Function at 0x1400762f8
Capabilities:
Encode data using xor
Execute anti-debugging instructions
Link many functions at runtime
Parse pe header
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1140]
mov eax, 0x1240
call fcn.1400cdb40
sub rsp, rax
mov qword [rbp + 0x4d0], 0xfffffffffffffffe
mov qword [rsp + 0x1270], rbx
mov qword [rsp + 0x1278], rsi
mov qword [rsp + 0x1280], rdi
mov rax, qword [0x140109388]
xor rax, rsp
mov qword [rbp + 0x1130], rax
xor esi, esi
mov qword [rbp + 0x338], rsi
mov qword [rbp + 0x340], rsi
mov qword [rbp + 0x348], rsi
mov qword [rbp + 0x298], rsi
lea rax, [rbp + 0x298]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftMediaPlayerPreferences_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea r14d, [rsi + 1]
test eax, eax
jne 0x140076417
mov eax, esi
mov rcx, qword [rbp + 0x338]
test rcx, rcx
je 0x1400763b5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x338], rsi
mov rcx, qword [rbp + 0x298]
mov qword [rbp + 0x338], rcx
test eax, eax
jne 0x140076417
mov dword [rbp + 0x188], esi
mov dword [rbp + 0x22c], 4
lea rax, [rbp + 0x22c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x188]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x410]
xor r8d, r8d
lea rdx, str.DisableRMESetting
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rbp + 0x188], r14d
jne 0x140076417
mov sil, r14b
jmp 0x140080370
mov dword [rbp + 0x14c], esi
mov qword [rbp + 0x230], rsi
mov dword [rbp + 0xb8], esi
mov dword [rbp + 0x148], esi
mov dword [rbp + 0xe8], esi
mov qword [rbp + 0x140], rsi
mov dword [rbp + 0x80], esi
xor eax, eax
lock cmpxchg dword [0x14010beac], r14d
jne 0x140076443
mov edi, 0xab69
mov r12d, 0x338
or r15, 0xffffffffffffffff
mov eax, dword [0x14010bea8]
test eax, eax
jne 0x140076a1f
mov dword [rbp - 0x50], esi
mov qword [rbp + 0x1a8], rsi
mov qword [rbp + 0x2a0], rsi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, r12d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp + 0x50], rax
test rax, rax
je 0x14007699a
mov ebx, esi
or ecx, 0xffffffff
mov edx, esi
mov dword [rbp + 0x18], edx
mov r11d, esi
mov dword [rbp + 0x2c], esi
lea r12, [rax + 7]
lea r13, [0x1400ea212]
mov r15d, 0x67
movzx r10d, byte [r13 - 2]
shl r10d, 8
movzx eax, byte [r13 - 1]
or r10d, eax
shl r10d, 8
movzx eax, byte [r13]
or r10d, eax
shl r10d, 8
movzx eax, byte [r13 + 1]
or r10d, eax
movzx r9d, byte [r13 + 2]
shl r9d, 8
movzx eax, byte [r13 + 3]
or r9d, eax
shl r9d, 8
movzx eax, byte [r13 + 4]
or r9d, eax
shl r9d, 8
movzx eax, byte [r13 + 5]
or r9d, eax
xor r11d, r10d
lea r13, [r13 + 8]
mov r8d, r11d
xor r8d, r9d
xor r8d, edx
xor r8d, 0xac987321
lea eax, [r8 + 0x54969fa2]
rol eax, 5
mov edx, r8d
rol edx, 0xa
imul eax, eax, 0x137f
add edx, eax
xor r11d, edx
lea eax, [r11 + 0x7f1137f]
ror eax, 9
mov edx, r11d
rol edx, 2
imul eax, eax, 0xab69
sub eax, edx
xor r8d, eax
imul edx, r8d, 0x605e
mov eax, r8d
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor r11d, edx
mov eax, r11d
xor eax, edi
rol eax, 6
mov edx, r11d
rol edx, 2
imul eax, eax, 0x7f1
sub eax, edx
xor r8d, eax
mov edx, r8d
xor edx, 0xab69605e
mov eax, 0x7f1137f
sub eax, edx
xor r11d, eax
mov edi, r11d
ror edi, 6
mov eax, r11d
xor eax, 0x137f
imul edx, eax, 0xab69
xor edi, edx
xor r8d, edi
lea eax, [r8 + 0x7f1137f]
ror eax, 0xf
mov edx, r8d
rol edx, 2
imul eax, eax, 0x605e
add edx, eax
xor r11d, edx
lea eax, [r11 + 0x54969fa2]
ror eax, 0xe
mov edx, r11d
rol edx, 8
imul eax, eax, 0x7f1
sub eax, edx
xor r8d, eax
mov eax, r8d
xor eax, 0xab69605e
ror eax, 0xc
mov edx, r8d
ror edx, 0xa
imul eax, eax, 0x137f
xor edx, eax
xor r11d, edx
mov eax, r11d
mov edi, 0x7f1
xor eax, edi
imul edx, eax, 0xab69
mov eax, r11d
shr eax, 0xa
xor edx, eax
xor edx, r8d
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor r11d, eax
lea r8d, [r11 - 0x7f1]
xor r8d, edx
xor r8d, 0xab69605e
mov eax, r8d
xor eax, edi
rol eax, 2
imul edx, eax, 0x137f
mov eax, r8d
shr eax, 2
add edx, eax
xor r11d, edx
lea eax, [r11 - 0x7f1137f]
ror eax, 6
mov edx, r11d
rol edx, 7
imul eax, eax, 0xab69
add edx, eax
xor r8d, edx
mov edi, r8d
ror edi, 9
mov eax, r8d
xor eax, 0x137f
imul edx, eax, 0x605e
add edi, edx
xor r11d, edi
mov eax, r11d
mov edi, 0xab69
xor eax, edi
rol eax, 5
mov edx, r11d
rol edx, 7
imul eax, eax, 0x7f1
add edx, eax
xor r8d, edx
xor r11d, r8d
xor r11d, 0xac987321
mov eax, r11d
ror eax, 3
sub eax, edi
imul eax, eax, 0x137f
xor r8d, eax
lea eax, [r8 - 0x7f1137f]
ror eax, 1
mov edx, r8d
ror edx, 6
imul eax, eax, 0x605e
sub eax, edx
xor r11d, eax
lea eax, [r11 - 0x54969fa2]
rol eax, 3
mov edx, r11d
rol edx, 0xe
imul eax, eax, 0x7f1
add edx, eax
xor r8d, edx
lea eax, [r8 - 0x54969fa2]
rol eax, 0xf
mov edx, r8d
ror edx, 0xe
imul eax, eax, 0x137f
sub eax, edx
xor r11d, eax
mov eax, r11d
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, r11d
shr eax, 3
xor edx, eax
xor r8d, edx
mov eax, r8d
xor eax, 0x7f1137f
rol eax, 4
mov edx, r8d
rol edx, 2
imul eax, eax, 0x605e
xor edx, eax
xor edx, ebx
xor r11d, edx
mov dword [rbp + 0x2c], r11d
xor r8d, ecx
mov dword [rbp + 0x18], r8d
mov byte [r12 - 4], r11b
ror dword [rbp + 0x2c], 8
mov al, byte [rbp + 0x18]
mov byte [r12], al
ror dword [rbp + 0x18], 8
mov al, byte [rbp + 0x2c]
mov byte [r12 - 5], al
ror dword [rbp + 0x2c], 8
mov al, byte [rbp + 0x18]
mov byte [r12 - 1], al
ror dword [rbp + 0x18], 8
mov al, byte [rbp + 0x2c]
mov byte [r12 - 6], al
ror dword [rbp + 0x2c], 8
mov al, byte [rbp + 0x18]
mov byte [r12 - 2], al
ror dword [rbp + 0x18], 8
mov al, byte [rbp + 0x2c]
mov byte [r12 - 7], al
mov al, byte [rbp + 0x18]
mov byte [r12 - 3], al
mov r11d, dword [rbp + 0x2c]
ror r11d, 8
mov dword [rbp + 0x2c], r11d
mov edx, dword [rbp + 0x18]
ror edx, 8
mov dword [rbp + 0x18], edx
mov ebx, r10d
mov ecx, r9d
lea r12, [r12 + 8]
sub r15, r14
jne 0x1400764c0
mov rax, rsi
mov cl, sil
or r15, 0xffffffffffffffff
mov ebx, esi
mov r14, qword [rbp + 0x50]
lea edx, [r15 + 2]
mov r12d, 0x338
xor cl, byte [rax + r14]
add rax, rdx
cmp rax, r12
jb 0x1400767fe
movzx eax, cl
cmp rax, qword [0x1400ea548]
je 0x14007681d
mov edi, 0xc004d501
jmp 0x140076830
mov qword [rbp + 0x1a8], r14
mov r14, rsi
mov qword [rbp + 0x2a0], r12
mov edi, ebx
test r14, r14
je 0x140076849
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
js 0x14007699a
mov rdi, qword [rbp + 0x1a8]
mov rax, qword [rbp + 0x2a0]
mov byte [rax + rdi - 1], sil
xor edx, edx
lea r8d, [rdx + 0x60]
lea r14, [0x14010a7b0]
mov rcx, r14
call sub.msvcrt.dll_memset
cmp byte [rdi], sil
je 0x14007699f
mov r13d, ebx
jmp 0x14007688e
lea r14, [0x14010a7b0]
mov rdx, rdi
mov rax, r15
inc rax
cmp word [rdi + rax*2], si
jne 0x140076894
lea rdi, [rdi + rax*2]
mov eax, r13d
lea rcx, [rax + rax*2]
lea r14, [r14 + rcx*8]
mov r8, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x14007699a
mov ebx, esi
mov rax, qword [r14]
mov ecx, 0x5a4d
cmp word [rax], cx
je 0x1400768d5
mov ebx, 0xc000007b
jmp 0x140076920
movsxd rcx, dword [rax + 0x3c]
cmp ecx, 0x10000000
jae 0x1400768ce
add rcx, qword [r14]
cmp rcx, qword [r14]
jb 0x1400768ce
cmp dword [rcx], 0x4550
jne 0x1400768ce
movzx eax, word [rcx + 0x18]
mov edx, 0x10b
sub ax, dx
mov edx, 0xfeff
test dx, ax
je 0x14007690e
mov ebx, 0xc000000d
jmp 0x140076920
mov rax, qword [rcx + 0x88]
mov qword [r14 + 0xc], rax
mov eax, dword [rcx + 0x50]
mov dword [r14 + 8], eax
mov eax, dword [rdi + 2]
mov dword [rbp - 0x70], eax
add rdi, 6
mov r12d, esi
test eax, eax
je 0x140076986
mov ecx, 1
mov rdx, rdi
mov rax, r15
inc rax
cmp byte [rdi + rax], sil
jne 0x14007693c
inc rdi
add rdi, rax
test ebx, ebx
js 0x140076975
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
test rax, rax
je 0x14007699f
mov eax, dword [rbp - 0x50]
lea r8, [0x140106020]
mov qword [r8 + rax*8], rdx
mov ecx, 1
jmp 0x140076978
mov eax, dword [rbp - 0x50]
add eax, ecx
mov dword [rbp - 0x50], eax
add r12d, ecx
cmp r12d, dword [rbp - 0x70]
jb 0x140076936
mov r14d, 1
add r13d, r14d
cmp byte [rdi], sil
jne 0x140076887
jmp 0x1400769a5
mov ebx, 0xc000007a
mov r14d, 1
cmp qword [rbp + 0x1a8], rsi
je 0x1400769c6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, qword [rbp + 0x1a8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
jns 0x140076a19
lea r12, [0x14010a7b0]
mov rdi, r12
mov ebx, 4
cmp qword [rdi], rsi
je 0x1400769e7
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
add rdi, 0x18
sub rbx, r14
jne 0x1400769d9
xor edx, edx
lea r8d, [rbx + 0x60]
mov rcx, r12
call sub.msvcrt.dll_memset
mov r8d, 0x170
lea rdx, [0x1400d7440]
lea rcx, [0x140106020]
call sub.msvcrt.dll_memcpy
jmp 0x140076a28
mov eax, dword [0x14010bea8]
add eax, r14d
mov dword [0x14010bea8], eax
mov eax, esi
xchg dword [0x14010beac], eax
mov qword [rbp + 0x248], rsi
mov qword [rbp + 0x1e0], rsi
mov r14d, esi
mov ebx, esi
mov rax, qword gs:[0x60]
mov edi, 0x80004005
mov r13d, 0x80070000
cmp dword [rax + 0x2c0], esi
je 0x140076cef
mov rax, qword [0x140106130]
call qword [case.0x14006d218.0]
mov r12, rax
test rax, rax
jne 0x140076a98
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, r13d
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140076cf6
mov ebx, edi
jmp 0x140076cf6
mov qword [rbp + 0xf0], rsi
mov ebx, esi
mov r9d, esi
mov rdi, rsi
lea rax, [rbp + 0x184]
mov qword [rsp + 0x20], rax
mov r8, rdi
mov edx, 2
mov rcx, r12
mov rax, qword [0x140106150]
call qword [case.0x14006d218.0]
test eax, eax
jne 0x140076b47
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140076b31
cmp qword [rbp + 0xf0], rsi
jne 0x140076b28
mov edi, dword [rbp + 0x184]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, edi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
lea rcx, [rbp + 0xf0]
call fcn.1400cbba8
test rdi, rdi
je 0x140076b21
mov qword [rbp + 0xf0], rdi
mov r9d, dword [rbp + 0x184]
jmp 0x140076aa7
mov ebx, 0x8007000e
jmp 0x140076b55
mov edi, 0x80004005
mov ebx, edi
jmp 0x140076b61
mov edi, 0x80004005
test eax, eax
je 0x140076b2d
movzx ebx, ax
or ebx, r13d
test eax, eax
cmovle ebx, eax
jmp 0x140076b61
mov rax, qword [rbp + 0xf0]
mov qword [rbp + 0x248], rax
mov edi, 0x80004005
mov qword [rbp + 0xf0], rsi
lea rcx, [rbp + 0xf0]
call fcn.1400cbba8
test ebx, ebx
js 0x140076cf6
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov rax, qword [0x140106148]
call qword [case.0x14006d218.0]
mov r12, rax
test rax, rax
je 0x140076a78
mov qword [rbp + 0xf8], rsi
mov ebx, esi
mov r9d, esi
mov rdi, rsi
lea rax, [rbp + 0x180]
mov qword [rsp + 0x20], rax
mov r8, rdi
mov edx, 2
mov rcx, r12
mov rax, qword [0x140106150]
call qword [case.0x14006d218.0]
test eax, eax
jne 0x140076c45
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140076c2f
cmp qword [rbp + 0xf8], rsi
jne 0x140076c26
mov edi, dword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, edi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
lea rcx, [rbp + 0xf8]
call fcn.1400cbba8
test rdi, rdi
je 0x140076c1f
mov qword [rbp + 0xf8], rdi
mov r9d, dword [rbp + 0x180]
jmp 0x140076ba5
mov ebx, 0x8007000e
jmp 0x140076c53
mov edi, 0x80004005
mov ebx, edi
jmp 0x140076c5f
mov edi, 0x80004005
test eax, eax
je 0x140076c2b
movzx ebx, ax
or ebx, r13d
test eax, eax
cmovle ebx, eax
jmp 0x140076c5f
mov rax, qword [rbp + 0xf8]
mov qword [rbp + 0x1e0], rax
mov edi, 0x80004005
mov qword [rbp + 0xf8], rsi
lea rcx, [rbp + 0xf8]
call fcn.1400cbba8
test ebx, ebx
js 0x140076cf6
mov rcx, qword [rbp + 0x248]
test rcx, rcx
je 0x140076cef
lea rdx, str.WinSta0
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140076cef
mov rcx, qword [rbp + 0x1e0]
test rcx, rcx
je 0x140076cef
lea rdx, str.Default
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140076cef
xor eax, eax
mov dword [rbp + 0x170], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov r9d, 4
lea r8, [rbp + 0x170]
lea edx, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
test eax, eax
je 0x140076a78
mov eax, reloc.OLEAUT32.dll_SafeArrayDestroy
test byte [rbp + 0x170], al
mov eax, 1
cmove r14d, eax
mov dword [rbp + 0x80], r14d
lea rcx, [rbp + 0x1e0]
call fcn.1400cbba8
lea rcx, [rbp + 0x248]
call fcn.1400cbba8
mov eax, dword [rbp + 0x80]
test ebx, ebx
cmovs eax, esi
mov dword [rbp + 0x80], eax
mov dword [rbp + 0xe8], esi
mov edx, 4
lea ecx, [rdx + 0x3c]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
mov qword [rbp + 0x48], rax
lea rcx, [rbp + 0x140]
call fcn.1400cbb84
test rdi, rdi
jne 0x140076e14
mov qword [rbp + 0x140], rsi
mov r14d, 0x8007000e
mov qword [rbp + 0x140], rdi
mov r12, rsi
mov rbx, rsi
xor eax, eax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov dword [rbp + 0x15c], esi
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xb0], rax
mov dword [rbp + 0x98], esi
lea rax, [0x140109470]
mov qword [rbp + 0x360], rax
mov edi, RegisterTypeLib
mov qword [rbp + 0x2d8], rdi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, edi
mov r14d, 8
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
mov qword [rbp + 0x50], rax
mov r13d, 0xc0000017
test rax, rax
jne 0x140076e99
mov r14d, r13d
mov dword [rsp + 0x60], r13d
jmp 0x14007705b
mov r8, qword [rbp + 0x2d8]
mov rdx, qword [rbp + 0x360]
mov rcx, rdi
call sub.msvcrt.dll_memcpy
mov r12, rdi
mov qword [rsp + 0x70], rdi
mov ebx, dword [rbp + 0x2d8]
mov dword [rsp + 0x68], ebx
lea rax, [0x1401093b8]
mov qword [rbp + 0x368], rax
mov qword [rbp + 0x2e0], r14
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r14
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
mov qword [rbp + 0x40], rax
test rax, rax
jne 0x140076f07
mov r14d, r13d
mov dword [rsp + 0x60], r13d
mov rbx, rsi
jmp 0x14007705b
mov r8, qword [rbp + 0x2e0]
mov rdx, qword [rbp + 0x368]
mov rcx, rdi
call sub.msvcrt.dll_memcpy
mov qword [rbp - 0x78], rdi
mov rdi, qword [rbp + 0x2e0]
mov qword [rbp - 0x28], rdi
rdtsc
shl rdx, 0x20
or rax, rdx
mov qword [rbp + 0x278], rax
mov ecx, r14d
mov dword [rbp + 0x84], ecx
add ebx, 4
or r8d, 0xffffffff
mov eax, r8d
cmp ebx, 4
cmovae eax, ebx
sbb r13d, r13d
mov r11d, 0xc0000095
and r13d, r11d
mov r14d, r13d
mov dword [rsp + 0x60], r13d
mov edx, ecx
cmp ebx, 4
jb 0x140077057
mov ecx, eax
mov dword [rbp + 0x84], eax
mov edx, eax
lea eax, [rax + 8]
mov edx, r8d
cmp eax, 8
cmovae edx, eax
sbb r14d, r14d
and r14d, r11d
mov r9d, 0x10000000
add r14d, r9d
mov dword [rsp + 0x60], r14d
cmp eax, 8
jb 0x140079ba7
lea r12d, [rdi + 4]
mov eax, r8d
cmp r12d, 4
cmovae eax, r12d
sbb r14d, r14d
and r14d, r11d
mov dword [rsp + 0x60], r14d
mov dword [rbp - 0x70], r14d
cmp r12d, 4
cmovae ecx, eax
mov dword [rbp + 0x84], ecx
jb 0x140077052
lea eax, [rcx + rdx]
mov ecx, r8d
cmp eax, edx
cmovae ecx, eax
sbb r14d, r14d
and r14d, r11d
add r14d, r9d
mov dword [rsp + 0x60], r14d
cmp eax, edx
jb 0x140079ba2
mov dword [rbp + 0x84], SafeArrayDestroy
lea eax, [rcx + 0xc]
mov edi, r8d
cmp eax, ecx
cmovae edi, eax
sbb r14d, r14d
and r14d, r11d
add r14d, r9d
mov dword [rsp + 0x60], r14d
cmp eax, ecx
jb 0x140079ba2
lea r8, [rbp + 0x1c8]
mov edx, 0x7fffffff
lea rcx, str.WMPPlayer_RMEAllowed
call fcn.1400cbbe0
test eax, eax
jns 0x14007716c
mov qword [rbp + 0x1c8], rsi
mov r14d, 0xc000003e
mov rax, qword [rbp + 0x1c8]
inc rax
mov qword [rbp + 0x1c8], rax
lea ecx, [rax*2 + 4]
or r8d, 0xffffffff
mov eax, r8d
cmp ecx, 4
cmovae eax, ecx
sbb r14d, r14d
mov r11d, 0xc0000095
and r14d, r11d
mov dword [rsp + 0x60], r14d
mov edx, dword [rbp + 0x84]
cmp ecx, 4
cmovae edx, eax
mov dword [rbp + 0x84], edx
jb 0x140077052
lea eax, [rdx + rdi]
mov edx, r8d
cmp eax, edi
cmovae edx, eax
sbb r14d, r14d
and r14d, r11d
mov r9d, 0x10000000
add r14d, r9d
mov dword [rsp + 0x60], r14d
cmp eax, edi
jb 0x140079ba2
mov dword [rbp + 0x84], 8
lea eax, [rdx + 8]
mov ecx, r8d
cmp eax, edx
cmovae ecx, eax
sbb r14d, r14d
and r14d, r11d
add r14d, r9d
mov dword [rsp + 0x60], r14d
cmp eax, edx
jb 0x140079ba2
mov dword [rbp + 0x84], 8
lea eax, [rcx + 8]
mov edx, r8d
cmp eax, ecx
cmovae edx, eax
sbb r14d, r14d
and r14d, r11d
add r14d, r9d
mov dword [rsp + 0x60], r14d
cmp eax, ecx
jb 0x140079ba2
mov dword [rbp - 0x5c], edx
mov edi, edx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, edi
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdx, rax
test rax, rax
jne 0x140077266
mov r14d, 0xc0000017
jmp 0x14007704d
mov qword [rbp - 0x58], rdx
mov edi, esi
mov dword [rbp - 0x60], esi
mov dword [rbp + 0x1e8], esi
add rax, 4
mov r8, r15
cmp rax, rdx
cmovae r8, rax
sbb r14d, r14d
mov r11d, 0xc0000095
and r14d, r11d
mov dword [rsp + 0x60], r14d
cmp rax, rdx
jb 0x1400772ca
mov ecx, dword [rbp - 0x5c]
add rcx, rdx
lea rax, [rdx + 8]
cmp rax, rcx
jbe 0x1400772b3
mov dword [rdx], 4
mov eax, dword [rbp + 0x1e8]
mov dword [r8], eax
mov edi, dword [rbp - 0x60]
inc edi
mov dword [rbp - 0x60], edi
test r14d, r14d
js 0x140077052
mov edx, dword [rsp + 0x68]
test edx, edx
je 0x14007741b
cmp qword [rbp - 0x58], rsi
jne 0x140077343
or eax, 0xffffffff
cmp ebx, 4
cmovae eax, ebx
mov r14d, r13d
mov dword [rsp + 0x60], r13d
mov edx, dword [rbp + 0x108]
cmovae edx, eax
mov dword [rbp + 0x108], edx
jb 0x140077426
mov ecx, dword [rbp - 0x5c]
lea eax, [rcx + rdx]
or r8d, 0xffffffff
cmp eax, ecx
cmovae r8d, eax
mov dword [rbp - 0x5c], r8d
sbb r14d, r14d
and r14d, r11d
mov dword [rsp + 0x60], r14d
mov r13d, 1
cmp eax, ecx
jb 0x140077430
add edi, r13d
mov dword [rbp - 0x60], edi
jmp 0x14007743f
mov r8, qword [rbp - 0x58]
mov r10d, esi
mov r13d, 1
test edi, edi
je 0x1400773c7
mov r9d, dword [rbp + 0x108]
mov ebx, r11d
mov r11, r8
mov ecx, dword [r8]
add ecx, 4
or eax, 0xffffffff
cmp ecx, 4
cmovae eax, ecx
sbb r14d, r14d
and r14d, ebx
mov dword [rsp + 0x60], r14d
cmp ecx, 4
cmovae r9d, eax
mov dword [rbp + 0x108], r9d
jb 0x140077426
mov edx, r9d
mov rcx, r8
add rdx, r8
mov rax, r15
cmp rdx, r8
cmovae rax, rdx
mov r8, rax
cmp rdx, rcx
sbb r14d, r14d
and r14d, ebx
mov dword [rsp + 0x60], r14d
cmp rdx, rcx
jb 0x140077426
add r10d, r13d
cmp r10d, edi
jb 0x14007735e
mov edx, dword [rsp + 0x68]
mov r11d, ebx
lea rax, [r8 + 4]
mov r9, r15
cmp rax, r8
cmovae r9, rax
sbb r14d, r14d
and r14d, r11d
mov dword [rsp + 0x60], r14d
cmp rax, r8
jb 0x140077426
mov edi, edx
mov ecx, dword [rbp - 0x5c]
add rcx, qword [rbp - 0x58]
lea rax, [rdi + 4]
add rax, r8
cmp rax, rcx
ja 0x1400772a8
mov dword [r8], edx
mov r8d, edi
mov rdx, qword [rbp + 0x50]
mov rcx, r9
call sub.msvcrt.dll_memcpy
mov edi, dword [rbp - 0x60]
add edi, r13d
mov dword [rbp - 0x60], edi
jmp 0x14007742c
mov r14d, 0xc000000d
mov dword [rsp + 0x60], r14d
mov r13d, 1
mov r8d, dword [rbp - 0x5c]
test r14d, r14d
js 0x140077052
mov r11d, 0xc0000095
mov rbx, qword [rbp - 0x28]
test ebx, ebx
je 0x1400775ef
cmp qword [rbp - 0x58], rsi
jne 0x1400774bb
or eax, 0xffffffff
cmp r12d, 4
cmovae eax, r12d
mov r14d, dword [rbp - 0x70]
mov dword [rsp + 0x60], r14d
mov edx, dword [rbp + 0x10c]
cmovae edx, eax
mov dword [rbp + 0x10c], edx
jb 0x140077599
mov ecx, r8d
lea eax, [rdx + r8]
or r8d, 0xffffffff
cmp eax, ecx
cmovae r8d, eax
mov dword [rbp - 0x5c], r8d
sbb r14d, r14d
and r14d, r11d
mov dword [rsp + 0x60], r14d
cmp eax, ecx
jb 0x140077599
add edi, r13d
mov dword [rbp - 0x60], edi
mov rax, qword [rbp + 0x278]
mov qword [rbp + 0x2e8], rax
jmp 0x1400775b6
mov r9, qword [rbp - 0x58]
mov r11d, esi
test edi, edi
je 0x140077537
mov r10d, dword [rbp + 0x10c]
mov r12, r9
mov ecx, dword [r9]
add ecx, 4
or eax, 0xffffffff
cmp ecx, 4
cmovae eax, ecx
sbb r14d, r14d
and r14d, 0xc0000095
mov dword [rsp + 0x60], r14d
cmp ecx, 4
cmovae r10d, eax
mov dword [rbp + 0x10c], r10d
jb 0x140077593
mov edx, r10d
mov rcx, r9
add rdx, r9
mov rax, r15
cmp rdx, r9
cmovae rax, rdx
mov r9, rax
cmp rdx, rcx
sbb r14d, r14d
and r14d, 0xc0000095
mov dword [rsp + 0x60], r14d
cmp rdx, rcx
jb 0x140077593
add r11d, r13d
cmp r11d, edi
jb 0x1400774cd
lea rax, [r9 + 4]
mov r10, r15
cmp rax, r9
cmovae r10, rax
sbb r14d, r14d
mov r11d, 0xc0000095
and r14d, r11d
mov dword [rsp + 0x60], r14d
cmp rax, r9
jb 0x140077599
mov edx, ebx
mov ecx, r8d
add rcx, qword [rbp - 0x58]
lea rax, [rdx + 4]
add rax, r9
cmp rax, rcx
ja 0x1400772a8
mov dword [r9], ebx
mov r8d, edx
mov rdx, qword [rbp + 0x40]
mov rcx, r10
call sub.msvcrt.dll_memcpy
mov edi, dword [rbp - 0x60]
add edi, r13d
mov dword [rbp - 0x60], edi
mov r8d, dword [rbp - 0x5c]
mov r11d, 0xc0000095
test r14d, r14d
js 0x140077052
mov rax, qword [rbp + 0x278]
mov qword [rbp + 0x2e8], rax
cmp qword [rbp - 0x58], rsi
jne 0x1400775fc
mov dword [rbp + 0x17c], SafeArrayDestroy
lea ecx, [r8 + 0xc]
or eax, 0xffffffff
cmp ecx, r8d
cmovae eax, ecx
mov dword [rbp - 0x5c], eax
sbb r14d, r14d
and r14d, r11d
mov dword [rsp + 0x60], r14d
cmp ecx, r8d
jb 0x1400776bb
add edi, r13d
mov dword [rbp - 0x60], edi
jmp 0x1400776c4
mov r14d, 0xc000000d
mov dword [rsp + 0x60], r14d
jmp 0x140077599
mov r9, qword [rbp - 0x58]
mov r11d, esi
mov r12d, 0xc0000095
test edi, edi
je 0x140077672
mov r10d, dword [rbp + 0x17c]
mov rbx, r9
mov ecx, dword [r9]
add ecx, 4
or eax, 0xffffffff
cmp ecx, 4
cmovae eax, ecx
sbb r14d, r14d
and r14d, r12d
mov dword [rsp + 0x60], r14d
cmp ecx, 4
cmovae r10d, eax
mov dword [rbp + 0x17c], r10d
jb 0x1400776bb
mov edx, r10d
mov rcx, r9
add rdx, r9
mov rax, r15
cmp rdx, r9
cmovae rax, rdx
mov r9, rax
cmp rdx, rcx
sbb r14d, r14d
and r14d, r12d
mov dword [rsp + 0x60], r14d
cmp rdx, rcx
jb 0x1400776bb
add r11d, r13d
cmp r11d, edi
jb 0x140077614
lea rax, [r9 + 4]
mov rdx, r15
cmp rax, r9
cmovae rdx, rax
sbb r14d, r14d
and r14d, r12d
mov dword [rsp + 0x60], r14d
cmp rax, r9
jb 0x1400776bb
mov ecx, r8d
add rcx, qword [rbp - 0x58]
lea rax, [r9 + 0xc]
cmp rax, rcx
ja 0x1400772a8
mov dword [r9], 8
movsd xmm0, qword [rbp + 0x2e8]
movsd qword [rdx], xmm0
add dword [rbp - 0x60], r13d
test r14d, r14d
js 0x140077052
lea r8, [rbp + 0x260]
mov edx, 0x7fffffff
lea rcx, str.WMPPlayer_RMEAllowed
call fcn.1400cbbe0
test eax, eax
jns 0x1400776ec
mov qword [rbp + 0x260], rsi
jmp 0x140077047
mov rcx, qword [rbp + 0x260]
lea rax, [rcx + 1]
mov rdx, r15
cmp rax, rcx
cmovae rdx, rax
mov qword [rbp + 0x260], rdx
sbb r14d, r14d
mov r11d, 0xc0000095
and r14d, r11d
mov dword [rsp + 0x60], r14d
cmp rax, rcx
jb 0x14007787c
lea r9d, [rdx + rdx]
test r9d, r9d
je 0x14007786b
cmp qword [rbp - 0x58], rsi
jne 0x140077799
lea ecx, [r9 + 4]
or eax, 0xffffffff
cmp ecx, 4
cmovae eax, ecx
sbb r14d, r14d
and r14d, r11d
mov dword [rsp + 0x60], r14d
mov edi, dword [rbp + 0x110]
cmp ecx, 4
cmovae edi, eax
mov dword [rbp + 0x110], edi
jb 0x140077876
mov edx, dword [rbp - 0x5c]
lea ecx, [rdi + rdx]
or eax, 0xffffffff
cmp ecx, edx
cmovae eax, ecx
mov dword [rbp - 0x5c], eax
sbb r14d, r14d
and r14d, r11d
mov dword [rsp + 0x60], r14d
cmp ecx, edx
jb 0x140077876
add dword [rbp - 0x60], r13d
mov r14d, esi
mov dword [rsp + 0x60], esi
jmp 0x140077876
mov rdi, qword [rbp - 0x58]
mov r10d, esi
cmp dword [rbp - 0x60], esi
jbe 0x140077817
mov r8d, dword [rbp + 0x110]
mov ebx, r11d
mov r11, rdi
mov ecx, dword [rdi]
add ecx, 4
or eax, 0xffffffff
cmp ecx, 4
cmovae eax, ecx
sbb r14d, r14d
and r14d, ebx
mov dword [rsp + 0x60], r14d
cmp ecx, 4
cmovae r8d, eax
mov dword [rbp + 0x110], r8d
jb 0x140077876
mov edx, r8d
mov rcx, rdi
add rdx, rdi
mov rax, r15
cmp rdx, rdi
cmovae rax, rdx
mov rdi, rax
cmp rdx, rcx
sbb r14d, r14d
and r14d, ebx
mov dword [rsp + 0x60], r14d
cmp rdx, rcx
jb 0x140077876
add r10d, r13d
cmp r10d, dword [rbp - 0x60]
jb 0x1400777af
mov r11d, 0xc0000095
lea rax, [rdi + 4]
mov r10, r15
cmp rax, rdi
cmovae r10, rax
sbb r14d, r14d
and r14d, r11d
mov dword [rsp + 0x60], r14d
cmp rax, rdi
jb 0x140077876
mov r8d, r9d
mov ecx, dword [rbp - 0x5c]
add rcx, qword [rbp - 0x58]
lea rax, [rdi + 4]
add rax, r8
cmp rax, rcx
jbe 0x140077853
mov r14d, 0xc0000023
jmp 0x140077871
mov dword [rdi], r9d
lea rdx, str.WMPPlayer_RMEAllowed
mov rcx, r10
call sub.msvcrt.dll_memcpy
add dword [rbp - 0x60], r13d
jmp 0x140077876
mov r14d, 0xc000000d
mov dword [rsp + 0x60], r14d
mov r11d, 0xc0000095
test r14d, r14d
js 0x140077052
mov eax, dword [rbp + 0x80]
mov dword [rbp + 0x1f0], eax
cmp qword [rbp - 0x58], rsi
jne 0x1400778d8
mov dword [rbp + 0x178], 8
mov edx, dword [rbp - 0x5c]
lea ecx, [rdx + 8]
or eax, 0xffffffff
cmp ecx, edx
cmovae eax, ecx
mov dword [rbp - 0x5c], eax
sbb r14d, r14d
and r14d, r11d
mov dword [rsp + 0x60], r14d
cmp ecx, edx
jb 0x14007798d
add dword [rbp - 0x60], r13d
mov dword [rbp + 0x168], 4
jmp 0x1400779a6
mov rdi, qword [rbp - 0x58]
mov r9d, esi
cmp dword [rbp - 0x60], esi
jbe 0x140077949
mov r8d, dword [rbp + 0x178]