Function at 0x180017a80
Capabilities:
Check for software breakpoints
Reference http user-agent string

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2070]
mov eax, 0x2170
call fcn.18006fe70
sub rsp, rax
mov rax, qword [0x180089b10]
xor rax, rsp
mov qword [rbp + 0x2060], rax
mov r12, r8
mov rdi, rdx
mov qword [rsp + 0x40], rdx
mov r13d, ecx
mov dword [rsp + 0x38], ecx
movdqa xmm0, xmmword [0x18007f320]
movdqa xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
movdqa xmm1, xmm0
movdqa xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], 0
movdqa xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
mov r15d, ecx
lea ebx, [rcx + 0x1192]
cmp ecx, ebx
movzx ebx, byte [rsp + 0x30]
mov byte [rsp + 0x30], bl
jae 0x180017ee4
xor ecx, ecx
mov edx, 0x6f4d
mov esi, 0x2f61
mov r10d, 0x697a
mov r11d, 0x6c6c
mov r8d, 0x302e
lea r14d, [rcx + 0x35]
mov r9d, 0x7377
lea eax, [r15 + 0x1192]
nop dword [rax + rax]
cmp r15d, 0x431
ja 0x180017d04
je 0x180017cf4
cmp r15d, 0x1d2
ja 0x180017c3b
je 0x180017c01
cmp r15d, 0x125
ja 0x180017be1
je 0x180017bc4
mov eax, r15d
sub eax, 0x78
je 0x180017bae
sub eax, 0x58
je 0x180017ba5
cmp eax, 0x29
jne 0x180017ecd
mov word [rbp + 0x40], cx
lea r8d, [rax - 0x28]
lea rdx, [0x180076de8]
lea rcx, [rbp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x180017eae
mov word [rbp + 0x30], dx
jmp 0x180017ecd
mov qword [rbp - 0x18], rdi
cmp qword [rdi + 0x1a], 0
jne 0x180017ecd
xor bl, bl
jmp 0x180018d37
mov rdx, qword [rbp - 0x18]
add rdx, 0xa
mov r8d, ILFree
lea rcx, [rsp + 0x50]
call fcn.18005d170
jmp 0x180017eae
mov eax, r15d
sub eax, 0x17d
je 0x180017bf5
cmp eax, 0x29
je 0x180017c1b
jmp 0x180017ecd
mov dword [rbp + 0x32], 0x6c6c697a
jmp 0x180017ecd
mov eax, 0x6e
cmp eax, 0x6e
je 0x180017ffb
add eax, 0x32b4
cmp eax, 0x32b4
jbe 0x180017c06
mov dword [rbp + 0x42], 0x73
mov r8d, 0xa
lea rdx, [rbp + 0x44]
lea ecx, [r8 - 8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultow]
jmp 0x180017eae
cmp r15d, 0x300
ja 0x180017cbe
je 0x180017c8d
mov eax, r15d
sub eax, 0x22a
je 0x180017c81
sub eax, 0x29
je 0x180017c75
cmp eax, 0x84
lea eax, [r13 + 0x1192]
jne 0x180017ed4
mov word [rbp + 0x39], r8w
mov byte [rbp + 0x3b], 0
jmp 0x180017ed4
mov dword [rbp + 0x46], 0x5f
jmp 0x180017ecd
mov dword [rbp + 0x36], 0x352f61
jmp 0x180017ecd
mov r8d, 0xa
lea rdx, [rbp + 0x48]
lea ecx, [r8 + 0x16]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ltow]
movsd xmm0, qword [str..dll]
movsd qword [rbp + 0x4c], xmm0
movzx eax, word [0x180076ec0]
mov word [rbp + 0x54], ax
jmp 0x180017eae
mov eax, r15d
sub eax, 0x384
je 0x180017ce9
cmp eax, 0x29
jne 0x180017ecd
lea r8, [rbp + 0x40]
lea edx, [rax - 0x19]
lea ecx, [rax + 0x48]
call fcn.1800053d0
mov qword [rbp - 8], rax
jmp 0x180017eae
mov word [rbp], 0x57
jmp 0x180017ecd
mov dword [rbp + 1], 0x6f646e69
mov byte [rbp + 5], 0
jmp 0x180017ed4
cmp r15d, 0x661
ja 0x180017f7a
je 0x180017f6f
cmp r15d, 0x58b
ja 0x180017df0
je 0x180017de7
mov eax, r15d
sub eax, 0x45a
je 0x180017d95
sub eax, 0x84
je 0x180017d8b
cmp eax, 0x29
jne 0x180017ecd
xor r9d, r9d
mov r8d, 0x2000
lea rdx, [rbp + 0x60]
mov rcx, qword [rdi]
call qword [rbp - 8]
mov dword [rbp - 0x40], eax
test eax, eax
jne 0x180017ea9
mov edx, 0x3b
mov ecx, edx
sub ecx, 0x3b
je 0x180017d79
cmp ecx, 1
je 0x180018d37
jmp 0x180017d7f
xor bl, bl
mov byte [rsp + 0x30], bl
inc edx
cmp edx, 0x3d
jb 0x180017d67
jmp 0x180017ea9
mov word [rbp + 5], r9w
jmp 0x180017ecd
mov dword [rsp + 0x28], 0xc4
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8, rdi
xor edx, edx
xor ecx, ecx
call fcn.18001d620
test al, al
jne 0x180017eae
mov ecx, 0xcc
nop
mov eax, ecx
sub eax, 0xcb
je 0x180018d37
cmp eax, 1
jne 0x180017dd8
xor bl, bl
mov byte [rsp + 0x30], bl
dec ecx
cmp ecx, 0xca
ja 0x180017dc0
jmp 0x180017eae
mov byte [rbp + 7], 0x20
jmp 0x180017ed4
