Function at 0x1800b4aa0
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc8
mov ebp, dword [rsp + 0x120]
lea r11, [0x180000000]
mov r14d, dword [rsp + 0x120]
mov r13d, r8d
mov rsi, qword [rsp + 0x80]
xor edi, edi
mov r10, r9
mov dword [rsp + 0x54], r13d
mov r8, rcx
mov qword [rsp + 0x98], rbp
lea eax, [r13 + 0x14a]
mov qword [rsp + 0x90], r14
mov dword [rsp + 0x50], eax
cmp r13d, eax
jae 0x1800b504b
mov eax, dword [rsp + 0x120]
lea ebx, [r13 - 0xb9]
mov r15, qword [rsp + 0xb0]
mov r12d, dword [rsp + 0x120]
mov r13d, dword [rsp + 0x120]
mov ecx, dword [rsp + 0x50]
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x68], ebx
nop
cmp ebx, 0xb3
ja case.default.0x1800b4b70
movzx eax, byte [r11 + rbx + 0xb57dc]
mov ecx, dword [r11 + rax*4 + 0xb57b0]
add rcx, r11
jmp rcx
mov eax, 0x52
cmp eax, 0x52
je 0x1800b5008
add eax, 0x2e
cmp eax, 0x80
jb 0x1800b4b77
mov dword [rsp + 0x74], 0xffffffff
jmp case.0x1800b4b70.10
mov r15, qword [rsp + 0xb0]
mov qword [rsp + 0x80], rdi
jmp case.0x1800b4b70.10
mov dword [rsp + 0x70], 0xffffffff
mov dword [rsp + 0x58], 0xffffffff
jmp case.0x1800b4b70.10
mov r9, r10
xor r8d, r8d
mov edx, IUnknown_GetWindow
xor ecx, ecx
call fcn.180038720
test eax, eax
je 0x1800b50a1
mov rcx, qword [rsp + 0x128]
mov eax, dword [rcx + 0x18]
test eax, eax
jle 0x1800b4f7a
mov r14d, dword [rsp + 0x58]
mov r10, rdi
mov edi, dword [rsp + 0x74]
mov r11d, eax
mov ebp, dword [rsp + 0x70]
mov r9d, 0x89
nop word [rax + rax]
cmp r9d, 0x89
je 0x1800b4d3f
cmp r9d, 0x2688
je 0x1800b4cf0
cmp r9d, 0x4c87
jne 0x1800b4cb7
mov rax, qword [rsp + 0x138]
mov ecx, dword [rax + 0x14]
test ecx, ecx
je 0x1800b4c58
mov eax, dword [r15 + 0x14]
sub eax, ecx
cdq
mov r8d, eax
xor r8d, edx
sub r8d, edx
jmp 0x1800b4c5f
mov r8d, dword [r15 + 0x14]
not r8d
cmp r12d, r14d
jb 0x1800b4c72
jne 0x1800b4caf
cmp r13d, edi
jb 0x1800b4c72
jne 0x1800b4caf
cmp r8d, ebp
jae 0x1800b4caf
mov ecx, 0xdc
mov eax, ecx
sub eax, 0xdb
je 0x1800b4c92
cmp eax, 1
jne 0x1800b4c98
mov qword [rsp + 0x80], r15
mov edi, r13d
jmp 0x1800b4c98
mov ebp, r8d
mov r14d, r12d
dec ecx
cmp ecx, 0xda
ja 0x1800b4c77
mov dword [rsp + 0x70], ebp
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x74], edi
mov rcx, qword [rsp + 0x128]
add r9d, 0x25ff
cmp r9d, 0x71fd
jbe 0x1800b4c10
add r10, 0x18
sub r11, 1
jne 0x1800b4c01
mov rbp, qword [rsp + 0x98]
xor edi, edi
mov r14, qword [rsp + 0x90]
jmp 0x1800b4f7a
mov r8, qword [rsp + 0x138]
mov eax, dword [r15 + 0x10]
add eax, dword [r15 + 0xc]
add eax, dword [r15 + 8]
sub eax, dword [r8 + 8]
sub eax, dword [r8 + 0x10]
sub eax, dword [r8 + 0xc]
mov ecx, dword [r15 + 4]
cdq
sub ecx, dword [r8 + 4]
mov r12d, eax
mov eax, dword [r15]
xor r12d, edx
sub eax, dword [r8]
sub r12d, edx
imul eax, eax
imul ecx, ecx
add eax, ecx
cdq
mov r13d, eax
xor r13d, edx
sub r13d, edx
jmp 0x1800b4caf
mov r15, qword [rcx + 0x10]
add r15, r10
jmp 0x1800b4cb7
mov qword [rsp + 0x28], r10
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov edx, 0xe0
xor ecx, ecx
call fcn.18003f630
mov dword [rsp + 0x64], eax
cmp eax, 0x10
jbe 0x1800b4f7a
mov qword [rsp + 0x30], rdi
lea rcx, str.PrintTicketProperty
mov qword [rsp + 0x28], rdi
mov r9d, 0x111
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
call fcn.180070ab0
mov rax, rdi
jmp 0x1800b4e48
mov qword [rsp + 0x28], rdi
lea rcx, [rsp + 0x68]
mov r9d, 0x88
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov dword [rsp + 0x68], 6
mov rdx, r10
call fcn.1800815d0
jmp 0x1800b4f7a
mov qword [rsp + 0x40], rdi
xor r9d, r9d
mov qword [rsp + 0x38], r10
xor r8d, r8d
mov qword [rsp + 0x30], rdi
xor edx, edx
mov qword [rsp + 0x28], rdi
xor ecx, ecx
mov dword [rsp + 0x20], 0x69
call fcn.18009f6b0
xor r8d, r8d
cmp eax, 0x38425053
jne 0x1800b5020
mov rdx, qword [rsp + 0x128]
xor r9d, r9d
mov qword [rsp + 0x28], rdx
xor ecx, ecx
mov edx, 0xe0
mov qword [rsp + 0x20], rdi
call fcn.18003f630
cmp eax, 1
je 0x1800b4f7a
mov ebx, 0x106
mov eax, ebx
sub eax, 0x106
je 0x1800b4e5c
cmp eax, 0x3a
jne 0x1800b4e85
mov rax, rsi
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov qword [rsp + 0x30], rdi
lea rcx, str.BSEL_D_PSEUDO
mov qword [rsp + 0x28], rdi
mov r9d, 0x111
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
call fcn.180070ab0
mov rsi, rdi
add ebx, 0x3a
cmp ebx, 0x17a
jb 0x1800b4e37
jmp 0x1800b4f76
mov qword [rsp + 0x40], rdi
xor r9d, r9d
mov qword [rsp + 0x38], r10
xor r8d, r8d
mov qword [rsp + 0x30], rdi
xor edx, edx
mov qword [rsp + 0x28], rdi
xor ecx, ecx
mov dword [rsp + 0x20], 0x69
call fcn.18009f6b0
mov rbp, rax
mov qword [rsp + 0x98], rax
jmp 0x1800b4f7a
mov qword [rsp + 0x40], rdi
xor r9d, r9d
mov qword [rsp + 0x38], r10
xor r8d, r8d
mov qword [rsp + 0x30], rdi
xor edx, edx
mov qword [rsp + 0x28], rdi
xor ecx, ecx
mov dword [rsp + 0x20], 0x69
call fcn.18009f6b0
mov rdx, qword [rsp + 0x128]
xor r9d, r9d
mov qword [rsp + 0x28], rdx
xor r8d, r8d
mov edx, 0xe0
mov qword [rsp + 0x90], rax
xor ecx, ecx
mov qword [rsp + 0x20], rdi
mov r14, rax
call fcn.18003f630
cmp eax, 8
je 0x1800b4f7a
mov ebx, 0x38
mov eax, ebx
sub eax, 0x38
je 0x1800b4f46
cmp eax, 1
je case.0x1800b5006.195
jmp 0x1800b4f6f
mov qword [rsp + 0x30], rdi
lea rcx, str.Profile.Operation__
mov qword [rsp + 0x28], rdi
mov r9d, 0x111
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
call fcn.180070ab0
mov rsi, rdi
inc ebx
cmp ebx, 0x3a
jb 0x1800b4f34
mov ebx, dword [rsp + 0x68]
mov r10, qword [rsp + 0x128]
lea r11, [0x180000000]
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x50]
add eax, 0x21
add ebx, 0x21
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x68], ebx
cmp eax, ecx
jb 0x1800b4b50
mov r15d, dword [rsp + 0x64]
mov r13d, dword [rsp + 0x120]
mov rdx, qword [rsp + reloc.SHLWAPI.dll_SHRegGetIntW]
mov r8, qword [rsp + 0x110]
lea eax, [r13 + 0xb]
mov dword [rsp + 0xa8], eax
cmp r13d, eax
jae case.0x1800b5006.195
movzx ebx, byte [rsp + 0x120]
mov r12, qword [rsp + 0x78]
lea eax, [r13 - 0xb9]
mov r9d, 0xff
cmp eax, 0xa
ja case.default.0x1800b5006
mov ecx, dword [r11 + rax*4 + 0xb5890]
add rcx, r11
jmp rcx
mov rax, qword [rsp + 0x80]
jmp 0x1800b4e48
mov qword [rsp + 0x30], rdi
lea rcx, str.not_PSD
mov qword [rsp + 0x28], rdi
mov r9d, 0x111
xor edx, edx
mov qword [rsp + 0x20], rdi
call fcn.180070ab0
mov rax, rdi
jmp 0x1800b4e48
mov r15d, dword [rsp + 0x120]
mov dword [rsp + 0x64], r15d
jmp 0x1800b4fc4
mov rax, qword [rsp + 0x138]
mov rsi, r12
mov dword [rax], r14d
jmp case.default.0x1800b5006
cmp dword [rsp + 0x74], 1
jle case.default.0x1800b5006
mov qword [rsp + 0x30], rdi
lea rcx, str.isSystemProfile
mov qword [rsp + 0x28], rdi
mov r9d, 0x111
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
call fcn.180070ab0
mov rax, rdi
jmp 0x1800b4e48
mov qword [rsp + 0x28], r10
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov edx, 0xe0
xor ecx, ecx
call fcn.18003f630
xor r8d, r8d
xor edx, edx
cmp eax, 3
jne 0x1800b5750
mov r15, qword [rsp + 0x128]
xor r9d, r9d
mov qword [rsp + 0x40], rdi
xor ecx, ecx
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x69
call fcn.18009f6b0
mov r9d, 0x88
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov dword [rsp + 0x120], eax
mov rdx, r15
mov qword [rsp + 0x20], rdi
lea rcx, [rsp + 0x120]
call fcn.1800815d0
jmp case.default.0x1800b5006
mov qword [rsp + 0x40], rdi
xor r9d, r9d
mov qword [rsp + 0x38], r10
xor r8d, r8d
mov qword [rsp + 0x30], rdi
xor edx, edx
mov qword [rsp + 0x28], rdi
xor ecx, ecx
mov dword [rsp + 0x20], 0x69
call fcn.18009f6b0
mov rdx, qword [rsp + 0x128]
lea rcx, [rsp + 0x120]
mov r9d, 0x88
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov dword [rsp + 0x120], eax
mov qword [rsp + 0x20], rdi
call fcn.1800815d0
jmp case.default.0x1800b5006
test rdx, rdx
je 0x1800b5197
mov dword [rdx], r15d
mov dword [r8], ebp
jmp case.default.0x1800b5006
mov qword [rsp + 0x40], rdi
xor r9d, r9d
mov qword [rsp + 0x38], r10
xor r8d, r8d
mov qword [rsp + 0x30], rdi
xor edx, edx
mov qword [rsp + 0x28], rdi
xor ecx, ecx
mov dword [rsp + 0x20], 0x69
call fcn.18009f6b0
mov r15, qword [rsp + 0x128]
lea rcx, [rsp + 0x120]
mov rdx, r15
mov qword [rsp + 0x28], rdi
mov r9d, 0x88
mov dword [rsp + 0x120], eax
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call fcn.1800815d0
xor r9d, r9d
mov qword [rsp + 0x28], r15
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov edx, 0xe0
xor ecx, ecx
call fcn.18003f630
mov dword [rsp + 0x74], eax
jmp case.default.0x1800b5006
mov eax, r14d
imul eax, ebp
mov dword [rsp + 0x54], eax
jmp case.default.0x1800b5006
mov eax, r14d
mov qword [rsp + 0x28], rdi
imul eax, ebp
lea r9, [rsp + 0xb0]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor ecx, ecx
shl eax, 2
lea edx, [r8 + 0x67]
cdqe
mov qword [rsp + 0xb0], rax
call fcn.1800691c0
mov qword [rsp + 0x78], rax
cmp rax, 0
je 0x1800b5780
mov r12, rax
jmp case.default.0x1800b5006
cmp dword [rsp + 0x74], 0
je 0x1800b5597
mov eax, ebp
mov qword [rsp + 0x28], rdi
imul eax, r15d
lea rcx, [rsp + 0x58]
mov r9d, 0x88
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, r10
add eax, eax
mov dword [rsp + 0x58], eax
call fcn.1800815d0
mov rax, qword [rsp + 0x78]
mov ebp, edi
mov r14d, dword [rsp + 0x54]
mov r9d, 0xff
mov qword [rsp + 0x80], rax
nop dword [rax + rax]
mov r8d, 0x81
mov dword [rsp + 0x68], r8d
nop dword [rax + rax]
cmp r8d, 0x81
jne 0x1800b554b
mov rdx, rax
cmp ebp, r15d
jl 0x1800b5321
test r14d, r14d
jle 0x1800b554b
cmp ebp, 3
mov ecx, edi
mov rax, r14
cmove ecx, r9d
nop word [rax + rax]
mov byte [rdx], cl
lea rdx, [rdx + 4]
sub rax, 1
jne 0x1800b5310
jmp 0x1800b5543
mov eax, 0xde
mov dword [rsp + 0x70], eax
nop word [rax + rax]
cmp eax, 0xde
jne 0x1800b551f
mov r8d, edi
test r14d, r14d
jle 0x1800b551f
mov rdi, qword [rsp + 0x128]
nop
mov r13, rdx
mov byte [rsp + 0x60], bl
xor edx, edx
mov r12d, r8d
xor r9d, r9d
mov r8, rdi
lea ecx, [rdx + 0x49]
call fcn.18009aa90
movzx r15d, al
mov rdx, r13
mov r8d, r12d
movzx ecx, bl
cmp r15d, 0x80
je 0x1800b5510
jae 0x1800b5447
mov eax, 0xcf
mov qword [rsp + 0x88], rdx
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], r12d
sub eax, 0xcd
je 0x1800b53c0
sub eax, 1
je 0x1800b53b6
cmp eax, 1
jne 0x1800b5428
inc r15d
jmp 0x1800b5428
add r8d, r15d
mov dword [rsp + 0x50], r8d
jmp 0x1800b5428
test r15d, r15d
je 0x1800b5428
nop word [rax + rax]
mov ebx, 0xc9
cmp ebx, 0xc9
je 0x1800b53ea
cmp ebx, 0x3177
jne 0x1800b5410
dec r15d
jmp 0x1800b5410
xor edx, edx
xor r9d, r9d
mov r8, rdi
lea ecx, [rdx + 0x49]
call fcn.18009aa90
mov rdx, qword [rsp + 0x88]
mov byte [rdx], al
add rdx, 4
mov qword [rsp + 0x88], rdx
add ebx, 0x30ae
cmp ebx, 0x615c
jbe 0x1800b53d5
test r15d, r15d
jne 0x1800b53d0
mov r8d, dword [rsp + 0x50]
mov eax, dword [rsp + 0x58]
dec eax
mov dword [rsp + 0x58], eax
cmp eax, 0xcc
ja 0x1800b53a0
movzx ebx, byte [rsp + 0x60]
jmp 0x1800b5510
jbe 0x1800b5510
mov eax, 0x7f
mov qword [rsp + 0x88], rdx
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], r12d
sub eax, 0x7c
je 0x1800b54b4
sub eax, 1
je 0x1800b54aa
sub eax, 1
je 0x1800b5488
cmp eax, 1
jne 0x1800b54fd
xor r15d, 0xff
add r15d, 2
jmp 0x1800b54fd
xor edx, edx
xor r9d, r9d
mov r8, rdi
lea ecx, [rdx + 0x49]
call fcn.18009aa90
mov rdx, qword [rsp + 0x88]
mov rbx, rax
mov r8d, dword [rsp + 0x50]
jmp 0x1800b54fd
add r8d, r15d
mov dword [rsp + 0x50], r8d
jmp 0x1800b54fd
test r15d, r15d
je 0x1800b54fd
nop dword [rax]
mov ecx, 0x102
mov eax, ecx
sub eax, 0x102
je 0x1800b54e3
sub eax, 0x12
je 0x1800b54dd
cmp eax, 0x12
jne 0x1800b54e5
dec r15d
jmp 0x1800b54e5
add rdx, 4
jmp 0x1800b54e5
mov byte [rdx], bl
add ecx, 0x12
cmp ecx, 0x138
jb 0x1800b54c5
mov qword [rsp + 0x88], rdx
test r15d, r15d
jne 0x1800b54c0
mov eax, dword [rsp + 0x58]
dec eax
mov dword [rsp + 0x58], eax
cmp eax, 0x7b
ja 0x1800b5463
cmp r8d, r14d
jl 0x1800b5350
mov eax, dword [rsp + 0x70]
xor edi, edi
add eax, 0x93
mov dword [rsp + 0x70], eax
cmp eax, 0x171
jb 0x1800b5330
mov r8d, dword [rsp + 0x68]
mov r9d, 0xff
mov r15d, dword [rsp + 0x64]
mov rax, qword [rsp + 0x80]
add r8d, 0xc2
mov dword [rsp + 0x68], r8d
cmp r8d, 0x143
jb 0x1800b52e0
inc rax
inc ebp
mov qword [rsp + 0x80], rax
cmp ebp, 4
jl 0x1800b52d0
mov rbp, qword [rsp + 0x98]
mov r14, qword [rsp + 0x90]
mov r13d, dword [rsp + 0x120]
jmp 0x1800b5705
mov rdx, qword [rsp + 0x78]
mov r13d, edi
mov r14d, dword [rsp + 0x54]
mov eax, dword [rsp + 0x64]
mov qword [rsp + 0x80], rdx
mov r15, rdx
cmp r13d, eax
jle 0x1800b55df
test r14d, r14d
jle 0x1800b5621
cmp r13d, 3
mov ecx, edi
mov rax, r14
cmove ecx, r9d
nop word [rax + rax]
mov byte [r15], cl
lea r15, [r15 + 4]
sub rax, 1
jne 0x1800b55d0
jmp 0x1800b561d
test r14d, r14d
jle 0x1800b5621
mov rdi, qword [rsp + 0x128]
mov r12, r14
nop
xor edx, edx
xor r9d, r9d
mov r8, rdi
lea ecx, [rdx + 0x49]
call fcn.18009aa90
mov byte [r15], al
lea r15, [r15 + 4]
sub r12, 1
jne 0x1800b55f0
mov rdx, qword [rsp + 0x80]
xor edi, edi
mov r9d, 0xff
mov eax, dword [rsp + 0x64]
inc rdx
inc r13d
mov qword [rsp + 0x80], rdx
cmp r13d, 4
jl 0x1800b55b0
mov r14, qword [rsp + 0x90]
mov r13d, dword [rsp + 0x120]
jmp 0x1800b5705
mov rcx, qword [rsp + 0x130]
test dword [rcx], 0xfffffffb
je case.default.0x1800b5006
mov r15d, 0xb5
nop dword [rax + rax]
mov eax, r15d
sub eax, 0xb5
je 0x1800b568d
cmp eax, 1
jne 0x1800b56f5
cmp qword [rsp + 0x78], 0
je 0x1800b50a1
jmp 0x1800b56f5
mov eax, dword [rcx]
lea r9, [rsp + 0x88]
mov rcx, qword [rsp + 0x78]
lea r8, [rsp + 0x58]
mov dword [rsp + 0x120], eax
xor edx, edx
lea rax, [rsp + 0x120]
mov dword [rsp + 0x30], 0x13b
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], ebp
mov dword [rsp + 0x88], r14d
mov dword [rsp + 0xa0], 4
call fcn.1800a4f80
mov rcx, qword [rsp + 0x130]
mov qword [rsp + 0x78], rax
inc r15d
cmp r15d, 0xb7
jb 0x1800b5670
mov r12, qword [rsp + 0x78]
inc r13d
mov dword [rsp + 0x120], r13d
cmp r13d, dword [rsp + 0xa8]
jae case.0x1800b5006.195
mov r10, qword [rsp + 0x128]
lea r11, [0x180000000]
mov r15d, dword [rsp + 0x64]
mov rdx, qword [rsp + reloc.SHLWAPI.dll_SHRegGetIntW]
mov r8, qword [rsp + 0x110]
jmp 0x1800b4fe5
mov qword [rsp + 0x30], rdi
lea rcx, str.getIntegerInstance
mov qword [rsp + 0x28], rdi
mov r9d, 0x111
mov qword [rsp + 0x20], rdi
call fcn.180070ab0
mov rax, rdi
jmp 0x1800b4e48
mov qword [rsp + 0x30], rdi
lea rcx, str.outofmem
mov qword [rsp + 0x28], rdi
mov r9d, 0x111
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
call fcn.180070ab0
mov rax, rdi
jmp 0x1800b4e48