Function at 0x1800c83d0
Capabilities:
Check for software breakpoints
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xa0
lea eax, [rdx + 0x37]
mov r10, r9
mov dword [rbp - 0x51], eax
mov rsi, r8
mov r9, rcx
cmp edx, eax
jae 0x1800c85b8
mov r12, qword [rbp + 0x7f]
add edx, 0xfffffff2
mov r13d, dword [rbp + 0x67]
mov r14d, 8
mov r15d, dword [rbp + 0x67]
mov ecx, eax
mov dword [rbp - 0x4d], edx
xor r8d, r8d
lea r11, [0x180000000]
cmp edx, 0xcc
ja case.default.0x1800c8451
movzx eax, byte [r11 + rdx + 0xc898c]
mov ecx, dword [r11 + rax*4 + 0xc895c]
add rcx, r11
jmp rcx
mov r14, qword [r10]
lea rcx, str.Alpha_To_One:
mov qword [rbp - 9], r14
call fcn.1800d6920
mov rdi, qword [0x1801f3770]
mov ebx, 0x101
mov eax, ebx
sub eax, 0xe5
je 0x1800c84fa
sub eax, 0x1c
je 0x1800c8498
sub eax, 0x2e68
je 0x1800c8515
cmp eax, 0x5cc
je 0x1800c8515
jmp 0x1800c8503
mov edx, dword [rbp - 0x29]
lea rcx, str._Z4haddDv4_sS_
call fcn.1800d6920
mov rax, qword [rbp - 0x29]
lea r9, [rbp - 0x41]
mov dword [rbp - 0x41], eax
xor r8d, r8d
mov rax, qword [rbp - 0x31]
mov edx, 0x127
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.1800445a0
mov edx, r14d
lea rcx, str.GstParseContext
call fcn.1800d6920
mov r8, qword [rbp - 0x11]
lea rax, [rbp - 0x41]
xor r9d, r9d
mov dword [rbp - 0x41], r14d
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x2e]
call fcn.1800c83d0
jmp 0x1800c8503
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add ebx, 0x3434
cmp ebx, 0xd0d0
jbe 0x1800c8472
mov r14d, 8
mov edx, dword [rbp - 0x4d]
mov ecx, dword [rbp - 0x51]
add edx, 5
mov dword [rbp - 0x4d], edx
lea eax, [rdx + 0xe]
cmp eax, ecx
jae 0x1800c85b8
mov r9, qword [rbp + 0x5f]
mov r10, qword [rbp + 0x77]
jmp 0x1800c8427
movaps xmm0, xmmword [rbp - 0x11]
lea r9, [rbp - 1]
movaps xmm1, xmmword [rbp - 0x31]
lea r8, [rbp + 0xf]
mov rcx, qword [0x1801f3770]
lea rdx, [rbp - 0x49]
movdqa xmmword [rbp - 1], xmm0
movdqa xmmword [rbp + 0xf], xmm1
mov dword [rbp - 0x49], 1
mov dword [rsp + 0x20], 0x54
call fcn.18005b970
cmp eax, 0xffffffff
jne 0x1800c851b
lea r9, str.NVDefaultBPP
xor r8d, r8d
mov edx, 0xc1
xor ecx, ecx
call fcn.1800b9450
jmp 0x1800c851b
mov byte [rbp + 0x67], 1
mov qword [rbp - 0x21], r8
mov dword [rbp - 0x35], r8d
mov dword [rbp - 0x39], r8d
jmp case.0x1800c8451.11
cmp dword [r12], 0
mov r13d, r8d
jg case.0x1800c8451.11
movzx eax, byte [rbp + 0x67]
mov rbx, qword [rsp + 0xf0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov edx, r13d
lea rcx, str.__03X_
call fcn.1800d6920
jmp 0x1800c851b
test rsi, rsi
je 0x1800c85fb
cmp qword [r12], 0
jne case.0x1800c8451.11
lea r9, str.need_key
xor r8d, r8d
mov edx, 0xc1
xor ecx, ecx
call fcn.1800b9450
jmp 0x1800c85b8
cmp dword [r12], 0
mov r13d, r8d
jle 0x1800c8710
mov rdi, rsi
nop dword [rax]
nop dword [rax + rax]
movsx edx, byte [rdi]
lea rcx, str._02X
call fcn.1800d6920
inc r13d
lea rdi, [rdi + 1]
mov eax, r13d
and eax, 0x80000007
jge 0x1800c8657
dec eax
or eax, 0xfffffff8
inc eax
test eax, eax
jne 0x1800c8667
lea rcx, [0x1801de8e4]
call fcn.1800d6920
mov eax, r13d
and eax, 0x8000000f
jge 0x1800c8678
dec eax
or eax, 0xfffffff0
inc eax
test eax, eax
jne 0x1800c8703
mov ebx, reloc.SHELL32.dll_PathMakeUniqueName
mov eax, ebx
sub eax, 0x2f
je 0x1800c86d2
sub eax, 0x33
je 0x1800c86c0
sub eax, 0x33
je 0x1800c86b2
cmp eax, 0x33
jne 0x1800c86f8
cmp r13d, dword [r12]
jge 0x1800c86f8
mov edx, r13d
lea rcx, str.__03X_
call fcn.1800d6920
jmp 0x1800c86f8
lea rcx, [0x1801e1ef0]
call fcn.1800d6920
jmp 0x1800c86f8
lea rcx, [0x1801de8e4]
call fcn.1800d6920
lea eax, [r13 - 8]
jmp 0x1800c86d6
lea eax, [r13 - 0x10]
movsxd rcx, eax
lea r9, [rbp - 0x49]
add rcx, rsi
mov dword [rbp - 0x49], r14d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
xor ecx, ecx
mov edx, 0x127
call fcn.1800445a0
add ebx, 0x33
cmp ebx, 0xfb
jb 0x1800c8685
cmp r13d, dword [r12]
jl 0x1800c8630
mov edx, dword [rbp - 0x4d]
mov edi, r13d
and edi, 0x8000000f
jge 0x1800c8722
dec edi
or edi, 0xfffffff0
inc edi
test edi, edi
je case.0x1800c8451.11
mov ebx, 0x21
nop
mov eax, ebx
mov ecx, r15d
sub eax, 0x21
je 0x1800c87dd
sub eax, 0x3b
je 0x1800c879e
sub eax, 0x3b
je 0x1800c8762
cmp eax, 0x3b
jne 0x1800c8825
lea rcx, [0x1801e1ef0]
call fcn.1800d6920
jmp 0x1800c8825
mov r15d, edi
sub r15d, ecx
test r15d, r15d
jle 0x1800c8825
mov eax, r13d
mov dword [rbp - 0x49], r15d
sub eax, r15d
lea r9, [rbp - 0x49]
movsxd rcx, eax
xor r8d, r8d
add rcx, rsi
mov edx, 0x127
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call fcn.1800445a0
jmp 0x1800c8825
mov eax, r13d
lea r9, [rbp - 0x49]
cmp edi, 8
mov r15d, edi
mov edx, 0x127
cmovg r15d, r14d
sub eax, edi
movsxd rcx, eax
xor r8d, r8d
add rcx, rsi
mov dword [rbp - 0x49], r15d
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call fcn.1800445a0
lea rcx, [0x1801de8e4]
call fcn.1800d6920
jmp 0x1800c8825
mov r15d, reloc.SHELL32.dll_ILFindLastID
lea rcx, [0x1801de8e4]
sub r15d, edi
call fcn.1800d6920
cmp r15d, 8
jle 0x1800c8804
lea rcx, [0x1801de8e4]
call fcn.1800d6920
test r15d, r15d
je 0x1800c8822
nop dword [rax]
lea rcx, [0x1801e2458]
call fcn.1800d6920
sub r15d, 1
jne 0x1800c8810
dec r15d
add ebx, 0x3b
cmp ebx, 0x10d
jb 0x1800c8730
jmp 0x1800c851b
mov edx, dword [rbp - 0x35]
lea r9, [rbp - 0x39]
mov rcx, qword [rbp - 0x21]
xor r8d, r8d
call qword [sym.imp.SHELL32.dll_SHChangeNotification_Lock]
mov qword [rbp - 0x19], rax
jmp 0x1800c851b
test r9, r9
je 0x1800c8876
cmp qword [r10], 0
je 0x1800c8876
mov rax, qword [r12]
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x31], rsi
mov qword [rbp - 0x11], r9
jmp case.0x1800c8451.11
lea r9, str.need_data
xor r8d, r8d
mov edx, 0xc1
xor ecx, ecx
call fcn.1800b9450
jmp 0x1800c85b8
mov rcx, qword [rbp - 0x19]
movzx eax, byte [rbp + 0x67]
test rcx, rcx
cmovne r8d, eax
test r8b, r8b
je 0x1800c88b0
call qword [sym.imp.SHELL32.dll_SHChangeNotification_Unlock]
nop dword [rax + rax]
mov edi, 0xc7
mov eax, edi
sub eax, 0xc7
je 0x1800c88e2
sub eax, 0x46
je 0x1800c88d5
cmp eax, 0x46
jne 0x1800c8938
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1800c8938
mov rcx, qword [rsi + 0x38]
lea rdx, [rsi + 0x58]
call qword [rsi + 0x30]
jmp 0x1800c8938
mov rcx, qword [rsi + 0x18]
lea rbx, [rsi + 0x58]
mov rdx, rbx
call qword [rsi + reloc.SHELL32.dll_ILFindLastID]
test al, al
je 0x1800c894c
cmp qword [rbx + 0x18], 0x10
jb 0x1800c88fe
mov rbx, qword [rbx]
movzx eax, word [rsi + 0x78]
lea r8, [rbp + 0x67]
mov rcx, qword [0x1801ef070]
mov r9d, 0x42
mov rdx, rbx
mov word [rbp + 0x67], ax
call fcn.1800aeea0
test al, al
jne case.0x1800c8451.0
mov rdx, qword [0x1801ef070]
mov ecx, SHSetFolderPathW
call fcn.1800af840
test al, al
je 0x1800c894c
add edi, 0x46
cmp edi, 0x199
jb 0x1800c88b5
jmp 0x1800c88b0
xor al, al
jmp 0x1800c85bc
mov al, 1
jmp 0x1800c85bc