cmp r15d, 0x5b4
je 0x180017e26
cmp r15d, 0x638
jne 0x180017ed4
mov byte [rbp + 8], 0
mov r8d, 2
lea rdx, [0x1800784eb]
lea rcx, [rbp]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x180017eae
movsxd rsi, dword [rbp - 0x40]
test esi, esi
jns 0x180017e59
mov eax, 0xcd
cmp eax, 0xcd
je 0x180017e47
cmp eax, 0x4745
je 0x180018d37
jmp 0x180017e4d
xor bl, bl
mov byte [rsp + 0x30], bl
add eax, 0x4678
cmp eax, 0x8cf0
jbe 0x180017e33
mov r14, rsi
mov rdx, qword [r12 + 0x10]
mov rcx, qword [r12 + 0x18]
mov rax, rcx
sub rax, rdx
cmp rsi, rax
ja 0x180017f53
lea rax, [rdx + rsi]
mov qword [r12 + 0x10], rax
mov rax, r12
cmp rcx, 0x10
jb 0x180017e8b
mov rax, qword [r12]
lea rsi, [rax + rdx]
mov r8, r14
lea rdx, [rbp + 0x60]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + r14], 0
mov r14d, 0x35
mov esi, 0x2f61
mov r11d, 0x6c6c
mov r10d, 0x697a
mov r9d, 0x7377
mov r8d, 0x302e
mov edx, 0x6f4d
xor ecx, ecx
lea eax, [r13 + 0x1192]
add r15d, 0xad
cmp r15d, eax
jb 0x180017b40
lea eax, [r13 - 0x19]
lea rdx, [0x180000000]
cmp r13d, eax
jbe 0x180018260
lea esi, [r13 - 0xb8]
mov edx, 0x4b
mov edi, 0x656b
lea ebx, [rdx + 0x1b]
lea r14d, [rdx - 0x32]
mov r12d, 0x6153
lea r8d, [rdx - 0x17]
lea r15d, [rdx + 0x1e]
lea r9d, [rdx + 0x24]
mov r10d, 0x3330
lea r11d, [rdx - 8]
lea r13d, [rdx - 0x1a]
cmp esi, 0x18
ja case.default.0x180017f51
lea rcx, [0x180000000]
mov ecx, dword [rcx + rsi*4 + 0x18e3c]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x60]
xor r8d, r8d
mov rdx, r14
mov rcx, r12
call fcn.180002030
jmp 0x180017ea3
mov bl, 1
mov byte [rsp + 0x30], bl
jmp 0x180017ed4
mov eax, r15d
sub eax, 0x6e5
je 0x180017ff2
sub eax, 0x29
je 0x180018d37
sub eax, 0x84
je 0x180017fd6
sub eax, 0xad
je 0x180017fc6
cmp eax, 0xad
jne 0x180017ecd
mov r8d, 3
lea rdx, [0x1800784c3]
lea rcx, [rbp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x23], 0
jmp 0x180017eae
mov dword [rbp - 0xf], 0x34366e69
mov byte [rbp - 0xb], 0
jmp 0x180017ecd
mov r8d, 1
lea rdx, [0x180078525]
lea rcx, [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x180017eae
mov byte [rbp - 0x10], 0
jmp 0x180017ecd
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 8]
mov word [rsp + 0x30], ax
lea r9, [rsp + 0x30]
mov r8d, 0x10b
mov rdx, r12
lea rcx, [rsp + 0x50]
call fcn.1800105d0
mov rbx, rax
jmp 0x180018d37
movzx eax, word [0x18007855a]
mov word [rbp - 0x38], ax
movzx eax, byte [0x18007855c]
mov byte [rbp - 0x36], al
jmp case.default.0x180017f51
mov byte [rbp - 0x2c], 0
mov word [rbp - 0x18], r12w
jmp case.default.0x180017f51
mov byte [rbp - 2], 0
mov word [rbp - 0x28], dx
jmp case.default.0x180017f51
mov byte [rbp + 0x26], 0
mov r8d, 1
lea rdx, [0x180078572]
lea rcx, [rbp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov edx, 0x4b
lea r8d, [rdx - 0x17]
lea r9d, [rdx + 0x24]
mov r10d, 0x3330
lea r11d, [rdx - 8]
jmp case.default.0x180017f51
mov byte [rbp - 0x34], 0
mov word [rbp - 0x30], r8w
jmp case.default.0x180017f51
mov dword [rbp + 0x13], 0x656d6f
jmp case.default.0x180017f51
mov r8d, 3
lea rdx, [0x180078588]
lea rcx, [rbp + 0x11]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x180018078
mov word [rbp - 0x3f], r15w
jmp case.default.0x180017f51
mov word [rbp + 0x1c], r9w
jmp case.default.0x180017f51
mov word [rbp - 0x2e], r10w
jmp case.default.0x180017f51
lea rcx, [rbp - 0x28]
dec rcx
nop dword [rax]
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x1800180f0
movzx eax, word [0x18007858c]
mov word [rcx], ax
mov eax, 0x54
mov word [rbp - 0x26], ax
jmp case.default.0x180017f51
mov r8d, 0xa
lea rdx, [rbp - 0x1c]
lea ecx, [r8 - 7]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
mov r8d, 0xa
lea rdx, [rbp - 0x1b]
lea ecx, [r8 - 4]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itoa]
jmp 0x180018078
mov word [rbp + 0x10], r11w
jmp case.default.0x180017f51
mov word [rbp - 0x13], r15w
jmp case.default.0x180017f51
mov r8d, 4
lea rdx, [0x180078594]
lea rcx, [rbp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, dword [0x1800785d9]
mov dword [rbp - 8], eax
movzx eax, byte [0x1800785dd]
mov byte [rbp - 4], al
jmp 0x180018078
mov word [rbp - 0x3e], di
mov byte [rbp - 0x3c], 0
jmp case.default.0x180017f51
mov byte [rbp - 0x35], 0x30
jmp case.default.0x180017f51
mov word [rbp - 0x16], bx
mov eax, 0x7261
mov word [rbp - 0x15], ax
jmp case.default.0x180017f51
mov byte [rbp - 3], 0x36
jmp case.default.0x180017f51
mov word [rbp - 0x2f], r13w
jmp case.default.0x180017f51
movzx eax, word [0x180078618]
mov word [rbp - 0x1e], ax
movzx eax, byte [0x18007861a]
mov byte [rbp - 0x1c], al
jmp case.default.0x180017f51
movzx eax, word [0x18007861c]
mov word [rbp - 0x25], ax
movzx eax, byte [0x18007861e]
mov byte [rbp - 0x23], al
mov eax, 0x6c
mov word [rbp - 0x40], ax
jmp case.default.0x180017f51
movzx eax, word [0x180078640]
mov word [rbp + 0x23], ax
movzx eax, byte [0x180078642]
mov byte [rbp + 0x25], al
jmp case.default.0x180017f51
mov r8d, 0xa
lea rdx, [rbp - 0x20]
lea ecx, [r8 - 5]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ltoa]
mov r8d, 0xa
lea rdx, [rbp - 0x1f]
lea ecx, [r8 - 7]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
jmp 0x180018078
mov dword [rbp + 0x18], 0x6b636547
dec esi
sub r14, 1
jne 0x180017f30
movzx ebx, byte [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov r13d, dword [rsp + 0x38]
lea rdx, [0x180000000]
lea r15d, [r13 + 0x3b6]
cmp r13d, r15d
jae 0x180018d37
mov r12d, 0x3739
nop word [rax + rax]
cmp r13d, 0x298
ja 0x1800187cd
je 0x18001871d
cmp r13d, 0x1b4
ja 0x180018525
je 0x180018488
lea eax, [r13 - 0xd0]
cmp eax, 0xbe
ja case.0x180018804.708
movzx eax, byte [rdx + rax + 0x18ebc]
mov ecx, dword [rdx + rax*4 + 0x18ea0]
add rcx, rdx
jmp rcx
lea rax, [rbp]
mov r14, 0xffffffffffffffff
nop word [rax + rax]
inc r14
cmp byte [rax + r14], 0
jne 0x1800182e0
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x18001832b
lea rax, [rcx + r14]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180018311
mov rax, qword [rdi]
lea rsi, [rax + rcx]
mov r8, r14
lea rdx, [rbp]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
mov byte [r14 + rsi], 0
jmp case.0x180018804.703
lea r9, [rbp]
mov qword [rsp + 0x20], r14
mov rdx, r14
xor r8d, r8d
mov rcx, rdi
call fcn.180002030
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x18001836e
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180018363
mov rax, qword [rdi]
mov word [rax + rcx], 0x20
jmp case.0x180018804.708
mov r9b, 0x20
jmp 0x180018d14
mov r9b, 0x3b
jmp 0x180018d14
lea rax, [rbp + 0x30]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180018390
lea rdx, [rbp + 0x30]
mov rcx, rdi
call fcn.180020ed0
jmp case.0x180018804.708
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 3
jb 0x1800183f5
lea rax, [rcx + 3]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1800183d3
mov rax, qword [rdi]
lea rsi, [rax + rcx]
mov r8d, 3
lea rdx, [0x18007866c]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + 3], 0
jmp case.0x180018804.708
lea r9, [0x18007866c]
mov qword [rsp + 0x20], 3
xor r8d, r8d
lea edx, [r8 + 3]
mov rcx, rdi
call fcn.180002030
jmp case.0x180018804.708
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180018442
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x18001843a
mov rax, qword [rdi]
mov word [rax + rcx], 0x20
jmp 0x180018454
mov r9b, 0x20
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rdi
call fcn.180001ed0
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180018480
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180018475
mov rax, qword [rdi]
mov word [rax + rcx], 0x28
jmp case.0x180018804.708
mov r9b, 0x28
jmp 0x180018d14
lea rax, [rbp - 0x10]
mov r14, 0xffffffffffffffff
inc r14
cmp byte [rax + r14], 0
jne 0x180018493
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x1800184de
lea rax, [rcx + r14]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1800184c4
mov rax, qword [rdi]
lea rsi, [rax + rcx]
mov r8, r14
lea rdx, [rbp - 0x10]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
mov byte [r14 + rsi], 0
jmp case.0x1800182ca.212
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x10]
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call fcn.180002030
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180018376
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x18001851a
mov rax, qword [rdi]
mov word [rax + rcx], 0x3b
jmp case.0x180018804.708
mov eax, r13d
sub eax, 0x1da
je 0x18001868c
sub eax, 0x26
je case.0x180018804.706
sub eax, 0x26
je case.0x180018804.703
sub eax, 0x26
je 0x1800185b7
cmp eax, 0x26
jne case.0x180018804.708
lea rax, [rbp - 8]
mov r14, 0xffffffffffffffff
nop
inc r14
cmp byte [rax + r14], 0
jne 0x180018560
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x1800185ae
lea rax, [rcx + r14]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180018591
mov rax, qword [rdi]
lea rsi, [rax + rcx]
mov r8, r14
lea rdx, [rbp - 8]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rsi], 0
jmp case.0x180018804.703
lea r9, [rbp - 8]
jmp 0x18001832f
lea rax, [rbp + 0x20]
mov r14, 0xffffffffffffffff
inc r14
cmp byte [rax + r14], 0
jne 0x1800185c2
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x18001860d
lea rax, [rcx + r14]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1800185f3
mov rax, qword [rdi]
lea rsi, [rax + rcx]
mov r8, r14
lea rdx, [rbp + 0x20]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
mov byte [r14 + rsi], 0
jmp 0x180018624
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x20]
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call fcn.180002030
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180018650
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180018645
mov rax, qword [rdi]
mov word [rax + rcx], reloc.SHELL32.dll_PathMakeUniqueName
jmp case.0x180018804.708
mov r9b, reloc.SHELL32.dll_PathMakeUniqueName
jmp 0x180018d14
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180018684
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180018679
mov rax, qword [rdi]
mov word [rax + rcx], 0x29
jmp case.0x180018804.708
mov r9b, 0x29
jmp 0x180018d14
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x1800186b5
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1800186ad
mov rax, qword [rdi]
mov word [rax + rcx], 0x20
jmp 0x1800186c7
mov r9b, 0x20
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rdi
call fcn.180001ed0
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 3
jb 0x180018711
lea rax, [rcx + 3]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1800186ef
mov rax, qword [rdi]
lea rsi, [rax + rcx]
mov r8d, 3
lea rdx, [0x180078674]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + 3], 0
jmp case.0x180018804.708
lea r9, [0x180078674]
jmp 0x1800183fc
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180018746
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x18001873e
mov rax, qword [rdi]
mov word [rax + rcx], 0x28
jmp 0x180018758
mov r9b, 0x28
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rdi
call fcn.180001ed0
lea rax, [rbp - 0x28]
mov r14, 0xffffffffffffffff
inc r14
cmp byte [rax + r14], 0
jne 0x180018763
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x1800187b1
lea rax, [rcx + r14]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180018794
mov rax, qword [rdi]
lea rsi, [rax + rcx]
mov r8, r14
lea rdx, [rbp - 0x28]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r14], 0
jmp case.0x180018804.708
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x28]
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call fcn.180002030
jmp case.0x180018804.708
cmp r13d, 0x3a2
ja 0x180018aca
je 0x180018a13
lea eax, [r13 - 0x2be]
cmp eax, 0xbe
ja case.0x180018804.708
movzx eax, byte [rdx + rax + 0x18f98]
mov ecx, dword [rdx + rax*4 + 0x18f7c]
add rcx, rdx
jmp rcx
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x18001882f
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180018827
mov rax, qword [rdi]
mov word [rax + rcx], 0x20
jmp 0x180018841
mov r9b, 0x20
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rdi
call fcn.180001ed0
lea rax, [rbp + 0x18]
mov r14, 0xffffffffffffffff
nop dword [rax]
inc r14
cmp byte [rax + r14], 0
jne 0x180018850
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x18001889e
lea rax, [rcx + r14]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180018881
mov rax, qword [rdi]
lea rsi, [rax + rcx]
mov r8, r14
lea rdx, [rbp + 0x18]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r14], 0
jmp case.0x180018804.708
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x18]
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call fcn.180002030
jmp case.0x180018804.708
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x1800188e3
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1800188db
mov rax, qword [rdi]
mov word [rax + rcx], 0x20
jmp 0x1800188f5
mov r9b, 0x20
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rdi
call fcn.180001ed0
lea rax, [rbp + 0x10]
mov r14, 0xffffffffffffffff
inc r14
cmp byte [rax + r14], 0
jne 0x180018900
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x18001894e
lea rax, [rcx + r14]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180018931
mov rax, qword [rdi]
lea rsi, [rax + rcx]
mov r8, r14
lea rdx, [rbp + 0x10]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
mov byte [r14 + rsi], 0
jmp case.0x180018804.708
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x10]
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call fcn.180002030
jmp case.0x180018804.708
lea rax, [rbp - 0x40]
mov r14, 0xffffffffffffffff
inc r14
cmp byte [rax + r14], 0
jne 0x180018975
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x1800189c3
lea rax, [rcx + r14]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1800189a6
mov rax, qword [rdi]
lea rsi, [rax + rcx]
mov r8, r14
lea rdx, [rbp - 0x40]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rsi], 0
jmp case.0x180018804.708
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x40]
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call fcn.180002030
jmp case.0x180018804.708
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180018a0b
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180018a00
mov rax, qword [rdi]
mov word [rcx + rax], PathMakeUniqueName
jmp case.0x180018804.708
mov r9b, 0x2c
jmp 0x180018d14
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180018a3c
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180018a34
mov rax, qword [rdi]
mov word [rax + rcx], reloc.SHELL32.dll_PathMakeUniqueName
jmp 0x180018a4e
mov r9b, reloc.SHELL32.dll_PathMakeUniqueName
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rdi
call fcn.180001ed0
lea rax, [rbp - 0x38]
mov r14, 0xffffffffffffffff
nop dword [rax]
inc r14
cmp byte [rax + r14], 0
jne 0x180018a60
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x180018aae
lea rax, [rcx + r14]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180018a91
mov rax, qword [rdi]
lea rsi, [rax + rcx]
mov r8, r14
lea rdx, [rbp - 0x38]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r14], 0
jmp case.0x180018804.708
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x38]
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call fcn.180002030
jmp case.0x180018804.708
mov eax, r13d
sub eax, 0x3c8
je 0x180018ce8
sub eax, 0x26
je 0x180018c7b
sub eax, 0x26
je 0x180018c2a
sub eax, 0x26
je 0x180018bac
cmp eax, 0x26
jne case.0x180018804.708
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180018b25
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180018b1d
mov rax, qword [rdi]
mov word [rax + rcx], reloc.SHELL32.dll_PathMakeUniqueName
jmp 0x180018b37
mov r9b, reloc.SHELL32.dll_PathMakeUniqueName
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rdi
call fcn.180001ed0
lea rax, [rbp - 0x20]
mov r14, 0xffffffffffffffff
inc r14
cmp byte [rax + r14], 0
jne 0x180018b42
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x180018b90
lea rax, [rcx + r14]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180018b73
mov rax, qword [rdi]
lea rsi, [rax + rcx]
mov r8, r14
lea rdx, [rbp - 0x20]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + r14], 0
jmp case.0x180018804.708
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x20]
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call fcn.180002030
jmp case.0x180018804.708
lea rax, [rbp - 0x18]
mov r14, 0xffffffffffffffff
nop word [rax + rax]
inc r14
cmp byte [rax + r14], 0
jne 0x180018bc0
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x180018c0e
lea rax, [rcx + r14]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180018bf1
mov rax, qword [rdi]
lea rsi, [rax + rcx]
mov r8, r14
lea rdx, [rbp - 0x18]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r14], 0
jmp case.0x180018804.708
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x18]
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call fcn.180002030
jmp case.0x180018804.708
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 2
jb 0x180018c61
lea rax, [rcx + 2]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180018c52
mov rax, qword [rdi]
mov word [rax + rcx], r12w
mov byte [rax + rcx + 2], 0
jmp case.0x180018804.703
mov qword [rsp + 0x20], 2
lea r9, [0x180078670]
mov edx, 2
jmp 0x180018337
lea rax, [rbp - 0x30]
mov r14, 0xffffffffffffffff
inc r14
cmp byte [rax + r14], 0
jne 0x180018c86
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x180018cd1
lea rax, [rcx + r14]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180018cb7
mov rax, qword [rdi]
lea rsi, [rax + rcx]
mov r8, r14
lea rdx, [rbp - 0x30]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r14], 0
jmp 0x180018ce8
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x30]
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call fcn.180002030
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
cmp rcx, rdx
jae 0x180018d11
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
cmp rdx, 0x10
mov rax, rdi
jb 0x180018d09
mov rax, qword [rdi]
mov word [rax + rcx], PathMakeUniqueName
jmp case.0x180018804.708
mov r9b, PathMakeUniqueName
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rdi
call fcn.180001ed0
add r13d, 0x26
cmp r13d, r15d
lea rdx, [0x180000000]
jb 0x180018280
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x180018d72
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018d6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018e01
call fcn.18006f72c
movdqa xmm0, xmmword [0x18007f320]
movdqa xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x180018dbb
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018db6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018e01
call fcn.18006f72c
movdqa xmm0, xmmword [0x18007f320]
movdqa xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x180018e0d
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018e08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180018e08
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18006f72c
movzx eax, bl
mov rcx, qword [rbp + 0x2060]
xor rcx, rsp
call fcn.18006fee0
mov rbx, qword [rsp + 0x21b0]
add rsp, 0x2170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret