Function at 0x1800acb10
Capabilities:
Query environment variable
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x390]
sub rsp, 0x490
mov rax, qword [0x1801483c0]
xor rax, rsp
mov qword [rbp + 0x380], rax
mov r15, rdx
mov qword [rbp - 0x68], rdx
xor esi, esi
mov r12d, esi
mov dword [rsp + 0x68], esi
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x1800acc05
lea r13, [0x1801491d8]
mov rcx, qword [0x1801491d8]
cmp rcx, r13
je 0x1800acbd5
test byte [rcx + 0x1c], 4
je 0x1800acbd5
cmp byte [rcx + 0x19], 5
jb 0x1800acbd5
mov edx, 0x1ed
mov r9d, eax
lea r8, [0x180126448]
mov rcx, qword [rcx + 0x10]
call fcn.18001fa80
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.1800d5000
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov r14d, esi
mov dword [rsp + 0x6c], esi
cmp dword [rsp + 0x70], esi
jbe 0x1800acbd5
lea r13, [0x1801491d8]
movabs rbx, 0x7fffffffffffffff
mov dword [rbp - 0x80], 0xc8
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x80]
lea r8, [rbp + 0x1a0]
mov edx, r14d
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x1800acc9a
mov rcx, qword [0x1801491d8]
cmp rcx, r13
je 0x1800ad879
test byte [rcx + 0x1c], 4
je 0x1800ad879
cmp byte [rcx + 0x19], 5
jb 0x1800ad879
mov edx, 0x1ee
mov r9d, eax
lea r8, [0x180126448]
mov rcx, qword [rcx + 0x10]
call fcn.18001fa80
jmp 0x1800ad879
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], rsi
lea rax, [rbp + 0x1a0]
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rax + rdi], 0
jne 0x1800accb7
cmp rdi, rbx
ja 0x1800ad897
cmp rdi, 0xf
ja 0x1800accf5
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], 0xf
mov r8, rdi
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp - 0x28]
call fcn.180100680
mov byte [rbp + rdi - 0x28], 0
jmp 0x1800acd4d
mov rsi, rdi
or rsi, 0xf
cmp rsi, rbx
jbe 0x1800acd06
mov rsi, rbx
jmp 0x1800acd13
cmp rsi, 0x16
mov eax, 0x16
cmovb rsi, rax
lea rcx, [rsi + 1]
call fcn.180011160
mov rbx, rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], rsi
mov r8, rdi
lea rdx, [rbp + 0x1a0]
mov rcx, rax
call fcn.180100680
mov byte [rbx + rdi], 0
xor esi, esi
movabs rbx, 0x7fffffffffffffff
mov qword [rsp + 0x78], rsi
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x1a0]
mov rcx, r15
call qword [0x180148030]
test eax, eax
je 0x1800acdba
mov rcx, qword [0x1801491d8]
cmp rcx, r13
je 0x1800ad828
test byte [rcx + 0x1c], 4
je 0x1800ad7f3
cmp byte [rcx + 0x19], 5
jb 0x1800ad7f3
mov edx, 0x1ef
mov r9d, eax
lea r8, [0x180126448]
mov rcx, qword [rcx + 0x10]
call fcn.18001fa80
jmp 0x1800ad7ec
mov rax, qword [rsp + 0x78]
mov qword [rbp - 0x60], rax
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x48]
call fcn.1800ad8d0
nop
mov dword [rsp + 0x64], 0x12c
mov dword [rsp + 0x60], esi
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.FriendlyName
mov rcx, qword [rsp + 0x78]
call qword [0x180148040]
test eax, eax
jne 0x1800acf62
cmp dword [rsp + 0x60], 1
jne 0x1800acf62
mov r8d, 3
lea rdx, [0x180126340]
lea rcx, [rbp - 0x28]
call fcn.18001eb30
lea rax, [rbp + 0x70]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1800ace40
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 0x28]
call fcn.18001eb30
mov rdi, qword [rbp - 0x18]
mov rsi, qword [rbp - 0x10]
cmp rdi, rsi
jae 0x1800ace86
lea rax, [rdi + 1]
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x28]
cmp rsi, 0xf
cmova rax, qword [rbp - 0x28]
mov word [rax + rdi], 0x22
xor esi, esi
jmp 0x1800acf78
mov rax, rbx
sub rax, rdi
cmp rax, 1
jb 0x1800ad891
lea r15, [rdi + 1]
mov rbx, r15
or rbx, 0xf
movabs rdx, 0x7fffffffffffffff
cmp rbx, rdx
jbe 0x1800aceb5
mov rbx, rdx
jmp 0x1800aced6
mov rcx, rsi
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp rsi, rax
jbe 0x1800acecb
mov rbx, rdx
jmp 0x1800aced6
lea rax, [rcx + rsi]
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
call fcn.180011160
mov r14, rax
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x10], rbx
mov r8, rdi
mov rcx, rax
cmp rsi, 0xf
jbe 0x1800acf4a
mov rbx, qword [rbp - 0x28]
mov rdx, rbx
call fcn.180100680
mov word [rdi + r14], 0x22
lea rdx, [rsi + 1]
cmp rdx, 0x1000
jb 0x1800acf32
add rdx, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x1800ad8b5
mov rbx, rcx
lfence
mov rcx, rbx
call fcn.1800d504c
mov qword [rbp - 0x28], r14
mov r12d, dword [rsp + 0x68]
xor esi, esi
jmp 0x1800acf78
lea rdx, [rbp - 0x28]
call fcn.180100680
mov word [rdi + r14], 0x22
mov qword [rbp - 0x28], r14
xor esi, esi
jmp 0x1800acf78
mov r8d, 2
lea rdx, [0x1801251bc]
lea rcx, [rbp - 0x28]
call fcn.18001eb30
mov r8d, 2
lea rdx, [0x1801251bc]
lea rcx, [rbp - 0x28]
call fcn.18001eb30
mov dword [rsp + 0x64], 0x12c
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.LoadBehavior
mov rcx, qword [rsp + 0x78]
call qword [0x180148040]
test eax, eax
jne 0x1800ad027
cmp dword [rsp + 0x60], 4
jne 0x1800ad027
mov r9d, dword [rbp + 0x70]
lea r8, str.0x_lx
mov edx, 0xa
lea rcx, [rbp + 0x58]
call fcn.1800593e0
mov r8d, 6
lea rdx, str.Load:
lea rcx, [rbp - 0x28]
call fcn.18001eb30
lea rax, [rbp + 0x58]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1800ad010
lea rdx, [rbp + 0x58]
lea rcx, [rbp - 0x28]
call fcn.18001eb30
mov r8d, 2
lea rdx, [0x1801251bc]
lea rcx, [rbp - 0x28]
call fcn.18001eb30
mov dword [rsp + 0x64], 0x12c
mov dword [rsp + 0x60], esi
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.Manifest
mov rcx, qword [rsp + 0x78]
call qword [0x180148040]
test eax, eax
jne 0x1800ad1c8
cmp dword [rsp + 0x60], 1
jne 0x1800ad1c8
mov r8d, VariantTimeToDosDateTime
lea rdx, str.Manifest:__
lea rcx, [rbp - 0x28]
call fcn.18001eb30
lea rax, [rbp + 0x70]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1800ad0b0
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 0x28]
call fcn.18001eb30
mov rdi, qword [rbp - 0x18]
mov rsi, qword [rbp - 0x10]
cmp rdi, rsi
jae 0x1800ad0f4
lea rax, [rdi + 1]
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x28]
cmp rsi, 0xf
cmova rax, qword [rbp - 0x28]
mov word [rax + rdi], 0x22
jmp 0x1800ad1c6
movabs rdx, 0x7fffffffffffffff
mov rax, rdx
sub rax, rdi
cmp rax, 1
jb 0x1800ad891
lea r15, [rdi + 1]
mov rbx, r15
or rbx, 0xf
cmp rbx, rdx
jbe 0x1800ad123
mov rbx, rdx
jmp 0x1800ad144
mov rcx, rsi
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp rsi, rax
jbe 0x1800ad139
mov rbx, rdx
jmp 0x1800ad144
lea rax, [rsi + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
call fcn.180011160
mov r14, rax
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x10], rbx
mov r8, rdi
mov rcx, rax
cmp rsi, 0xf
jbe 0x1800ad1b2
mov rbx, qword [rbp - 0x28]
mov rdx, rbx
call fcn.180100680
mov word [r14 + rdi], 0x22
lea rdx, [rsi + 1]
cmp rdx, 0x1000
jb 0x1800ad1a0
add rdx, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x1800ad8b5
mov rbx, rcx
lfence
mov rcx, rbx
call fcn.1800d504c
mov r12d, dword [rsp + 0x68]
jmp 0x1800ad1c2
lea rdx, [rbp - 0x28]
call fcn.180100680
mov word [r14 + rdi], 0x22
mov qword [rbp - 0x28], r14
xor esi, esi
mov r8d, 2
lea rdx, [0x1801251bc]
lea rcx, [rbp - 0x28]
call fcn.18001eb30
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], rsi
mov qword [rbp + 0x10], rsi
lea rax, [rbp + 0x1a0]
mov rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x1800ad200
movabs r15, 0x7fffffffffffffff
cmp rdi, r15
ja 0x1800ad891
cmp rdi, 0xf
ja 0x1800ad248
mov qword [rbp + 8], rdi
mov qword [rbp + 0x10], 0xf
mov r8, rdi
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp - 8]
call fcn.180100680
mov byte [rbp + rdi - 8], 0
jmp 0x1800ad296
mov rsi, rdi
or rsi, 0xf
cmp rsi, r15
jbe 0x1800ad259
mov rsi, r15
jmp 0x1800ad266
cmp rsi, 0x16
mov eax, 0x16
cmovb rsi, rax
lea rcx, [rsi + 1]
call fcn.180011160
mov rbx, rax
mov qword [rbp - 8], rax
mov qword [rbp + 8], rdi
mov qword [rbp + 0x10], rsi
mov r8, rdi
lea rdx, [rbp + 0x1a0]
mov rcx, rax
call fcn.180100680
mov byte [rbx + rdi], 0
xor esi, esi
mov r8d, 6
lea rdx, str.CLSID
lea rcx, [rbp - 8]
call fcn.18001eb30
mov qword [rbp - 0x78], rsi
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 0xf
cmova rdx, qword [rbp - 8]
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
call qword [0x180148030]
test eax, eax
jne 0x1800ad788
mov rdi, qword [rbp - 0x78]
mov byte [rbp - 0x58], al
mov qword [rbp - 0x50], rdi
or r12d, 2
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x64], 0x12c
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, [0x180120bf1]
mov rcx, qword [rbp - 0x78]
call qword [0x180148040]
test eax, eax
jne 0x1800ad775
cmp dword [rsp + 0x60], 1
jne 0x1800ad775
lea rax, [rbp + 0x70]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1800ad350
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 0x28]
call fcn.18001eb30
mov r8d, 2
lea rdx, [0x1801251bc]
lea rcx, [rbp - 0x28]
call fcn.18001eb30
mov rsi, qword [rbp + 0x10]
cmp rsi, 6
jb 0x1800ad3ba
lea rbx, [rbp - 8]
cmp rsi, 0xf
cmova rbx, qword [rbp - 8]
mov qword [rbp + 8], 6
mov r8d, 6
lea rdx, str.CLSID_
mov rcx, rbx
call fcn.180100680
mov byte [rbx + 6], 0
jmp 0x1800ad457
mov rcx, rsi
shr rcx, 1
mov rax, r15
sub rax, rcx
cmp rsi, rax
jbe 0x1800ad3d0
mov rbx, r15
jmp 0x1800ad3e0
lea rax, [rsi + rcx]
mov ebx, 0xf
cmp rax, rbx
cmova rbx, rax
lea rcx, [rbx + 1]
call fcn.180011160
mov r14, rax
mov qword [rbp + 8], 6
mov qword [rbp + 0x10], rbx
mov ecx, dword [str.CLSID_]
mov dword [rax], ecx
movzx ecx, word [0x1801263b4]
mov word [rax + 4], cx
mov byte [rax + 6], 0
cmp rsi, 0xf
jbe 0x1800ad453
lea rdx, [rsi + 1]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800ad442
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800ad89d
lfence
call fcn.1800d504c
mov rdi, qword [rbp - 0x50]
mov r12d, dword [rsp + 0x68]
mov qword [rbp - 8], r14
lea rax, [rbp + 0x70]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1800ad462
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 8]
call fcn.18001eb30
mov r8d, 0xf
lea rdx, str.InprocServer32
lea rcx, [rbp - 8]
call fcn.18001eb30
xor esi, esi
mov qword [rbp - 0x70], rsi
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 0xf
cmova rdx, qword [rbp - 8]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
call qword [0x180148030]
test eax, eax
je 0x1800ad507
mov rcx, qword [0x1801491d8]
cmp rcx, r13
je 0x1800ad775
test byte [rcx + 0x1c], 4
je 0x1800ad775
cmp byte [rcx + 0x19], 5
jb 0x1800ad775
mov edx, 0x1f0
mov r9d, eax
lea r8, [0x180126448]
mov rcx, qword [rcx + 0x10]
call fcn.18001fa80
jmp 0x1800ad775
mov rbx, qword [rbp - 0x70]
mov byte [rbp - 0x38], 0
mov qword [rbp - 0x30], rbx
or r12d, 4
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x64], 0x12c
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, [0x180120bf1]
mov rcx, qword [rbp - 0x70]
call qword [0x180148040]
test eax, eax
jne 0x1800ad763
mov eax, dword [rsp + 0x60]
dec eax
cmp eax, 1
ja 0x1800ad763
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x28], rsi
mov qword [rbp + 0x30], rsi
lea rax, [rbp + 0x70]
mov r14, 0xffffffffffffffff
inc r14
cmp byte [rax + r14], 0
jne 0x1800ad581
cmp r14, r15
ja 0x1800ad8af
cmp r14, 0xf
ja 0x1800ad5be
mov qword [rbp + 0x28], r14
mov qword [rbp + 0x30], 0xf
mov r8, r14
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x18]
call fcn.180100680
mov byte [rbp + r14 + 0x18], 0
jmp 0x1800ad614
mov r15, r14
or r15, 0xf
movabs rdx, 0x7fffffffffffffff
cmp r15, rdx
jbe 0x1800ad5d9
mov r15, rdx
jmp 0x1800ad5e6
cmp r15, 0x16
mov eax, 0x16
cmovb r15, rax
lea rcx, [r15 + 1]
call fcn.180011160
mov rsi, rax
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x28], r14
mov qword [rbp + 0x30], r15
mov r8, r14
lea rdx, [rbp + 0x70]
mov rcx, rax
call fcn.180100680
mov byte [rsi + r14], 0
xor esi, esi
lea rdx, [rbp + 0x18]
cmp qword [rbp + 0x30], 0xf
cmova rdx, qword [rbp + 0x18]
mov r8, qword [rbp + 0x28]
lea rcx, [rbp - 0x28]
call fcn.18001eb30
mov r8d, 2
lea rdx, [0x1801251bc]
lea rcx, [rbp - 0x28]
call fcn.18001eb30
cmp dword [rsp + 0x60], 2
jne 0x1800ad69a
lea rcx, [rbp + 0x18]
cmp qword [rbp + 0x30], 0xf
cmova rcx, qword [rbp + 0x18]
mov r8d, 0x104
lea rdx, [rbp + 0x270]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea rax, [rbp + 0x270]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1800ad680
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x18]
call fcn.18001edd0
lea rdx, [rbp + 0x18]
cmp qword [rbp + 0x30], 0xf
cmova rdx, qword [rbp + 0x18]
lea rcx, [rbp + 0x38]
call fcn.180052140
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x1800ad6c0
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.18001eb30
nop
mov rdx, qword [rbp + 0x50]
cmp rdx, 0xf
jbe 0x1800ad708
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800ad703
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800ad8a3
call fcn.1800d504c
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], 0xf
mov byte [rbp + 0x38], 0
mov rdx, qword [rbp + 0x30]
cmp rdx, 0xf
jbe 0x1800ad753
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800ad74e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800ad8a9
call fcn.1800d504c
mov qword [rbp + 0x28], rsi
mov qword [rbp + 0x30], 0xf
mov byte [rbp + 0x18], 0
and r12d, 0xfffffffb
mov dword [rsp + 0x68], r12d
mov rcx, rbx
call qword [0x180148018]
and r12d, 0xfffffffd
mov dword [rsp + 0x68], r12d
mov rcx, rdi
call qword [0x180148018]
nop
mov rdx, qword [rbp + 0x10]
cmp rdx, 0xf
jbe 0x1800ad7c3
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800ad7be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800ad8b5
call fcn.1800d504c
mov qword [rbp + 8], rsi
mov qword [rbp + 0x10], 0xf
mov byte [rbp - 8], 0
cmp byte [rbp - 0x48], 0
jne 0x1800ad7e3
mov rcx, qword [rbp - 0x40]
call qword [0x180148018]
mov r15, qword [rbp - 0x68]
mov r14d, dword [rsp + 0x6c]
mov rcx, qword [0x1801491d8]
cmp rcx, r13
je 0x1800ad828
test byte [rcx + 0x1c], 4
je 0x1800ad828
cmp byte [rcx + 0x19], 4
jb 0x1800ad828
lea r9, [rbp - 0x28]
cmp qword [rbp - 0x10], 0xf
cmova r9, qword [rbp - 0x28]
mov edx, 0x1f1
lea r8, [0x180126448]
mov rcx, qword [rcx + 0x10]
call fcn.18002b820
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x1800ad85f
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800ad85a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800ad8bb
call fcn.1800d504c
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], 0xf
mov byte [rbp - 0x28], 0
movabs rbx, 0x7fffffffffffffff
inc r14d
mov dword [rsp + 0x6c], r14d
cmp r14d, dword [rsp + 0x70]
jb 0x1800acc23
jmp 0x1800acbd5
call fcn.180014060
nop
call fcn.180014060
nop
call fcn.1800dbd50
nop
call fcn.1800dbd50
nop
call fcn.1800dbd50
int3
call fcn.180014060
nop
call fcn.1800dbd50
nop
call fcn.1800dbd50
int3