Function at 0x180016260
Capabilities:
Check for software breakpoints
Enumerate disk volumes

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2c8]
sub rsp, 0x3c8
mov r12, r9
mov r15d, ecx
xor eax, eax
mov qword [rbp - 0x58], rax
mov r13d, 0xf
mov qword [rbp - 0x50], r13
mov byte [rbp - 0x68], al
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x20], r13
mov byte [rbp + 8], al
mov eax, dword [0x1800ba2d0]
test al, 1
jne 0x1800162c1
or eax, 1
mov dword [0x1800ba2d0], eax
mov esi, r15d
lea r14d, [rcx - 0xe]
lea rcx, [0x180000000]
cmp r15d, r14d
jbe 0x18001652d
lea edi, [r15 - 0x9d]
mov r8d, 0x4e
lea r9d, [r8 + 8]
lea r10d, [r8 + 0x11]
lea r11, [0x1800969a7]
lea rbx, [0x1800ba2cc]
nop dword [rax + rax]
cmp edi, 0x1d
ja case.default.0x18001631a
mov ecx, dword [rcx + rdi*4 + 0x16c5c]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov eax, dword [str.ystem]
mov dword [rbp - 0x74], eax
movzx eax, word [0x18009c998]
mov word [rbp - 0x70], ax
jmp case.0x18001631a.2
cmp qword [rbp + 0x338], 0
je 0x180016c21
test r12, r12
jne case.0x18001631a.2
mov ebx, 0xac
cmp ebx, 0xac
je 0x180016367
cmp ebx, 0x2fb4
je 0x180016c15
jmp 0x18001639e
mov ecx, 2
call fcn.180079a6c
mov rcx, rax
lea rax, [0x180098c08]
mov qword [rsp + 0x28], rax
lea rax, [0x180096847]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, rax
lea rdx, str.float___OVERLOADABLE___expm1_float__
call fcn.18006bd20
add ebx, 0x2f08
cmp ebx, 0x5e10
jbe 0x180016351
mov rdx, qword [rbp + 0x318]
mov r8d, 0x4e
lea r9d, [r8 + 8]
lea r10d, [r8 + 0x11]
lea r11, [0x1800969a7]
lea rbx, [0x1800ba2cc]
jmp case.0x18001631a.2
mov dword [rbp - 0x28], 0x2f003a
mov word [rbp - 0x24], r8w
jmp case.0x18001631a.2
lea rcx, [rbp - 0x48]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x1800163f0
mov eax, dword [0x18009c9f0]
mov dword [rcx], eax
movzx eax, word [0x18009c9f4]
mov word [rcx + 4], ax
jmp case.0x18001631a.2
mov r8d, 2
lea rdx, [0x18009c9f8]
lea rcx, [rbp - 0x78]
call fcn.180074b20
mov rdx, qword [rbp + 0x318]
mov r8d, 0x4e
lea r9d, [r8 + 8]
lea r10d, [r8 + 0x11]
lea r11, [0x1800969a7]
jmp case.0x18001631a.2
mov dword [rbp - 0x22], 0x5f0056
jmp case.0x18001631a.2
xor eax, eax
mov word [rbp - 0x48], ax
jmp case.0x18001631a.2
cmp dword [rdx], 0
jge case.0x18001631a.2
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r12 + rax], 0
jne 0x180016470
mov dword [rdx], eax
jmp case.0x18001631a.2
mov rax, qword [rbp + 0x330]
cmp byte [rax], 0
setne byte [rsp + 0x61]
jmp case.0x18001631a.2
mov byte [0x1800ba2cc], 8
jmp case.0x18001631a.2
lea rcx, [rbp - 0x78]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x1800164a5
mov eax, dword [0x18009c9fc]
mov dword [rcx], eax
mov eax, 0x6f
mov word [rbp - 0x6c], ax
jmp case.0x18001631a.2
mov eax, dword [rdx]
lea r8d, [rax + 3]
lea rcx, [rsp + 0x61]
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x40], r11
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov edx, 4
lea r9d, [rdx - 3]
mov rcx, qword [rbp + 0x338]
call fcn.180035ca0
mov byte [rsp + 0x70], al
jmp 0x180016428
mov dword [rbp - 0x77], 0x537465
lea rcx, [0x180000000]
dec esi
dec edi
cmp esi, r14d
ja 0x180016300
lea edi, [r15 - 0xd]
cmp r15d, edi
jbe 0x1800166aa
lea ebx, [r15 - 0x98]
mov edx, 0x55
lea r8d, [rdx + 0x17]
lea r14d, [rdx - 0x12]
mov rsi, qword [rsp + 0x68]
cmp ebx, 0x22
ja case.0x180016575.13
movzx eax, byte [rcx + rbx + 0x16d0c]
mov ecx, dword [rcx + rax*4 + 0x16cd4]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x1800165b2
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800165ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180016c1b
call fcn.18006dad0
mov eax, dword [rsp + 0x70]
add rsp, 0x3c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
movsd xmm0, qword [0x18009ca00]
movsd qword [rbp - 0x42], xmm0
mov eax, dword [0x18009ca08]
mov dword [rbp - 0x3a], eax
mov dword [rbp - 0x36], 0x64
jmp case.0x180016575.13
lea rcx, [rbp + 0x180]
call rsi
mov eax, dword [rbp + 0x1a0]
mov dword [rsp + 0x70], eax
mov edx, 0x55
lea r8d, [rdx + 0x17]
jmp case.0x180016575.13
mov dword [rbp - 0xa], 0x640065
mov dword [rbp - 6], 0x70002e
jmp case.0x180016575.13
lea r8, [rbp - 0x78]
lea rdx, [rbp - 0x48]
mov ecx, 0xdc
call fcn.180007d20
mov rsi, rax
mov edx, 0x55
lea r8d, [rdx + 0x17]
jmp case.0x180016575.13
mov dword [rbp - 0x16], 0x6c006f
jmp case.0x180016575.13
mov dword [rbp - 0x44], 0x72
jmp case.0x180016575.13
mov dword [rbp - 0x12], 0x61006c
mov dword [rbp - 0xe], 0x730070
jmp case.0x180016575.13
mov word [rbp - 0x18], r14w
jmp case.0x180016575.13
mov eax, dword [0x1800986d8]
mov dword [rbp - 0x34], eax
movzx eax, word [0x1800986dc]
mov word [rbp - 0x30], ax
jmp case.0x180016575.13
mov dword [rbp - 0x1c], 0x2f0049
jmp case.0x180016575.13
mov dword [rbp - 2], 0x67006e
jmp case.0x180016575.13
mov word [rbp - 0x1e], dx
dec ebx
lea eax, [rbx + 0x98]
cmp eax, edi
jbe 0x1800166aa
lea rcx, [0x180000000]
jmp 0x180016553
mov ebx, r15d
lea edi, [r15 + 0x7df]
mov rax, qword [rsp + 0x68]
movzx r8d, byte [rbp + 0x310]
movzx edx, byte [rbp + 0x310]
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x60], r8b
mov byte [rbp + 0x310], dl
cmp r15d, edi
jae 0x1800168e4
mov rsi, qword [rbp + 0x318]
nop dword [rax + rax]
cmp ebx, 0x440
ja 0x1800167df
je 0x1800167b7
cmp ebx, 0x26f
ja 0x180016791
je 0x180016777
cmp ebx, 0x9e
je 0x18001676c
cmp ebx, 0x139
je 0x180016744
cmp ebx, 0x1d4
jne 0x1800168d6
mov eax, dword [0x18009cab9]
mov dword [rbp + 0x71], eax
movzx eax, byte [0x18009cabd]
mov byte [rbp + 0x75], al
jmp 0x1800168d6
mov r8d, 1
lea rdx, [0x18009ca93]
lea rcx, [rbp + 0x70]
call fcn.180074b20
movzx edx, byte [rbp + 0x310]
movzx r8d, byte [rsp + 0x60]
jmp 0x1800168d6
xor eax, eax
mov word [rbp + 2], ax
jmp 0x1800168d6
movzx eax, word [0x18009ca81]
mov word [rbp + 0x76], ax
movzx eax, byte [0x18009ca83]
mov byte [rbp + 0x78], al
jmp 0x1800168d6
cmp ebx, 0x30a
je 0x1800167ae
cmp ebx, 0x3a5
jne 0x1800168d6
mov byte [rbp + 0x7a], 0
jmp 0x1800168d6
mov byte [rbp + 0x79], 0x38
jmp 0x1800168d6
mov r8d, 4
lea rdx, [0x18009caab]
lea rcx, [rbp + 0x7a]
call fcn.180074b20
movzx edx, byte [rbp + 0x310]
movzx r8d, byte [rsp + 0x60]
jmp 0x1800168d6
cmp ebx, 0x6ac
ja 0x1800168ad
je 0x18001687d
cmp ebx, 0x4db
je 0x180016877
cmp ebx, 0x576
je 0x18001683c
cmp ebx, 0x611
jne 0x1800168d6
mov r8d, 1
lea rdx, [0x18009ca2b]
lea rcx, [rbp + 0x70]
call fcn.1800748e0
mov byte [rbp + 0x83], 0x4d
movzx edx, byte [rbp + 0x310]
movzx r8d, byte [rsp + 0x60]
jmp 0x1800168d6
mov r8d, 1
lea rdx, [0x18009caee]
lea rcx, [rbp + 0x70]
call fcn.1800748e0
mov r8d, 3
lea rdx, [0x18009cb13]
lea rcx, [rbp + 0x70]
call fcn.1800748e0
movzx edx, byte [rbp + 0x310]
movzx r8d, byte [rsp + 0x60]
jmp 0x1800168d6
mov byte [rbp + 0x7e], 0
jmp 0x1800168d6
mov byte [rbp + 0x84], 0
cmp dword [rsi], 0
je case.0x180016575.7
mov rax, qword [rbp + 0x338]
cmp qword [rax + 0x10], 0
je case.0x180016575.7
cmp qword [r12 + 0x10], 0
je case.0x180016575.7
jmp 0x1800168d6
cmp ebx, 0x747
je 0x1800168c7
cmp ebx, 0x7e2
jne 0x1800168d6
mov dl, 1
mov byte [rbp + 0x310], dl
jmp 0x1800168d6
xor eax, eax
mov qword [rsp + 0x68], rax
mov r8b, 1
mov byte [rsp + 0x60], r8b
add ebx, 0x9b
cmp ebx, edi
jb 0x1800166f0
lea eax, [r15 + 0xdd]
cmp r15d, eax
jae 0x180016b9b
lea r14d, [r15 - 0x9e]
mov r15d, 0xd
mov rsi, qword [rsp + 0x68]
mov r12d, dword [rbp + 0x310]
mov r13, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x68]
nop word [rax + rax]
cmp r14d, 0xcc
ja case.0x180016948.1
lea r9, [0x180000000]
movzx eax, byte [r9 + r14 + 0x16d64]
mov ecx, dword [r9 + rax*4 + 0x16d30]
add rcx, r9
jmp rcx
mov rsi, 0xffffffffffffffff
jmp case.0x180016948.1
mov rax, qword [rbp + 0x338]
mov rcx, qword [rax + 0x10]
mov r10, qword [rbp + 0x328]
cmp qword [r10 + 0x10], rcx
cmovae rcx, qword [r10 + 0x10]
mov qword [rsp + 0x78], rcx
mov dword [rsp + 0x20], 0x95
lea r9, [rbp - 0x68]
lea r8, [rbp + 8]
lea rdx, [rsp + 0x78]
mov rcx, r10
call fcn.18000e9f0
xor eax, eax
mov ecx, eax
movzx eax, byte [rsp + 0x60]
cmp dword [rbp - 0x80], ecx
cmovne ecx, eax
movzx r8d, cl
mov byte [rsp + 0x60], cl
jmp 0x180016b82
test r8b, r8b
je 0x180016a0b
mov ebx, 0x73
nop dword [rax]
mov eax, ebx
sub eax, 0x70
je 0x1800169fb
sub eax, 1
je 0x1800169ec
sub eax, 1
je 0x1800169e3
cmp eax, 1
jne 0x180016a04
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
movups xmmword [rbp + 0x58], xmm0
jmp 0x180016a04
mov dword [rbp + 0x48], 0x20
jmp 0x180016a04
lea rdx, [rbp + 0x48]
mov rcx, rsi
call qword [sym.imp.dbghelp.dll_SymGetSymNext64]
jmp 0x180016a04
mov rcx, rsi
call qword [sym.imp.dbghelp.dll_SymCleanup]
dec ebx
cmp ebx, 0x6f
ja 0x1800169c0
mov dword [rsp + 0x28], r12d
mov eax, dword [rbp - 0x7c]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x28]
lea r8, [rbp - 0x28]
mov rdx, r13
mov rcx, qword [rsp + 0x68]
call sub.IMM32.dll_ImmGetConversionListW
jmp 0x180016b7c
mov rax, qword [rbp + 0x318]
mov eax, dword [rax]
mov dword [rsp + 0x78], eax
mov r8d, 0xd9
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x68]
call fcn.180018620
jmp 0x180016b7c
mov rax, qword [rbp + 0x338]
mov rcx, qword [rbp + 0x320]
cmp rcx, rax
je 0x180016a8d
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x180016a77
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
call fcn.180040050
movzx edx, byte [rbp + 0x310]
movzx r8d, byte [rsp + 0x60]
mov r12d, 1
jmp case.0x180016948.1
test dl, dl
je 0x180016adb
mov ebx, 0x94
mov eax, ebx
sub eax, 0x94
je 0x180016aba
cmp eax, 0xa
jne 0x180016ad0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
jmp 0x180016ad0
mov r8d, 0x104
lea rdx, [rbp + 0x1b0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
add ebx, 0xa
cmp ebx, 0xa8
jb 0x180016aa1
mov rax, qword [rbp + 0x330]
mov rax, qword [rax]
mov qword [rsp + 0x78], rax
mov r9, qword [rbp + 0x320]
lea r8, [rsp + 0x78]
lea rdx, [rbp + 8]
mov ecx, 0xba
call fcn.18000efb0
jmp 0x180016b7c
xor eax, eax
mov ecx, eax
movzx eax, dl
cmp rdi, 0xffffffffffffffff
cmovne ecx, eax
movzx edx, cl
mov byte [rbp + 0x310], cl
jmp case.0x180016948.1
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], rax
mov dword [rbp + 0x40], eax
jmp case.0x180016948.1
xor eax, eax
mov r13d, eax
jmp case.0x180016948.1
mov rdi, 0xffffffffffffffff
jmp case.0x180016948.1
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.dbghelp.dll_SymInitialize]
mov dword [rbp - 0x80], eax
mov dword [rbp + 0x28], 0x1c
jmp 0x180016b7c
mov r8d, 0x104
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
mov rdi, rax
mov dword [rbp - 0x7c], 0x1c
movzx r8d, byte [rsp + 0x60]
movzx edx, byte [rbp + 0x310]
add r14d, 0x11
sub r15, 1
jne 0x180016920
mov r13, qword [rbp + 0x20]
cmp r13, 0x10
jb 0x180016bd0
lea rdx, [r13 + 1]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180016bca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180016c0f
call fcn.18006dad0
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x1800165b2
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800165ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180016c1b
jmp 0x1800165ad
call fcn.180073fa4
nop
call fcn.180075408
nop
call fcn.180073fa4
nop
mov ecx, 2
call fcn.180079a6c
mov rcx, rax
lea rax, str.bson
mov qword [rsp + 0x28], rax
lea r8, [0x180096847]
mov qword [rsp + 0x20], r8
xor r9d, r9d
lea rdx, str.state.get_offset__state.put_offset
call fcn.18006bd20
call fcn.180075408
int3