Function at 0x18009eae0
Capabilities:
Check for software breakpoints

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 0x18], r8
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0xa0
mov r12d, dword [rbp + 0x7f]
mov r15, rdx
mov ebx, dword [rbp + 0x7f]
lea rdx, [0x180000000]
movaps xmmword [rax - 0x38], xmm6
mov r14, r9
mov eax, dword [rbp + 0x7f]
mov r13, rcx
mov edi, eax
lea esi, [rax + 0x5dc]
cmp eax, esi
jae 0x18009ee38
movaps xmm6, xmmword [rbp - 0x21]
nop dword [rax]
cmp edi, 0x13d
ja 0x18009ecb5
je 0x18009ec93
lea eax, [rdi - 0x44]
cmp eax, 0xcc
ja case.0x18009eb72.75
movzx eax, byte [rdx + rax + 0x9f404]
mov ecx, dword [rdx + rax*4 + 0x9f3e4]
add rcx, rdx
jmp rcx
mov qword [rbp - 0x11], r15
jmp case.0x18009eb72.75
mov qword [rbp - 0x39], 0
jmp case.0x18009eb72.75
mov rax, qword [r15]
cmp dword [rax], 0x7f2bb702
jne 0x18009ec0e
jmp case.0x18009eb72.75
mov qword [rbp - 0x31], 0
jmp case.0x18009eb72.75
test r15, r15
je 0x18009ebb3
cmp qword [r13], 0
jne 0x18009ebd7
mov eax, 0xd5
nop dword [rax + rax]
cmp eax, 0xd5
je 0x18009ee65
add eax, 0xba
cmp eax, 0x18f
jb 0x18009ebc0
test r8, r8
je 0x18009ebf0
cmp qword [r14], 0
jne case.0x18009eb72.75
nop word [rax + rax]
xor ecx, ecx
lea rdx, str.need_data
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov ecx, 0x43
call fcn.18007ac70
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
test r15, r15
jne 0x18009ec5e
mov ecx, 0x74
mov eax, ecx
sub eax, 0x74
je 0x18009ec4e
cmp eax, 0x74
je 0x18009ec0e
jmp 0x18009ec53
mov ebx, 0x7f2bb73a
add ecx, 0x74
cmp ecx, 0x15c
jb 0x18009ec40
mov dword [rbp - 0x41], 0x88
lea rdx, [rbp - 0x31]
jmp 0x18009ee0b
mov rdx, qword [r15]
add rdx, 0x10
cmp qword [rdx], 0
je 0x18009ee23
xor r9d, r9d
xor r8d, r8d
lea ecx, [r9 + 0x4a]
call fcn.180086260
jmp 0x18009ee1f
mov rax, qword [r15]
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
lea ecx, [r9 + 0x4a]
mov qword [rax + 0x10], 0
call fcn.180086260
jmp 0x18009ee1f
cmp edi, 0x1d8
ja 0x18009ed47
je 0x18009ed33
mov eax, edi
sub eax, 0x170
je 0x18009ecf6
sub eax, 4
je 0x18009ece9
cmp eax, 0x60
jne case.0x18009eb72.75
mov rax, qword [rbp - 0x31]
mov dword [rax], 0x7f2bb705
jmp case.0x18009eb72.75
mov rax, qword [r13]
mov qword [rbp - 9], rax
jmp case.0x18009eb72.75
test r12d, r12d
jne 0x18009ef19
mov rax, qword [rbp - 0x31]
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
mov qword [rax + 0x80], rcx
jmp case.0x18009eb72.75
mov rax, qword [r14]
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x21], r8
movaps xmm6, xmmword [rbp - 0x21]
jmp case.0x18009eb72.75
mov eax, edi
sub eax, 0x238
je 0x18009ee00
sub eax, 4
je 0x18009edc5
cmp eax, 0x64
jne case.0x18009eb72.75
movaps xmm0, xmmword [rbp - 0x11]
lea rax, [rbp - 1]
mov r8, qword [0x1800ea018]
lea r9, [rbp - 0x41]
mov qword [rsp + 0x28], 0
lea rdx, [rbp + 0xf]
mov ecx, 0x60
movdqa xmmword [rbp - 1], xmm0
mov qword [rsp + 0x20], rax
movdqa xmmword [rbp + 0xf], xmm6
mov dword [rbp - 0x41], 1
call fcn.1800c8610
cmp eax, 0xffffffff
jne 0x18009ee1f
xor ecx, ecx
lea rdx, str.HandlerEndPC
mov qword [rsp + 0x20], rcx
xor r9d, r9d
lea ecx, [rax + 0x44]
xor r8d, r8d
call fcn.18007ac70
jmp 0x18009ee1f
lea rcx, str.CI3DeleteFile
call fcn.1800cfb40
movaps xmm0, xmmword [rbp - 0x11]
lea r8, [rbp + 0xf]
mov rdx, qword [0x1800ea018]
lea rcx, [rbp - 1]
xor r9d, r9d
movdqa xmmword [rbp + 0xf], xmm0
movdqa xmmword [rbp - 1], xmm6
mov dword [rsp + 0x20], 0x67
call fcn.1800bb8f0
jmp 0x18009ee1f
mov dword [rbp - 0x41], 0x60
lea rdx, [rbp - 0x39]
lea r9, [rbp - 0x41]
xor r8d, r8d
mov ecx, 0xac
call fcn.180098000
mov r12d, eax
mov r8, qword [rbp + 0x6f]
lea rdx, [0x180000000]
add edi, 0x64
cmp edi, esi
jb 0x18009eb40
mov eax, dword [rbp + 0x7f]
lea r14d, [rax - 0xe]
mov esi, eax
cmp eax, r14d
jbe 0x18009f0a4
lea edi, [rax - 0x37]
nop word [rax + rax]
cmp edi, 0xd
ja case.default.0x18009ee63
mov ecx, dword [rdx + rdi*4 + 0x9f4d4]
add rcx, rdx
jmp rcx
xor ecx, ecx
lea rdx, str.need_key
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
jmp 0x18009ec04
mov rdx, qword [rbp - 0x31]
mov rax, 0xffffffffffffffff
add rdx, 0x10
nop dword [rax]
inc rax
cmp byte [r15 + rax], 0
jne 0x18009ee90
inc eax
lea r9, [rbp - 0x41]
xor r8d, r8d
mov dword [rbp - 0x41], eax
mov ecx, 0xac
call fcn.180098000
mov r12d, eax
jmp case.default.0x18009ee63
mov rax, qword [rbp - 0x31]
xorps xmm0, xmm0
mov dword [rax + 0x30], 1
mov rax, qword [rbp - 0x39]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
jmp case.default.0x18009ee63
mov rax, qword [rbp - 0x39]
mov dword [rax], 0x7f2bb70b
mov rax, qword [0x1800e5d70]
test rax, rax
je 0x18009ef51
mov r8, qword [rbp - 0x39]
mov rcx, r15
mov edx, dword [r13]
add r8, 8
call qword [rax + 0x10]
mov r12d, eax
test eax, eax
je case.default.0x18009ee63
mov rsi, qword [rbp + 0x6f]
cmp qword [rbp - 0x31], 0
mov edi, 0x20284
je 0x18009f3d0
xor r9d, r9d
lea rdx, [rbp - 0x31]
xor r8d, r8d
lea ecx, [r9 + 0x4a]
call fcn.180086260
imul eax, dword [rbp + 0x7f], 0xb0
add edi, eax
mov eax, dword [rbp + 0x7f]
jmp 0x18009f0aa
mov rax, qword [rbp - 0x39]
mov qword [rax + 8], 0
jmp case.default.0x18009ee63
mov rax, qword [rbp - 0x39]
lea rdx, str.internal_module
xor ecx, ecx
xor r9d, r9d
mov qword [rsp + 0x28], rcx
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov qword [rax + 0x18], rcx
mov ecx, 0x127
call fcn.1800bb400
test rax, rax
je case.default.0x18009ee63
lea rdx, [0x1800dda2c]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rcx, qword [rbp - 0x39]
mov qword [rcx + 0x18], rax
jmp case.default.0x18009ee63
test r12d, r12d
jne 0x18009ef19
jmp case.default.0x18009ee63
mov rax, qword [rbp - 0x31]
mov qword [rax + 0x20], 0
mov rax, qword [rbp - 0x31]
mov qword [rax + 0x28], 0
jmp case.default.0x18009ee63
mov rcx, qword [rbp - 0x39]
mov rax, qword [0x1800eaa50]
mov qword [rcx + 0x40], rax
jmp case.default.0x18009ee63
mov rcx, qword [rbp - 0x39]
mov rax, qword [0x1800eaa30]
mov qword [rcx + 0x30], rax
mov rcx, qword [rbp - 0x39]
mov rax, qword [0x1800eaa38]
mov qword [rcx + 0x38], rax
jmp case.default.0x18009ee63
mov rax, qword [rbp - 0x31]
mov rcx, r15
mov rdx, qword [rax + 0x10]
nop dword [rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x18009f020
mov rcx, qword [rbp - 0x31]
mov rax, qword [rbp - 0x39]
mov qword [rcx + 0x70], rax
jmp case.default.0x18009ee63
mov rcx, qword [rbp - 0x39]
mov rax, qword [0x1800eaa40]
mov qword [rcx + 0x50], rax
mov rcx, qword [rbp - 0x39]
mov rax, qword [0x1800eaa48]
mov qword [rcx + 0x58], rax
jmp case.default.0x18009ee63
mov rcx, qword [rbp - 0x39]
mov rax, qword [0x1800ea420]
mov qword [rcx + 0x48], rax
jmp case.default.0x18009ee63
mov rax, qword [rbp - 0x31]
mov dword [rax + 0x18], 0x400
jmp case.default.0x18009ee63
mov rcx, qword [rbp - 0x31]
mov rax, qword [0x1800e5120]
mov qword [rcx + 8], rax
dec esi
dec edi
cmp esi, r14d
jbe 0x18009f0a1
lea rdx, [0x180000000]
jmp 0x18009ee50
mov eax, dword [rbp + 0x7f]
mov rsi, qword [rbp + 0x6f]
mov edi, eax
imul eax, eax, 0x9a0
cmp edi, eax
ja 0x18009ec0e
cmp edi, 0x14784
ja 0x18009f328
je 0x18009f2f6
cmp edi, 0x8c84
ja 0x18009f1bc
je 0x18009f1a0
cmp edi, 0x44
je 0x18009f16d
cmp edi, 0x2f04
je 0x18009f151
cmp edi, 0x5dc4
jne 0x18009f3d0
mov qword [rsp + 0x28], 0
lea rdx, str.searchEnabled
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor r8d, r8d
mov ecx, 0x127
call fcn.1800bb400
test rax, rax
je 0x18009f3d0
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoul]
mov rcx, qword [rbp - 0x39]
mov dword [rcx + 0x10], eax
imul eax, dword [rbp + 0x7f], 0xb0
add edi, eax
mov eax, dword [rbp + 0x7f]
jmp 0x18009f0aa
mov rax, qword [rbp - 0x39]
mov dword [rax + 0x10], 0
imul eax, dword [rbp + 0x7f], 0xb0
add edi, eax
mov eax, dword [rbp + 0x7f]
jmp 0x18009f0aa
mov rax, qword [rbp - 0x39]
cmp qword [rax + 0x18], 0
jne 0x18009f3d0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, qword [rbp - 0x39]
mov qword [rcx + 0x18], rax
imul eax, dword [rbp + 0x7f], 0xb0
add edi, eax
mov eax, dword [rbp + 0x7f]
jmp 0x18009f0aa
mov rax, qword [rbp - 0x39]
mov dword [rax + 0x20], 0
imul eax, dword [rbp + 0x7f], 0xb0
add edi, eax
mov eax, dword [rbp + 0x7f]
jmp 0x18009f0aa
cmp edi, 0xbb44
je 0x18009f297
cmp edi, 0xea04
je 0x18009f23f
cmp edi, 0x118c4
jne 0x18009f3d0
mov rax, qword [rbp - 0x39]
lea rdx, str._1___2___3___4___5_
mov qword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], 0
mov ecx, 0x127
mov dword [rax + 0x28], 0
call fcn.1800bb400
test rax, rax
je 0x18009f3d0
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoul]
mov rcx, qword [rbp - 0x39]
mov dword [rcx + 0x28], eax
imul eax, dword [rbp + 0x7f], 0xb0
add edi, eax
mov eax, dword [rbp + 0x7f]
jmp 0x18009f0aa
mov qword [rsp + 0x28], 0
lea rdx, str.check_follow_cname
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor r8d, r8d
mov ecx, 0x127
call fcn.1800bb400
test rax, rax
je 0x18009f3d0
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoul]
mov rcx, qword [rbp - 0x39]
mov dword [rcx + 0x24], eax
imul eax, dword [rbp + 0x7f], 0xb0
add edi, eax
mov eax, dword [rbp + 0x7f]
jmp 0x18009f0aa
mov qword [rsp + 0x28], 0
lea rdx, str.CreateOverlay
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor r8d, r8d
mov ecx, 0x127
call fcn.1800bb400
test rax, rax
je 0x18009f2da
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoul]
mov rcx, qword [rbp - 0x39]
mov dword [rcx + 0x20], eax
mov rax, qword [rbp - 0x39]
mov dword [rax + 0x24], 0
imul eax, dword [rbp + 0x7f], 0xb0
add edi, eax
mov eax, dword [rbp + 0x7f]
jmp 0x18009f0aa
mov rax, qword [rbp - 0x39]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x18009f3d0
mov rax, qword [rbp - 0x31]
mov ecx, dword [rcx + 0x80]
mov dword [rax + 0x80], ecx
imul eax, dword [rbp + 0x7f], 0xb0
add edi, eax
mov eax, dword [rbp + 0x7f]
jmp 0x18009f0aa
cmp edi, 0x20284
ja 0x18009f38e
je 0x18009ef1d
cmp edi, 0x17644
je 0x18009f376
cmp edi, 0x1a504
je 0x18009f363
cmp edi, 0x1d3c4
je 0x18009ec0e
imul eax, dword [rbp + 0x7f], 0xb0
add edi, eax
mov eax, dword [rbp + 0x7f]
jmp 0x18009f0aa
imul eax, dword [rbp + 0x7f], 0xb0
xor ebx, ebx
add edi, eax
mov eax, dword [rbp + 0x7f]
jmp 0x18009f0aa
mov rax, qword [rbp - 0x31]
mov qword [rsi], rax
imul eax, dword [rbp + 0x7f], 0xb0
add edi, eax
mov eax, dword [rbp + 0x7f]
jmp 0x18009f0aa
cmp edi, 0x23144
je 0x18009f3b3
cmp edi, 0x26004
je 0x18009ec0e
imul eax, dword [rbp + 0x7f], 0xb0
add edi, eax
mov eax, dword [rbp + 0x7f]
jmp 0x18009f0aa
cmp qword [rbp - 0x39], 0
je 0x18009f3cd
xor r9d, r9d
lea rdx, [rbp - 0x39]
xor r8d, r8d
lea ecx, [r9 + 0x4a]
call fcn.180086260
mov ebx, r12d
imul eax, dword [rbp + 0x7f], 0xb0
add edi, eax
mov eax, dword [rbp + 0x7f]
jmp 0x18009f0aa