Function at 0x18002ccc0
Capabilities:
Query environment variable
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4d0]
sub rsp, 0x5d0
mov rax, qword [0x180090f80]
xor rax, rsp
mov qword [rbp + 0x4c0], rax
mov esi, dword [rbp - 0x80]
lea eax, [rdx - 0xb]
mov ebx, dword [rbp - 0x80]
lea r10, [0x180000000]
xor r9d, r9d
mov dword [rbp - 0x70], edx
cmp edx, eax
mov qword [rbp - 8], r8
mov r13d, edx
mov qword [rbp - 0x10], rcx
mov r15d, edx
mov r14, rcx
mov rdx, qword [rbp - 0x30]
mov qword [rbp - 0x50], rdx
jbe 0x18002d3fd
mov r12, qword [rbp - 0x30]
mov eax, dword [rbp - 0x80]
mov rdi, qword [rbp - 0x48]
mov qword [rbp - 0x40], r12
mov dword [rbp - 0x74], eax
lea eax, [r15 - 0xb7]
lea r11, str.Loss
cmp eax, 0xd
ja case.0x18002cd5b.186
mov ecx, dword [r10 + rax*4 + 0x2d6d0]
add rcx, r10
jmp rcx
cmp dword [0x1800e2268], 0
jne case.0x18002cd5b.186
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.SzEMMAoGA1UEChMDVERDMRQwEgYDVQQDEwtUREMgT0NFUyBDQTAeFw0wMzAyMTEw
call fcn.180076250
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov byte [rbp - 0x78], 0
mov eax, 0x94
nop dword [rax]
cmp eax, 0x94
jne 0x18002ce0f
mov eax, dword [r8]
lea rdx, [rbp + 0x60]
mov dword [rbp - 0x68], eax
lea r8, [0x1800797a3]
lea rax, [rbp - 0x68]
mov r9d, 0xd2
mov qword [rsp + 0x28], rax
lea rcx, [0x180136f50]
mov qword [rsp + 0x20], r14
call fcn.1800398b0
test eax, eax
js case.0x18002cd5b.194
je 0x18002d338
sub eax, 1
je 0x18002cdf5
cmp eax, 1
jne 0x18002d338
mov byte [rbp - 0x78], al
jmp 0x18002ce06
mov rcx, qword [0x1800e2238]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov qword [rbp - 0x28], rax
mov r8, qword [rbp - 8]
mov eax, 0x94
add eax, 0xd
cmp eax, 0xa1
jb 0x18002cda0
jmp 0x18002cd94
mov r15d, 0xc2
jmp case.0x18002cd5b.186
lea rcx, [rbp + 0xc0]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__ftime64]
mov rax, qword [rbp + 0xc0]
mov qword [r14], rax
jmp case.0x18002cd5b.186
mov r14, qword [rbp - 0x10]
lea rax, str.help
mov qword [rbp + 0x100], rax
lea rax, str.path
mov qword [rbp + 0x120], rax
lea rax, str.test
mov dword [rbp + 0x108], r9d
movaps xmm0, xmmword [rbp + 0x100]
movaps xmmword [0x180136f50], xmm0
mov qword [rbp + 0x110], r9
mov dword [rbp + 0x118], r9d
movaps xmm1, xmmword [rbp + 0x110]
movaps xmmword [0x180136f60], xmm1
mov dword [rbp + 0x128], 1
movaps xmm0, xmmword [rbp + 0x120]
movaps xmmword [0x180136f70], xmm0
mov qword [rbp + 0x130], r9
mov dword [rbp + 0x138], 1
movaps xmm1, xmmword [rbp + 0x130]
movaps xmmword [0x180136f80], xmm1
mov qword [rbp + 0x140], rax
mov dword [rbp + 0x148], r9d
movaps xmm0, xmmword [rbp + 0x140]
mov qword [rbp + 0x150], r9
mov dword [rbp + 0x158], 2
movaps xmm1, xmmword [rbp + 0x150]
movaps xmmword [0x180136f90], xmm0
mov qword [rbp + 0x160], r9
mov dword [rbp + 0x168], r9d
movaps xmm0, xmmword [rbp + 0x160]
mov qword [rbp + 0x170], r9
mov dword [rbp + 0x178], r9d
movaps xmmword [0x180136fa0], xmm1
movaps xmm1, xmmword [rbp + 0x170]
movaps xmmword [0x180136fb0], xmm0
movaps xmmword [0x180136fc0], xmm1
mov qword [rbp - 0x28], r9
jmp case.0x18002cd5b.186
mov eax, dword [r8]
movsxd rcx, dword [0x18008de00]
dec eax
cmp ecx, eax
jne 0x18002d338
mov r12, qword [r14 + rcx*8]
mov r14, qword [rbp - 0x28]
mov qword [rbp - 0x40], r12
test r14, r14
jne 0x18002cf89
lea rcx, str.TB_PATH
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov r14, rax
mov qword [rbp - 0x28], rax
mov rdx, r14
mov ecx, 0x94
call fcn.1800354d0
mov r14, qword [rbp - 0x10]
jmp case.0x18002cd5b.186
cmp ebx, 0xffffffff
je 0x18002d37e
mov eax, ebx
and eax, 0xf
cmp byte [rbp - 0x78], 0
mov dword [rbp - 0x74], eax
jne 0x18002d34e
lea rax, str.__WaveFront
mov qword [rbp + 0xd0], r11
mov qword [rbp + 0xd8], rax
lea rcx, str.Definujte_d
movups xmm0, xmmword [rbp + 0xd0]
lea rax, str.Draw
mov qword [rbp + 0xe0], rax
lea rax, str.CursedWin
mov qword [rbp + 0xe8], rax
lea rax, [0x18007b4b4]
movups xmm1, xmmword [rbp + 0xe0]
mov qword [rbp + 0xf0], rax
movups xmmword [rbp + 0x180], xmm0
movsd xmm0, qword [rbp + 0xf0]
movsd qword [rbp + 0x1a0], xmm0
movups xmmword [rbp + 0x190], xmm1
call fcn.180076310
jmp case.0x18002cd5b.186
lea rcx, str.dragMotion
call fcn.180076310
lea rcx, str.CACHE_S_LAST
call fcn.180076310
lea rcx, str.mips:isa32r5
call fcn.180076310
lea rcx, str.PseudoSocket.Send
call fcn.180076310
jmp case.0x18002cd5b.186
mov qword [rsp + 0x28], r9
lea rax, [rbp + 0x70]
mov r9, r12
mov qword [rbp - 0x50], rax
lea r8, [rbp + 0x70]
mov dword [rsp + 0x20], 0x9c
xor edx, edx
xor ecx, ecx
call fcn.180058760
test al, al
je 0x18002d3d4
mov rax, qword [rbp + 0x78]
lea rdx, [rbp - 0x38]
or rax, qword [rbp + 0x70]
mov r9d, 0x2f
xor r8d, r8d
mov qword [rbp - 0x38], rax
xor ecx, ecx
call fcn.180072b30
cmp eax, dword [0x1800e2268]
ja 0x18002d3a4
mov rax, qword [rbp + 0x90]
mov ebx, 0x79
movzx ecx, byte [rbp + 0xb3]
movzx edx, byte [rbp + 0xb2]
movzx r8d, byte [rbp + 0xb1]
mov r9, qword [rbp + 0xa8]
mov r10, qword [rbp + 0xa0]
mov r11, qword [rbp + 0x98]
mov r13, qword [rbp + 0x70]
movzx r14d, byte [rbp + 0xb0]
mov r12, qword [rbp + 0x78]
mov qword [rbp], rax
mov rax, qword [rbp + 0x88]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x10], rax
mov byte [rsp + 0x78], cl
mov dword [rbp - 0x60], edx
mov dword [rbp - 0x68], r8d
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x18], r10
mov qword [rbp - 0x38], r11
mov qword [rbp + 0x58], r13
cmp ebx, 0x6724
ja 0x18002d286
je 0x18002d25f
mov eax, ebx
sub eax, 0x79
je 0x18002d23b
sub eax, 0x28
je 0x18002d232
sub eax, 0x83
je 0x18002d225
cmp eax, 0x4c60
jne 0x18002d2bb
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x18], rax
lea rax, [rbp + 0x1b0]
mov qword [rsp + 0x60], rax
lea rax, [rbp + 0x18]
mov qword [rsp + 0x58], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x20]
mov dword [rsp + 0x48], 0xeb
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x38]
mov byte [rsp + 0x70], cl
lea rcx, [rbp + 0x50]
mov dword [rbp - 0x80], edx
lea rdx, [rbp + 0x48]
mov dword [rbp - 0x58], r8d
lea r8, [rsp + 0x70]
mov qword [rbp + 0x48], r9
lea r9, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x38], r10
mov qword [rbp + 0x50], r11
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x28], r13
call fcn.1800280b0
mov dword [rbp - 0x48], eax
mov rdi, qword [rbp - 0x48]
jmp 0x18002d26c
lea rax, [rbp + 0x58]
mov qword [rbp - 0x30], rax
jmp 0x18002d2bb
lea rcx, str.map_Nvda::Analysis::StatisticsFilter::ProviderEventsStatKey_unsigned_long_std::less_Nvda::Analysis::StatisticsFilter::ProviderEventsStatKey__std::allocator_std::pair_Nvda::Analysis::StatisticsFilter::ProviderEventsStatKey_const__unsigned_long_____
jmp 0x18002d266
test r14d, r14d
je 0x18002d2bb
mov r14, qword [rbp - 0x10]
mov r13d, dword [rbp - 0x70]
mov r12, qword [rbp - 0x40]
mov dword [rbp - 0x48], 0xffffffff
mov rdi, qword [rbp - 0x48]
mov rbx, rdi
jmp case.0x18002cd5b.186
lea rcx, str.6CStorageEncrypted::LoadCryptedIntVector__:_invalid_length
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
movzx ecx, byte [rsp + 0x78]
mov edx, dword [rbp - 0x60]
mov r8d, dword [rbp - 0x68]
mov r9, qword [rbp - 0x20]
mov r10, qword [rbp - 0x18]
mov r11, qword [rbp - 0x38]
jmp 0x18002d2bb
cmp ebx, 0x9a8f
je 0x18002d2f0
cmp ebx, 0xbb10
je 0x18002d2b2
cmp ebx, 0x174fc
jne 0x18002d2bb
mov rax, qword [rbp - 0x30]
mov rdi, qword [rax + 0x210]
mov qword [rax + 0x210], r12
jmp 0x18002d2ec
cmp byte [0x180091059], 0
je 0x18002d2de
add ebx, 0x4d0b
cmp ebx, 0x26858
jbe 0x18002d140
mov r14, qword [rbp - 0x10]
mov rbx, rdi
mov r13d, dword [rbp - 0x70]
mov r12, qword [rbp - 0x40]
jmp case.0x18002cd5b.186
xor edx, edx
mov ecx, 0x10001
call fcn.180025910
xor edi, edi
mov qword [rbp - 0x48], rdi
mov r14, qword [rbp - 0x10]
mov rbx, rdi
mov r13d, dword [rbp - 0x70]
mov r12, qword [rbp - 0x40]
jmp case.0x18002cd5b.186
movzx eax, word [rbp + 0xc8]
mov esi, r9d
imul ecx, eax, 0xf4240
mov dword [r14 + 8], ecx
dec r15d
lea eax, [r13 - 0xb]
lea r10, [0x180000000]
cmp r15d, eax
jbe 0x18002d40f
mov r8, qword [rbp - 8]
xor r9d, r9d
jmp 0x18002cd39
mov r8, qword [r14]
mov edx, 0xb8
xor ecx, ecx
call fcn.180073e50
xor eax, eax
jmp 0x18002d6a6
mov rcx, qword [rbp - 0x50]
mov r14d, 4
sub r14d, eax
cmp byte [rcx + 0x43], 0
lea rcx, [0x18007a5e8]
cmove eax, r14d
mov rdx, qword [r10 + rax*8 + 0x8de10]
call fcn.180076310
xor eax, eax
jmp 0x18002d6a6
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str._RCW_Walker__Calling_IJupiterObject::Connect__IJupiterObject__0x_p__RCW__0x_p_
call fcn.180076250
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9d, dword [0x1800e2268]
lea rdx, str.const_char___cdecl_WTF::GetStringWithTypeName_void___T__blink::CSSTimingData_
mov rcx, rax
mov r8, r12
call fcn.180076250
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, r12
lea rdx, str.int_imageAtomicMax_iimage2D_ivec2_int__
mov rcx, rax
call fcn.180076250
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rbp - 0x30]
mov r8d, dword [rbp - 0x80]
mov qword [rbp - 0x40], rcx
mov dword [rbp - 0x74], r8d
jmp 0x18002d41b
mov rdx, qword [rbp - 0x50]
mov r8d, dword [rbp - 0x74]
mov rcx, qword [rbp - 0x40]
imul r12d, r13d, 0x4b0
mov edi, r13d
cmp r13d, r12d
ja case.0x18002cd5b.183
movzx r15d, byte [rsp + 0x70]
lea r13, [rbp + 0x180]
mov eax, r8d
mov r14d, 4
lea r13, [r13 + rax*8]
mov eax, dword [rbp - 0x70]
nop dword [rax]
cmp edi, 0x1cc24
ja 0x18002d55f
je 0x18002d517
cmp edi, 0xc4
je 0x18002d506
cmp edi, 0x5ca4
je 0x18002d4dd
cmp edi, 0xb884
je 0x18002d4c9
cmp edi, 0x11464
je 0x18002d4a3
cmp edi, 0x17044
jne 0x18002d686
lea rcx, str.Local:_.ovftool
call fcn.180076310
jmp 0x18002d67f
mov rdx, qword [r13]
lea rcx, str.kums__HFS_s
call fcn.180076310
mov edx, ebx
lea rcx, str.FtpGetFileA
shr edx, 0x14
call fcn.180076310
jmp 0x18002d67f
mov rdx, rcx
lea rcx, str.vmul10ecuq
call fcn.180076310
jmp 0x18002d67f
mov eax, r8d
mov ecx, r14d
sub ecx, r8d
cmp byte [rdx + 0x43], 0
cmove eax, ecx
lea rcx, str.Timeline_Track
mov rdx, qword [r10 + rax*8 + 0x8de10]
call fcn.180076310
jmp 0x18002d67f
lea rcx, str.Remplacer_fichier
call fcn.180076310
jmp 0x18002d67f
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x80]
xor r15b, r15b
mov dword [rbp - 0x80], r14d
lea rdx, [rbp + 0x1b0]
mov byte [rsp + 0x70], r15b
lea r8, [rsp + 0x70]
mov ecx, 0xce
call fcn.180028570
lea rcx, [0x18007b5d4]
call fcn.180076310
lea rcx, str.real_size____1
call fcn.180076310
jmp 0x18002d67f
cmp edi, 0x22804
je 0x18002d5f8
cmp edi, 0x283e4
je 0x18002d5db
cmp edi, 0x2dfc4
je 0x18002d5d3
cmp edi, 0x33ba4
jne 0x18002d686
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x80]
lea rdx, [rbp + 0x1b0]
mov dword [rbp - 0x80], 0
lea r8, [rsp + 0x70]
mov byte [rsp + 0x70], r15b
mov ecx, 0xce
call fcn.180028570
lea rcx, [0x18007b5d4]
call fcn.180076310
mov rcx, qword [rbp - 0x50]
mov edx, 0x8d
call fcn.1800312a0
xor eax, eax
jmp 0x18002d6a6
xor r15b, r15b
jmp 0x18002d686
lea rcx, [0x18007b5d4]
call fcn.180076310
lea rcx, str.V869_CurrentPU
call fcn.180076310
jmp 0x18002d67f
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x80]
lea rdx, [rbp + 0x1b0]
mov dword [rbp - 0x80], 3
lea r8, [rsp + 0x70]
mov byte [rsp + 0x70], 0
mov ecx, 0xce
mov dword [rbp - 0x58], 2
call fcn.180028570
mov r15, qword [rbp - 0x50]
lea r9, [rbp - 0x58]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x20], r15
lea rdx, [rbp + 0x1b0]
mov byte [rsp + 0x70], al
mov ecx, 0xce
mov dword [rbp - 0x80], 1
call fcn.180028570
lea r9, [rbp - 0x80]
mov byte [rsp + 0x70], al
lea r8, [rsp + 0x70]
mov qword [rsp + 0x20], r15
lea rdx, [rbp + 0x1b0]
mov ecx, 0xce
call fcn.180028570
movzx r15d, al
mov eax, dword [rbp - 0x70]
mov r8d, dword [rbp - 0x74]
imul ecx, eax, 0x78
add edi, ecx
cmp edi, r12d
ja case.0x18002cd5b.183
mov rdx, qword [rbp - 0x50]
lea r10, [0x180000000]
mov rcx, qword [rbp - 0x40]
jmp 0x18002d450
mov eax, esi
mov rcx, qword [rbp + 0x4c0]
xor rcx, rsp
call fcn.180076c30
mov rbx, qword [rsp + 0x618]
add rsp, 0x5d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret