Function at 0x180022230
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xf0
mov rax, qword [0x180070338]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r14, qword [rbp - 0x79]
lea r12d, [rcx + 0x258]
xor esi, esi
mov dword [rbp - 0x6d], ecx
cmp ecx, r12d
mov qword [rsp + 0x40], r8
mov eax, ecx
mov qword [rsp + 0x38], rdx
mov r15d, ecx
mov r13, r9
mov rcx, qword [rbp - 0x79]
mov r10, r8
mov qword [rsp + 0x30], rcx
jae 0x180022610
mov rax, qword [rbp - 0x79]
mov ebx, dword [rbp - 0x69]
mov rdi, qword [rbp - 0x79]
mov qword [rbp - 0x59], rax
movabs r8, 0x680020003d
cmp r15d, 0xcc
ja 0x18002241e
je 0x180022369
mov eax, r15d
sub eax, 0x18
je 0x180022415
sub eax, 0x12
je 0x1800223f6
sub eax, 0x2a
je 0x1800223a8
sub eax, 0x12
je 0x180022374
cmp eax, 0x2a
jne 0x180022341
mov qword [rsp + 0x28], rsi
lea r8, [rbp - 0x61]
mov r9d, 0xf9
mov qword [rsp + 0x20], rsi
xor edx, edx
xor ecx, ecx
call fcn.1800186e0
cmp al, 0x1d
jne 0x18002235a
mov qword [rsp + 0x28], rsi
lea r8, [rbp - 0x61]
mov r9d, 0xf9
mov qword [rsp + 0x20], rsi
xor edx, edx
xor ecx, ecx
call fcn.1800186e0
mov r10, qword [rsp + 0x40]
mov ebx, 1
movsx ecx, al
mov dword [r10], ecx
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
add r15d, 0x3c
cmp r15d, r12d
jb 0x1800222a0
mov r14, qword [rbp - 0x59]
mov eax, dword [rbp - 0x6d]
jmp 0x180022614
mov r10, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov r15d, 0xcc
mov dword [rbp - 0x49], ebx
jmp 0x180022341
movsd xmm0, qword [str.andle]
lea rdx, [0x180066948]
mov eax, dword [0x180066940]
lea rcx, [rbp - 0x21]
mov r8d, 3
movsd qword [rbp - 0xf], xmm0
mov dword [rbp - 7], eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r10, qword [rsp + 0x40]
jmp 0x180022337
mov eax, dword [r13]
lea r9, [rbp - 0x69]
mov rcx, qword [rbp - 0x61]
lea rdx, [rbp - 0x51]
mov r8d, 0x4d
mov dword [rbp - 0x51], eax
call fcn.180017180
mov r10, qword [rsp + 0x40]
mov rbx, rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
cdqe
add qword [rbp - 0x61], rax
cmp dword [rbp - 0x69], 3
jge 0x180022341
mov r15d, 0xcc
mov dword [rbp - 0x49], ebx
jmp 0x180022341
movsd xmm0, qword [str.iter__]
mov eax, dword [0x180066930]
movsd qword [rbp - 0x21], xmm0
mov dword [rbp - 0x19], eax
mov qword [rbp - 0x15], r8
jmp 0x180022341
mov qword [rbp - 0x61], rdx
jmp 0x180022341
mov eax, r15d
sub eax, 0xd0
je 0x18002255a
sub eax, 0x16
je 0x180022472
sub eax, 0x22
je 0x18002298c
cmp eax, 0x1a
jne 0x180022341
movzx ecx, byte [rdx]
mov eax, 1
shl eax, cl
mov rcx, qword [rsp + 0x30]
movzx eax, al
cmp dword [r10], esi
jne 0x180022466
mov dword [0x40002008], eax
jmp 0x180022341
mov dword [0x40002010], eax
jmp 0x180022341
cmp dword [r10], 1
jbe 0x1800224d8
mov dword [rbp - 0x41], esi
mov ecx, 0x64
mov eax, ecx
sub eax, 0x5d
je 0x1800224d3
sub eax, 9
je 0x1800225f0
sub eax, 5
je 0x1800224cd
sub eax, 7
je 0x1800224b9
cmp eax, 1
jne 0x1800224c4
test rdi, rdi
je 0x1800224d3
mov rax, qword [rbp - 0x41]
cmp qword [rdi + 0x10], rax
jae 0x1800224d3
mov rdi, qword [rdi + 0x18]
test rdi, rdi
jne 0x1800224a8
jmp 0x1800224d3
mov rax, qword [0x1800643ee]
mov rdi, qword [rax + 0x18]
inc ecx
cmp ecx, 0x6b
jb 0x180022480
jmp 0x1800224d3
mov eax, dword [0x180074acc]
mov rcx, qword [rsp + 0x30]
cmp byte [rdx], 7
jbe 0x180022341
mov dword [rbp - 0x79], esi
mov ecx, 0x64
nop dword [rax]
mov eax, ecx
sub eax, 0x5d
je 0x18002233c
sub eax, 9
je 0x1800225f2
sub eax, 5
je 0x18002254f
sub eax, 7
je 0x180022538
cmp eax, 1
jne 0x180022543
test r14, r14
je 0x18002233c
mov rax, qword [rbp - 0x79]
cmp qword [r14 + 0x10], rax
jae 0x18002233c
mov r14, qword [r14 + 0x18]
test r14, r14
jne 0x180022520
jmp 0x18002233c
mov rax, qword [0x1800643ee]
mov r14, qword [rax + 0x18]
inc ecx
cmp ecx, 0x6b
jb 0x1800224f0
jmp 0x18002233c
mov eax, dword [0x180074acc]
jmp 0x18002233c
mov rax, qword [r10 + 0x88]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x3e]
call fcn.18003d350
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x180022588
mov dword [rdx], esi
mov r10, qword [rsp + 0x40]
mov rcx, qword [r10 + 0x78]
test rcx, rcx
je 0x1800225be
mov rax, qword [r10 + 0x70]
dec rcx
mov qword [r10 + 0x78], rcx
mov r8, qword [rax + rcx*8]
mov rcx, r8
mov qword [rbp - 0x59], r8
shl rcx, 5
add rcx, qword [r10 + 0x58]
mov qword [rsp + 0x30], rcx
jmp 0x180022341
mov r8, qword [r10 + 0x60]
mov qword [rbp - 0x59], r8
cmp r8, qword [r10 + 0x68]
jae 0x1800225f4
mov rcx, r8
lea rax, [r8 + 1]
shl rcx, 5
add rcx, qword [r10 + 0x58]
mov qword [rsp + 0x30], rcx
mov qword [r10 + 0x60], rax
jmp 0x180022341
jmp 0x1800225f0
jmp 0x1800225f2
mov r9, qword [r10 + 0x88]
xor edx, edx
xor r8d, r8d
lea ecx, [rdx + 0x7c]
call fcn.180026e70
mov rax, rsi
jmp 0x180022993
mov qword [rbp - 0x59], r14
lea r13d, [rax + 0x4a6]
cmp eax, r13d
jae 0x18002298c
mov rbx, qword [rbp - 0x49]
movzx r15d, byte [rbp - 0x71]
mov r12, qword [rbp - 0x79]
mov rdi, qword [rbp - 0x79]
cmp eax, 0x18f
ja 0x1800227de
je 0x180022990
sub eax, 0x2a
je 0x1800227a6
sub eax, 0x77
je 0x18002278a
sub eax, 0x2f
je 0x180022747
sub eax, 0x48
je 0x18002267b
cmp eax, 0x2f
jne 0x180022727
mov rax, qword [rcx]
mov qword [rax + 0x20], rsi
jmp 0x180022727
mov edx, 0x25
xor ecx, ecx
call fcn.180037880
test al, al
jne 0x1800226f1
mov ebx, 0x50
mov eax, ebx
sub eax, 0x50
je 0x1800226e0
sub eax, 1
je 0x1800226c9
cmp eax, 1
jne 0x1800226ea
test r15b, r15b
je 0x180022608
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.dbghelp.dll_SymRegisterCallback64]
mov rcx, r12
call qword [sym.imp.dbghelp.dll_SymCleanup]
mov rax, rsi
jmp 0x180022993
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.dbghelp.dll_SymInitialize]
test eax, eax
jne 0x1800226ea
xor r15b, r15b
jmp 0x1800226ea
mov r15b, 1
mov r12, 0xffffffffffffffff
inc ebx
cmp ebx, 0x53
jb 0x180022690
lea r9, [rbp - 0x39]
lea r8, [rbp - 0x31]
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x21]
call qword [sym.imp.SHELL32.dll_SHGetDiskFreeSpaceExW]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rcx]
call qword [0x180070438]
mov rbx, rax
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov eax, dword [rbp - 0x6d]
add eax, 0x77
mov dword [rbp - 0x6d], eax
cmp eax, r13d
jae 0x180022990
mov r10, qword [rsp + 0x40]
mov r14, qword [rbp - 0x59]
jmp 0x180022635
mov rax, qword [r10]
lea rcx, [rsp + 0x48]
mov r9, rdx
mov qword [rsp + 0x48], rax
mov rdx, r10
mov dword [rsp + 0x20], 0x75
xor r8d, r8d
call fcn.18000f1c0
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov qword [rcx], rax
test rdx, rdx
je 0x180022784
cmp dword [rdx], esi
jne 0x18002297b
mov qword [rax + 0x18], rsi
jmp 0x180022727
mov r8d, 3
lea rdx, [0x180066958]
lea rcx, [rbp - 0x21]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x18002271d
mov r8d, 3
mov dword [rbp + 1], 0x70
lea rdx, [0x180066950]
lea rcx, [rbp + 3]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
movabs r8, 0x3a006e0065
mov qword [rbp + 7], r8
mov dword [rbp + 0xd], 0x5c
jmp 0x18002271d
sub eax, 0x1be
je 0x180022972
sub eax, 0x77
je 0x18002281d
sub eax, 0x77
je 0x180022801
cmp eax, 0x77
je 0x180022990
jmp 0x180022727
mov r9, qword [r10 + 0x88]
xor edx, edx
xor r8d, r8d
lea ecx, [rdx + 0x7c]
call fcn.180026e70
mov rbx, r14
jmp 0x18002271d
mov rax, qword [r10]
mov r14d, 0xd2
mov qword [rcx + 0x10], rax
lea rax, [rax*8]
mov qword [rsp + 0x48], rax
nop word [rax + rax]
cmp r14d, 0x8e21
ja 0x1800228db
je 0x1800228cc
mov eax, r14d
sub eax, 0x5f
je 0x1800228ab
sub eax, 0x73
je 0x18002289b
cmp eax, 0x466e
jne 0x1800228f7
mov rcx, qword [0x18]
test rcx, rcx
je 0x180022880
mov rax, qword [0x20]
mov qword [rcx + 0x20], rax
mov rax, qword [rbp - 0x69]
test rax, rax
je 0x18002288d
mov qword [rax + 0x20], rsi
mov rax, qword [rbp - 0x69]
mov qword [0x18], rax
jmp 0x1800228f7
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
jmp 0x1800228f7
cmp qword [rbp - 0x69], rsi
je 0x18002290b
mov rcx, qword [0x20]
test rcx, rcx
je 0x1800228f7
mov rax, qword [0x18]
mov qword [rcx + 0x18], rax
jmp 0x1800228f7
lea rax, [rsp + 0x48]
mov qword [0x20], rax
jmp 0x1800228f7
cmp r14d, 0x9d80
je 0x18002290b
mov rax, qword [rbp - 0x69]
cmp r14d, 0xd502
cmove rax, rsi
mov qword [rbp - 0x69], rax
add r14d, 0x9cae
cmp r14d, 0x3ac14
jbe 0x180022840
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 8], rdi
test rdi, rdi
jne 0x180022722
mov r14d, SHTestTokenMembership
mov eax, r14d
sub eax, 0xf3
je 0x180022938
cmp eax, 1
je 0x180022608
jmp 0x180022961
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x180022948
mov dword [rax], 3
mov rax, qword [rsp + 0x40]
xor edx, edx
xor r8d, r8d
mov r9, qword [rax + 0x88]
lea ecx, [rdx + 0x7c]
call fcn.180026e70
inc r14d
cmp r14d, 0xf5
jb 0x180022923
jmp 0x18002271d
mov qword [rcx + 0x18], rsi
jmp 0x180022727
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x88]
jmp 0x1800225fb
mov rbx, qword [rbp - 0x49]
mov rax, rbx
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.180058e50
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret