp 0x18001db7f
movzx eax, byte [rsp + 0x39]
xor ecx, ecx
cmp dword [rbp - 0x68], ecx
cmove ecx, eax
mov byte [rsp + 0x39], cl
jmp 0x18001db7f
cmp edi, 0x16546
je 0x18001db0f
cmp edi, 0x18304
je case.0x18001ce21.0
jmp 0x18001db7f
cmp byte [rsp + 0x39], 0
je 0x18001db7a
mov ebx, 0x46
nop dword [rax + rax]
cmp ebx, 0x46
je 0x18001db4b
cmp ebx, 0x113a
jne 0x18001db67
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x18001db3b
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rbp + 0x60]
test rcx, rcx
je 0x18001db67
call sub.RPCRT4.dll_MesHandleFree
jmp 0x18001db67
lea r8, [rbp + 0x60]
mov qword [rbp + 0x60], 0
mov edx, r14d
lea rcx, [rsp + 0x48]
call sub.RPCRT4.dll_MesDecodeBufferHandleCreate
mov dword [rbp - 0x68], eax
add ebx, 0x10f4
cmp ebx, 0x21e8
jbe 0x18001db20
mov ebx, 0x78
mov byte [rsp + 0x3c], 0
add edi, 0x1dbe
cmp edi, 0x1a064
jbe 0x18001d991
xor ecx, ecx
movzx eax, sil
test r15, r15
cmovne ecx, eax
movzx esi, cl
mov byte [rsp + 0x30], cl
mov ecx, dword [rsp + 0x40]
jmp 0x18001ddfe
cmp ecx, 0x5d7d
je 0x18001de2d
cmp ecx, 0x67c3
je 0x18001dc5c
cmp ecx, 0x7209
jne 0x18001de04
mov ebx, 0x97
mov eax, ebx
sub eax, 0x97
je 0x18001dbea
cmp eax, 1
je case.0x18001ce21.0
jmp 0x18001dbfc
xor r8d, r8d
xor ecx, ecx
lea edx, [r8 + 0x74]
call fcn.1800255e0
mov byte [rsp + 0x3c], al
inc ebx
cmp ebx, 0x99
jb 0x18001dbd6
mov ebx, 0x51
nop dword [rax + rax]
mov eax, ebx
sub eax, 0x50
je case.0x18001ce21.0
cmp eax, 1
jne 0x18001dc3e
mov r9, qword [rbp + 0x478]
mov edx, 0xde
mov r8, qword [rbp + 0x480]
xor ecx, ecx
call fcn.180058200
mov byte [rsp + 0x3c], al
dec ebx
cmp ebx, 0x4f
ja 0x18001dc10
mov ecx, dword [rsp + 0x40]
mov edx, dword [rbp + 0x470]
mov r13b, 1
mov byte [rsp + 0x32], r13b
jmp 0x18001de04
movzx edx, byte [rsp + 0x30]
test dl, dl
je 0x18001ddfb
mov r12d, dword [rbp - 0x14]
mov esi, 6
mov r13d, dword [rbp - 0x28]
mov edi, 5
mov r14d, dword [rbp - 0x2c]
mov qword [rbp - 0x70], rsi
cmp edi, 5
ja case.default.0x18001dca0
lea r8, [0x180000000]
mov eax, edi
mov ecx, dword [r8 + rax*4 + 0x1e0e8]
add rcx, r8
jmp rcx
mov r12d, 0x80
jmp case.default.0x18001dca0
test dl, dl
je case.default.0x18001dca0
mov ebx, 0x6d
nop word [rax + rax]
mov eax, ebx
sub eax, 0x6d
je 0x18001dcda
cmp eax, 0x74
jne 0x18001dcea
lea edx, [rax - 0x64]
mov rcx, r15
call qword [sym.imp.WINMM.dll_mmioClose]
jmp 0x18001dcea
mov rdx, qword [rbp + 0x38]
xor r8d, r8d
mov rcx, r15
call qword [sym.imp.WINMM.dll_mmioWrite]
add ebx, 0x74
cmp ebx, 0x155
jb 0x18001dcc0
jmp case.default.0x18001dca0
xor eax, eax
mov qword [rbp + 0xd8], rax
mov qword [rbp + 0x38], rax
jmp case.default.0x18001dca0
xor r13d, r13d
cmp r14d, 0xffffffff
jne case.default.0x18001dca0
mov rsi, qword [rbp + 0xc8]
mov ebx, 0xf6
mov eax, ebx
sub eax, 0xf6
je 0x18001dd7f
sub eax, 1
je 0x18001dd55
sub eax, 1
je 0x18001dd45
cmp eax, 1
jne 0x18001dd86
xor dl, dl
mov byte [rsp + 0x30], dl
jmp 0x18001dd86
lea rdx, [rsp + 0x48]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_SHDeleteEmptyKeyW]
jmp 0x18001dd86
mov edx, ILRemoveLastID
mov rcx, r15
call qword [sym.imp.WINMM.dll_mmioClose]
movups xmm0, xmmword [str.FIRSTBIT_HI]
movsd xmm1, qword [0x180085c00]
movups xmmword [rsp + 0x48], xmm0
movsd qword [rsp + 0x58], xmm1
jmp 0x18001dd86
mov rsi, 0xffffffff80000001
inc ebx
cmp ebx, 0xfa
jb 0x18001dd25
mov qword [rbp + 0xc8], rsi
mov rsi, qword [rbp - 0x70]
jmp case.default.0x18001dca0
mov rdx, qword [rbp + 0x38]
xor r8d, r8d
mov rcx, r15
call qword [sym.imp.WINMM.dll_mmioRead]
mov r14d, eax
jmp case.default.0x18001dca0
mov rcx, qword [rbp + 0xd8]
mov r9d, r13d
xor r8d, r8d
mov edx, r12d
call sub.IMM32.dll_ImmGetCompositionStringW
movzx edx, byte [rsp + 0x30]
dec edi
sub rsi, 1
mov qword [rbp - 0x70], rsi
jne 0x18001dc83
mov ecx, dword [rsp + 0x40]
mov dword [rbp - 0x2c], r14d
mov r14, qword [rbp + 0x40]
mov dword [rbp - 0x28], r13d
movzx r13d, byte [rsp + 0x32]
mov dword [rbp - 0x14], r12d
mov r12d, dword [rsp + 0x60]
movzx esi, dl
mov edx, dword [rbp + 0x470]
lea eax, [rdx + rdx*4]
lea ecx, [rcx + rax*2]
mov dword [rsp + 0x40], ecx
cmp ecx, dword [rbp - 0x18]
ja case.0x18001ce21.0
mov r8d, dword [rsp + 0x34]
movzx r9d, byte [rbp + 0x488]
mov r10, qword [rbp - 0x60]
jmp 0x18001d416
test r13b, r13b
je 0x18001de04
mov r15d, dword [rbp - 0x24]
mov edi, 0xff
mov r12d, dword [rbp - 0x1c]
nop
cmp edi, 0xff
je 0x18001def6
cmp edi, 0x946b
je 0x18001deed
cmp edi, 0x127d7
je 0x18001ded0
cmp edi, 0x1bb43
jne 0x18001dea7
test r13b, r13b
je 0x18001dea7
mov ebx, eax
nop
mov eax, ebx
sub eax, 0x41
je 0x18001de84
cmp eax, 1
jne 0x18001de97
mov r15d, 0x104
jmp 0x18001de97
mov r8d, r15d
lea rdx, [rbp + 0x170]
mov ecx, r12d
call qword [sym.imp.WINMM.dll_midiOutGetErrorTextA]
dec ebx
cmp ebx, 0x40
ja 0x18001de70
mov dword [rbp - 0x24], r15d
mov eax, 0x42
add edi, 0x936c
cmp edi, 0x24db0
jbe 0x18001de40
mov r15, qword [rbp - 0x10]
mov ecx, dword [rsp + 0x40]
mov dword [rbp - 0x1c], r12d
mov r12d, dword [rsp + 0x60]
mov byte [rsp + 0x32], r13b
jmp 0x18001ddfe
mov rcx, qword [rbp + 0xd0]
lea rdx, [rbp - 0x20]
call qword [sym.imp.WINMM.dll_midiOutGetID]
mov r12d, eax
test eax, eax
jne 0x18001dea2
xor r13b, r13b
jmp 0x18001dea2
mov dword [rbp - 0x20], 0
jmp 0x18001dea7
mov qword [rbp + 0xd0], 0
jmp 0x18001dea7
mov byte [rsp + 0x3c], 0
movzx eax, word [rsp + 0x3c]
add rsp, 0x528
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret