Function at 0x18006e200
Capabilities:
Check for software breakpoints
Parse pe header

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
mov rdi, rcx
mov r14, r9
mov ecx, dword [rbp + 0x77]
lea eax, [rcx + 0x2a3]
mov dword [rbp + 0x1f], eax
cmp ecx, eax
jae 0x18006e296
mov r9d, dword [rbp + 0x77]
xor esi, esi
mov r11d, dword [rbp + 0x77]
mov r8d, dword [rbp + 0x77]
mov ebx, dword [rbp + 0x77]
mov eax, dword [rbp + 0x77]
mov r10d, dword [rbp + 0x77]
mov r13d, dword [rbp + 0x77]
mov dword [rbp - 0x35], r9d
mov dword [rbp - 0x1d], r11d
mov dword [rbp - 0x39], r8d
mov dword [rbp + 0xb], ebx
mov dword [rbp + 0x1b], eax
mov dword [rbp - 0x21], r10d
mov eax, ecx
sub eax, 0x32
je 0x18006e30e
sub eax, 0x1d
je 0x18006e2bc
sub eax, 0x6a
je 0x18006e2b4
sub eax, 0x1d
je 0x18006e296
cmp eax, 0x6a
jne 0x18006ed46
mov eax, dword [rbp + 7]
mov rbx, qword [rsp + 0x108]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rbp + 7], esi
jmp 0x18006ed46
mov rbx, qword [rdi]
mov rdi, qword [rdi + 8]
cmp rbx, rdi
je 0x18006e305
nop dword [rax + rax]
mov rax, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x28], rdx
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 0x45]
call fcn.180064ae0
test al, al
jne 0x18006ed80
mov rdx, qword [rbp + 0x6f]
add rbx, 8
cmp rbx, rdi
jne 0x18006e2d0
mov ecx, dword [rbp + 0x77]
mov byte [rbp + 7], 0
jmp 0x18006ed46
movzx r15d, byte [rdx]
mov r12, rdx
test r15b, r15b
je 0x18006ed46
nop
inc r12
cmp r15b, 0x25
jne 0x18006ed11
mov esi, 0xd7
lea eax, [rsi - 0xcd]
mov rdx, r12
cmp eax, 0xa
ja case.default.0x18006e35c
lea rcx, [0x180000000]
mov ecx, dword [rcx + rax*4 + 0x6ed8c]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
xor eax, eax
mov r9d, eax
mov dword [rbp - 0x35], eax
lea r13d, [rax - 1]
jmp case.default.0x18006e35c
movzx r15d, byte [r12]
xor eax, eax
mov dword [rbp - 0x1d], eax
mov r11d, eax
test r15b, r15b
je 0x18006e3dd
inc r12
cmp r15b, 0x2d
jne 0x18006e391
mov eax, 1
jmp 0x18006e3c7
cmp r15b, 0x2b
jne 0x18006e39e
mov eax, 2
jmp 0x18006e3c7
cmp r15b, 0x20
jne 0x18006e3ab
mov eax, 4
jmp 0x18006e3c7
cmp r15b, 0x23
jne 0x18006e3b8
mov eax, 8
jmp 0x18006e3c7
cmp r15b, 0x30
jne case.0x18006e35c.211
mov eax, reloc.SHELL32.dll_ILFindLastID
movzx r15d, byte [r12]
or eax, r8d
mov dword [rbp - 0x39], eax
mov r8d, eax
test r15b, r15b
jne 0x18006e381
mov dword [rbp - 0x39], eax
inc r12
jmp case.default.0x18006e35c
movzx eax, r15b
cmp eax, 0x78
ja case.0x18006e40b.1
lea rdx, [0x180000000]
movzx eax, byte [rdx + rax + 0x6ede8]
mov ecx, dword [rdx + rax*4 + 0x6edb8]
add rcx, rdx
jmp rcx
add qword [r14], 4
mov edx, 0x63
mov rax, qword [r14]
mov rcx, rdi
mov dword [rbp - 0x31], r8d
lea r8, [rbp - 0x29]
mov dword [rbp - 0x29], r9d
lea r9, [rbp + 0xf]
movzx eax, byte [rax - 4]
mov byte [rbp + 0xf], al
lea rax, [rbp - 0x31]
mov qword [rsp + 0x20], rax
call fcn.1800205a0
test eax, eax
je 0x18006eace
nop dword [rax]
mov eax, 0xffffffff
jmp 0x18006e299
mov eax, 0x10c
nop
cmp eax, 0x10c
je 0x18006e52b
add eax, 0x3a
cmp eax, 0x146
jb 0x18006e460
mov ecx, 0xd5
nop word [rax + rax]
cmp ecx, 0xd5
je 0x18006e596
cmp ecx, 0x2f6d
je 0x18006e578
cmp ecx, 0x5e05
jne 0x18006e5bd
mov eax, dword [rbp + 0x1b]
lea rdx, [rbp - 1]
mov dword [rbp - 0x11], eax
mov rcx, rdi
lea rax, [rbp - 0x19]
mov dword [rbp - 0x19], r8d
mov qword [rsp + 0x40], rax
lea r8, [rbp - 9]
mov dword [rsp + 0x38], 0xa3
lea rax, [rbp - 0x29]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x31]
mov qword [rsp + 0x28], rax
lea rax, str.kb_postfix
mov dword [rbp - 0x29], r9d
lea r9, [rbp - 0x11]
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x31], ebx
mov dword [rbp - 1], r13d
mov dword [rbp - 9], 0xa
call fcn.180020760
test eax, eax
je 0x18006eace
mov ecx, 0x91
mov eax, ecx
sub eax, 0x91
je 0x18006e60d
cmp eax, 1
je 0x18006e296
jmp 0x18006e614
add qword [r14], 8
lea rcx, [rbp - 0x19]
mov rax, qword [r14]
mov edx, 0x8c
mov dword [rbp - 0x31], r8d
lea r8, [rbp - 0x31]
mov dword [rbp - 0x29], r9d
lea r9, [rbp - 0x29]
mov dword [rbp - 0x19], r13d
mov rax, qword [rax - 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call fcn.18006f050
test eax, eax
jne 0x18006e450
mov r8d, dword [rbp - 0x39]
mov esi, 0xce
jmp 0x18006ec14
mov eax, dword [rbp + 0x17]
mov edx, 1
test eax, eax
cmovs ebx, edx
mov edx, eax
neg edx
mov dword [rbp + 0xb], ebx
test eax, eax
cmovns edx, eax
mov dword [rbp + 0x1b], edx
jmp 0x18006e5bd
xor eax, eax
mov ebx, eax
mov dword [rbp + 0xb], eax
mov rax, qword [r14]
add rax, 4
mov qword [r14], rax
test r10d, r10d
jne 0x18006e5b7
test r11d, r11d
je 0x18006e5b7
movsx edx, word [rax - 4]
jmp 0x18006e5ba
mov edx, dword [rax - 4]
mov dword [rbp + 0x17], edx
add ecx, 0x2e98
cmp ecx, 0x8bc8
jbe 0x18006e480
mov ebx, 0xca
nop dword [rax]
nop dword [rax + rax]
mov eax, ebx
sub eax, 0xc9
je 0x18006eace
cmp eax, 1
jne 0x18006e6b0
test r10d, r10d
jne 0x18006e630
test r11d, r11d
je 0x18006e630
add qword [r14], 4
mov rax, qword [r14]
movzx ecx, word [rax - 4]
jmp 0x18006e63a
mov dword [rbp + 7], 0xffffffff
inc ecx
cmp ecx, 0x93
jb 0x18006e510
mov r8d, dword [rbp - 0x39]
mov esi, 0xce
jmp 0x18006ec14
add qword [r14], 4
mov rax, qword [r14]
mov ecx, dword [rax - 4]
xor eax, eax
mov dword [rbp - 1], r8d
mov dword [rbp - 0x11], eax
lea r8, [rbp - 0x29]
lea rax, [rbp - 1]
mov dword [rbp - 9], r9d
mov qword [rsp + 0x40], rax
lea r9, [rbp - 0x19]
mov dword [rsp + 0x38], 0xa3
lea rax, [rbp - 9]
mov qword [rsp + 0x30], rax
lea rdx, [rbp - 0x31]
lea rax, [rbp - 0x11]
mov dword [rbp - 0x19], ecx
mov qword [rsp + 0x28], rax
mov rcx, rdi
lea rax, str._m0_.m__.m
mov dword [rbp - 0x31], r13d
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x29], 0xa
call fcn.180020760
test eax, eax
jne 0x18006e450
mov r8d, dword [rbp - 0x39]
mov r9d, dword [rbp - 0x35]
mov r10d, dword [rbp - 0x21]
mov r11d, dword [rbp - 0x1d]
dec ebx
cmp ebx, 0xc8
ja 0x18006e5e0
mov ebx, 0x113
mov eax, ebx
sub eax, 0x112
je 0x18006eace
cmp eax, 1
jne 0x18006e760
test r10d, r10d
jne 0x18006e6f0
test r11d, r11d
je 0x18006e6f0
add qword [r14], 4
mov rax, qword [r14]
movzx ecx, word [rax - 4]
jmp 0x18006e6fa
add qword [r14], 4
mov rax, qword [r14]
mov ecx, dword [rax - 4]
xor eax, eax
mov dword [rbp - 1], r8d
mov dword [rbp - 0x11], eax
lea r8, [rbp - 0x29]
lea rax, [rbp - 1]
mov dword [rbp - 9], r9d
mov qword [rsp + 0x40], rax
lea r9, [rbp - 0x19]
mov dword [rsp + 0x38], 0xa3
lea rax, [rbp - 9]
mov qword [rsp + 0x30], rax
lea rdx, [rbp - 0x31]
lea rax, [rbp - 0x11]
mov dword [rbp - 0x19], ecx
mov qword [rsp + 0x28], rax
mov rcx, rdi
lea rax, str.01234567
mov dword [rbp - 0x31], r13d
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x29], 8
call fcn.180020760
test eax, eax
jne 0x18006e450
mov r8d, dword [rbp - 0x39]
dec ebx
mov r9d, dword [rbp - 0x35]
mov r10d, dword [rbp - 0x21]
mov r11d, dword [rbp - 0x1d]
cmp ebx, 0x111
ja 0x18006e6c3
mov ebx, SHSetInstanceExplorer
mov eax, ebx
sub eax, 0xae
je 0x18006e79a
cmp eax, 1
je 0x18006eace
jmp 0x18006e821
test r10d, r10d
jne 0x18006e7b1
test r11d, r11d
je 0x18006e7b1
add qword [r14], 4
mov rax, qword [r14]
movzx ecx, word [rax - 4]
jmp 0x18006e7bb
add qword [r14], 4
mov rax, qword [r14]
mov ecx, dword [rax - 4]
xor eax, eax
mov dword [rbp - 1], r8d
mov dword [rbp - 0x11], eax
lea r8, [rbp - 0x29]
lea rax, [rbp - 1]
mov dword [rbp - 9], r9d
mov qword [rsp + 0x40], rax
lea r9, [rbp - 0x19]
mov dword [rsp + 0x38], 0xa3
lea rax, [rbp - 9]
mov qword [rsp + 0x30], rax
lea rdx, [rbp - 0x31]
lea rax, [rbp - 0x11]
mov dword [rbp - 0x19], ecx
mov qword [rsp + 0x28], rax
mov rcx, rdi
lea rax, str.Transfer_Success
mov dword [rbp - 0x31], r13d
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x29], reloc.SHELL32.dll_ILFindLastID
call fcn.180020760
test eax, eax
jne 0x18006e450
mov r8d, dword [rbp - 0x39]
inc ebx
mov r9d, dword [rbp - 0x35]
mov r10d, dword [rbp - 0x21]
mov r11d, dword [rbp - 0x1d]
cmp ebx, 0xb0
jb 0x18006e783
mov ebx, 0xa4
nop dword [rax]
nop dword [rax + rax]
mov eax, ebx
sub eax, 0xa3
je 0x18006eace
cmp eax, 1
jne 0x18006e917
test r10d, r10d
jne 0x18006e87d
test r11d, r11d
je 0x18006e87d
add qword [r14], 4
mov rax, qword [r14]
movzx ecx, word [rax - 4]
jmp 0x18006e887
add qword [r14], 4
mov rax, qword [r14]
mov ecx, dword [rax - 4]
xor eax, eax
mov dword [rbp - 1], r8d
mov dword [rbp - 0x11], eax
lea r8, [rbp - 0x29]
lea rax, [rbp - 1]
mov dword [rbp - 9], r9d
mov qword [rsp + 0x40], rax
lea r9, [rbp - 0x19]
mov dword [rsp + 0x38], 0xa3
lea rax, [rbp - 9]
mov qword [rsp + 0x30], rax
lea rdx, [rbp - 0x31]
lea rax, [rbp - 0x11]
mov dword [rbp - 0x19], ecx
mov qword [rsp + 0x28], rax
mov rcx, rdi
lea rax, str.codingDependency
mov dword [rbp - 0x31], r13d
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x29], reloc.SHELL32.dll_ILFindLastID
call fcn.180020760
test eax, eax
je 0x18006e917
mov eax, 0x117
nop
cmp eax, 0x117
je 0x18006e904
cmp eax, 0x3f36
je 0x18006e296
jmp 0x18006e90b
mov dword [rbp + 7], 0xffffffff
add eax, 0x3e1f
cmp eax, 0x7c3e
jbe 0x18006e8f0
mov r8d, dword [rbp - 0x39]
dec ebx
mov r9d, dword [rbp - 0x35]
mov r10d, dword [rbp - 0x21]
mov r11d, dword [rbp - 0x1d]
cmp ebx, 0xa2
ja 0x18006e850
mov ebx, 0x4d
nop word [rax + rax]
cmp ebx, 0x4d
je 0x18006e956
cmp ebx, 0x1eae
je 0x18006eace
jmp 0x18006e9eb
add qword [r14], 8
lea rdx, [rbp - 0x31]
mov rax, qword [r14]
xor ecx, ecx
mov dword [rbp - 0x11], ecx
mov rcx, rdi
mov dword [rbp - 1], r8d
lea r8, [rbp - 0x29]
mov dword [rbp - 9], r9d
lea r9, [rbp - 0x19]
mov eax, dword [rax - 8]
mov dword [rbp - 0x19], eax
lea rax, [rbp - 1]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 9]
mov dword [rsp + 0x38], 0xa3
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x11]
mov qword [rsp + 0x28], rax
lea rax, str.________
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x31], r13d
mov dword [rbp - 0x29], reloc.SHELL32.dll_ILFindLastID
call fcn.180020760
test eax, eax
je 0x18006e9eb
mov ecx, 0x7f
mov eax, ecx
sub eax, 0x7f
je 0x18006e9d9
cmp eax, 0x5a
je 0x18006e296
jmp 0x18006e9e0
mov dword [rbp + 7], 0xffffffff
add ecx, 0x5a
cmp ecx, 0x133
jb 0x18006e9c7
mov r8d, dword [rbp - 0x39]
add ebx, 0x1e61
mov r9d, dword [rbp - 0x35]
cmp ebx, 0x3cc2
jbe 0x18006e940
mov edx, 0x7d
nop word [rax + rax]
mov eax, edx
sub eax, 0x7d
je 0x18006ea22
cmp eax, 1
je 0x18006eace
jmp 0x18006ea34
add qword [r14], 8
mov rax, qword [r14]
mov ecx, dword [rdi + 8]
sub ecx, dword [rdi]
mov rax, qword [rax - 8]
mov dword [rax], ecx
inc edx
cmp edx, 0x7f
jb 0x18006ea10
dec r12
mov ebx, 0x6c
mov eax, ebx
sub eax, 0x6c
je 0x18006ea51
cmp eax, 1
je 0x18006eace
jmp 0x18006ea89
movzx edx, r15b
mov rcx, rdi
call qword [rdi + 0x28]
test eax, eax
je 0x18006ea89
mov eax, 0x11
cmp eax, 0x11
je 0x18006ea76
cmp eax, 0x50c
je 0x18006e296
jmp 0x18006ea7d
mov dword [rbp + 7], 0xffffffff
add eax, 0x4fb
cmp eax, 0x9f6
jbe 0x18006ea64
inc ebx
cmp ebx, 0x6e
jb 0x18006ea43
mov dl, 0x25
mov rcx, rdi
call qword [rdi + 0x28]
test eax, eax
jne 0x18006eaaa
movzx edx, r15b
mov rcx, rdi
call qword [rdi + 0x28]
test eax, eax
je 0x18006eace
mov ecx, 0x47
nop
mov eax, ecx
sub eax, 0x46
je 0x18006e296
cmp eax, 1
jne 0x18006eac7
mov dword [rbp + 7], 0xffffffff
dec ecx
cmp ecx, 0x45
ja 0x18006eab0
mov r8d, dword [rbp - 0x39]
mov esi, 0xce
jmp 0x18006ec14
cmp r15b, 0x68
jne 0x18006eaf9
movzx r15d, byte [rdx]
mov eax, 1
mov r11d, eax
mov dword [rbp - 0x1d], eax
inc r12
jmp case.default.0x18006e35c
cmp r15b, 0x6c
jne case.default.0x18006e35c
movzx r15d, byte [r12]
mov eax, 1
mov r10d, eax
mov dword [rbp - 0x21], eax
inc r12
jmp case.default.0x18006e35c
xor eax, eax
mov r10d, eax
mov dword [rbp - 0x21], eax
jmp case.default.0x18006e35c
mov esi, 0xd3
mov eax, 0x32
mov dword [rbp + 0x77], eax
jmp case.default.0x18006e35c
cmp r15b, 0x2e
jne case.default.0x18006e35c
mov ebx, 0x124
xor edi, edi
nop dword [rax + rax]
mov eax, ebx
sub eax, 0x123
je 0x18006eb72
cmp eax, 1
jne 0x18006ebf8
movzx r15d, byte [r12]
mov r13d, edi
inc r12
jmp 0x18006ebf8
movzx ecx, r15b
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
test eax, eax
je 0x18006ebc1
mov edx, 0x10c
cmp edx, 0x10c
jne 0x18006eba6
movzx eax, r15b
lea r13d, [r13 + r13*4]
movzx r15d, byte [r12]
lea r13d, [r13 - 0x18]
inc r12
lea r13d, [rax + r13*2]
add edx, 0x35
cmp edx, 0x141
jb 0x18006eb85
movzx ecx, r15b
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
test eax, eax
jne 0x18006eb80
jmp 0x18006ebf8
cmp r15b, 0x2a
jne 0x18006ebf8
mov ecx, 0x4e
nop dword [rax]
mov eax, ecx
sub eax, 0x4e
je 0x18006ebe6
cmp eax, 1
jne 0x18006ebf1
movzx r15d, byte [r12]
inc r12
jmp 0x18006ebf1
add qword [r14], 4
mov rax, qword [r14]
mov r13d, dword [rax - 4]
inc ecx
cmp ecx, 0x50
jb 0x18006ebd0
dec ebx
cmp ebx, 0x122
ja 0x18006eb50
mov r8d, dword [rbp - 0x39]
nop word [rax + rax]
mov rdi, qword [rbp + 0x67]
mov r9d, dword [rbp - 0x35]
mov r10d, dword [rbp - 0x21]
mov r11d, dword [rbp - 0x1d]
mov ebx, dword [rbp + 0xb]
dec esi
cmp esi, 0xcc
ja 0x18006e332
jmp 0x18006ed23
mov eax, r8d
mov ecx, r8d
xor ecx, 4
and eax, 6
cmp al, 6
cmovne ecx, r8d
mov r8d, ecx
mov dword [rbp - 0x39], ecx
jmp case.default.0x18006e35c
xor eax, eax
mov r8d, eax
mov dword [rbp - 0x39], eax
jmp case.default.0x18006e35c
mov eax, r8d
movzx ebx, r15b
mov ecx, r8d
and eax, 0x11
xor ecx, 0x10
cmp al, 0x11
cmovne ecx, r8d
mov dword [rbp - 0x39], ecx
mov edi, ecx
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
test eax, eax
je 0x18006ecb9
mov edi, dword [rbp - 0x35]
nop dword [rax]
nop dword [rax + rax]
movzx r15d, byte [r12]
lea eax, [rdi - 6]
lea eax, [rdi + rax*4]
mov ecx, r15d
lea edi, [rbx + rax*2]
inc r12
mov ebx, r15d
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
test eax, eax
jne 0x18006ec90
mov dword [rbp - 0x35], edi
jmp 0x18006ec06
mov dword [rbp - 0x39], edi
mov r8d, edi
cmp r15b, 0x2a
jne 0x18006ec10
mov ecx, 0xbf
nop
mov eax, ecx
sub eax, 0xbe
je 0x18006ecef
cmp eax, 1
jne 0x18006ecf7
add qword [r14], 4
mov rax, qword [r14]
mov r9d, dword [rax - 4]
mov dword [rbp - 0x35], r9d
jmp 0x18006ecfb
movzx r15d, byte [r12]
inc r12
mov r9d, dword [rbp - 0x35]
dec ecx
cmp ecx, 0xbd
ja 0x18006ecd0
mov dword [rbp - 0x39], edi
mov rdi, qword [rbp + 0x67]
jmp 0x18006ec18
movzx edx, r15b
mov rcx, rdi
call qword [rdi + 0x28]
test eax, eax
jne 0x18006e450
movzx r15d, byte [r12]
mov r8d, dword [rbp - 0x39]
mov r9d, dword [rbp - 0x35]
mov r10d, dword [rbp - 0x21]
mov r11d, dword [rbp - 0x1d]
test r15b, r15b
jne 0x18006e320
mov ecx, dword [rbp + 0x77]
xor esi, esi
add ecx, 0x87
mov dword [rbp + 0x77], ecx
cmp ecx, dword [rbp + 0x1f]
jae 0x18006e296
mov r8d, dword [rbp - 0x39]
mov rdi, qword [rbp + 0x67]
mov r9d, dword [rbp - 0x35]
mov r10d, dword [rbp - 0x21]
mov r11d, dword [rbp - 0x1d]
mov ebx, dword [rbp + 0xb]
mov rdx, qword [rbp + 0x6f]
jmp 0x18006e273
mov byte [rbp + 7], 1
jmp 0x18006e296