Function at 0x18000a390
Capabilities:
Create shortcut via ishelllink

Disassembly:
push rbp
push r14
push r15
lea rbp, [rsp - 0x1020]
mov eax, 0x1120
call fcn.1800dfab0
sub rsp, rax
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x1148], rbx
mov qword [rsp + 0x1150], rsi
mov qword [rsp + 0x1158], rdi
mov rax, qword [0x1801a3080]
xor rax, rsp
mov qword [rbp + 0x1010], rax
mov rbx, rcx
lea rcx, [rsp + 0x40]
call fcn.18008f6a0
nop
xor r14b, r14b
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r15
test rbx, rbx
jne 0x18000a4df
lea edx, [rbx + 2]
lea rcx, [0x1801ab190]
call fcn.1800c2600
mov edi, eax
test eax, eax
je 0x18000acd1
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rsp + 0x60], xmm1
mov word [rsp + 0x50], r15w
lea r8d, [r15 + 9]
lea rdx, [0x1801533d8]
lea rcx, [rsp + 0x50]
call fcn.18000c0a0
mov dword [rsp + 0x28], 0x5a1
lea rax, str.RC::RCApiHookNewFuns::OnLoadHookArrived
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rsp + 0x50]
lea edx, [rbx + 2]
lea rcx, [0x1801ab190]
call fcn.1800c2650
cmp edi, 1
jbe 0x18000a495
lea rdx, [rsp + 0x50]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000acbd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000acb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ad3b
jmp 0x18000acb8
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [0x18013b960]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x18013b990]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test eax, eax
js 0x18000abc8
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x18000abc8
mov rax, qword [rcx]
lea r8, [rsp + 0x38]
lea rdx, [0x18013b980]
call qword [rax]
mov esi, eax
test eax, eax
js 0x18000aac7
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x18000aac7
mov rax, qword [0x1801a8838]
xor r8d, r8d
mov rdx, rbx
test rax, rax
je 0x18000a55a
call rax
jmp 0x18000a565
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov edi, eax
test eax, eax
jns 0x18000a64d
mov edx, 2
lea rcx, [0x1801ab190]
call fcn.1800c2600
mov ebx, eax
test eax, eax
je 0x18000acd1
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rsp + 0x60], xmm1
mov word [rsp + 0x50], r15w
mov r8d, edi
lea rdx, [0x1801534b0]
lea rcx, [rsp + 0x50]
call fcn.1800c2b20
mov dword [rsp + 0x28], 0x5bd
lea rax, str.RC::RCApiHookNewFuns::OnLoadHookArrived
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rsp + 0x50]
mov edx, 2
lea rcx, [0x1801ab190]
call fcn.1800c2650
cmp ebx, 1
jbe 0x18000a603
lea rdx, [rsp + 0x50]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000acbd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000acb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ad41
jmp 0x18000acb8
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
xor edx, edx
mov r8d, 0x3e80001
call qword [rax + 0x98]
mov esi, eax
test eax, eax
jns 0x18000a74b
mov edx, 2
lea rcx, [0x1801ab190]
call fcn.1800c2600
mov edi, eax
test eax, eax
je 0x18000acd1
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rsp + 0x60], xmm1
mov word [rsp + 0x50], r15w
mov r8d, esi
lea rdx, [0x1801534e8]
lea rcx, [rsp + 0x50]
call fcn.1800c2b20
mov dword [rsp + 0x28], 0x5c5
lea rax, str.RC::RCApiHookNewFuns::OnLoadHookArrived
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rsp + 0x50]
mov edx, 2
lea rcx, [0x1801ab190]
call fcn.1800c2650
cmp edi, 1
jbe 0x18000a701
lea rdx, [rsp + 0x50]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000acbd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000acb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ad47
jmp 0x18000acb8
xor edx, edx
mov r8d, 0x250
lea rcx, [rbp + 0x1a0]
call fcn.1800fe490
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x600]
call fcn.1800fe490
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
mov dword [rsp + 0x20], 2
lea r9, [rbp + 0x1a0]
mov r8d, 0x104
lea rdx, [rbp + 0x600]
call qword [rax + 0x18]
mov esi, eax
test eax, eax
jns 0x18000a882
mov edx, 2
lea rcx, [0x1801ab190]
call fcn.1800c2600
mov edi, eax
test eax, eax
je 0x18000acd1
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rsp + 0x60], xmm1
mov word [rsp + 0x50], r15w
mov r8d, esi
lea rdx, [0x180153520]
lea rcx, [rsp + 0x50]
call fcn.1800c2b20
mov dword [rsp + 0x28], 0x5ce
lea rax, str.RC::RCApiHookNewFuns::OnLoadHookArrived
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rsp + 0x50]
mov edx, 2
lea rcx, [0x1801ab190]
call fcn.1800c2650
cmp edi, 1
jbe 0x18000a838
lea rdx, [rsp + 0x50]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000acbd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000acb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ad4d
jmp 0x18000acb8
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x3f0]
call fcn.1800fe490
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
mov r8d, 0x104
lea rdx, [rbp + 0x3f0]
call qword [rax + 0x50]
mov esi, eax
test eax, eax
jns 0x18000a996
mov edx, 2
lea rcx, [0x1801ab190]
call fcn.1800c2600
mov edi, eax
test eax, eax
je 0x18000acd1
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rsp + 0x60], xmm1
mov word [rsp + 0x50], r15w
mov r8d, esi
lea rdx, [0x180153558]
lea rcx, [rsp + 0x50]
call fcn.1800c2b20
mov dword [rsp + 0x28], 0x5d6
lea rax, str.RC::RCApiHookNewFuns::OnLoadHookArrived
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rsp + 0x50]
mov edx, 2
lea rcx, [0x1801ab190]
call fcn.1800c2650
cmp edi, 1
jbe 0x18000a94c
lea rdx, [rsp + 0x50]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000acbd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000acb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ad53
jmp 0x18000acb8
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x810]
call fcn.1800fe490
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
lea rax, [rbp + 0x3f0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x600]
mov qword [rsp + 0x20], rax
lea r8, str._ld__s__s
mov edx, 0x3ff
lea rcx, [rbp + 0x810]
call fcn.180003e30
mov qword [rbp - 0x70], r15
movzx eax, r15w
lea rdi, [rbp - 0x68]
mov ecx, 0x104
rep stosw word [rdi], ax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbp - 0x6c], eax
mov r8d, 0x104
mov rdx, rbx
lea rcx, [rbp - 0x68]
call fcn.180100e80
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp - 0x80], xmm1
mov word [rsp + 0x70], r15w
lea rax, [rbp + 0x810]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], r15w
jne 0x18000aa40
lea rdx, [rbp + 0x810]
lea rcx, [rsp + 0x70]
call fcn.18000c0a0
nop
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x70]
call fcn.18000ad70
movzx r14d, al
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x18000aaaf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000aaaa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ad5f
call fcn.1800dedc4
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rbp - 0x80], xmm0
mov word [rsp + 0x70], r15w
jmp 0x18000acd1
cmp qword [0x1801ab190], r15
je 0x18000acd1
lea rcx, [0x1801ab190]
call fcn.1800c19a0
mov rax, qword [0x1801ab190]
cmp byte [rax + 0x78], r15b
je 0x18000acd1
cmp dword [rax + 0x80], 2
jb 0x18000acd1
movzx edi, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rsp + 0x60], xmm1
mov word [rsp + 0x50], r15w
mov r8d, esi
lea rdx, [0x180153478]
lea rcx, [rsp + 0x50]
call fcn.1800c2b20
mov dword [rsp + 0x28], 0x5af
lea rax, str.RC::RCApiHookNewFuns::OnLoadHookArrived
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rsp + 0x50]
mov edx, 2
lea rcx, [0x1801ab190]
call fcn.1800c2650
test dil, dil
je 0x18000ab7e
lea rdx, [rsp + 0x50]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000acbd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000acb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ad59
jmp 0x18000acb8
cmp qword [0x1801ab190], r15
je 0x18000acd1
lea rcx, [0x1801ab190]
call fcn.1800c19a0
mov rax, qword [0x1801ab190]
cmp byte [rax + 0x78], r15b
je 0x18000acd1
cmp dword [rax + 0x80], 2
jb 0x18000acd1
movzx edi, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rsp + 0x60], xmm1
mov word [rsp + 0x50], r15w
mov r8d, esi
lea rdx, [0x180153440]
lea rcx, [rsp + 0x50]
call fcn.1800c2b20
mov dword [rsp + 0x28], 0x5a8
lea rax, str.RC::RCApiHookNewFuns::OnLoadHookArrived
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rsp + 0x50]
mov edx, 2
lea rcx, [0x1801ab190]
call fcn.1800c2650
test dil, dil
je 0x18000ac7f
lea rdx, [rsp + 0x50]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000acbd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000acb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ad35
call fcn.1800dedc4
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r15w
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x18000ace6
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x38], r15
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x18000acfb
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x30], r15
lea rcx, [rsp + 0x40]
call fcn.18008f7c0
movzx eax, r14b
mov rcx, qword [rbp + 0x1010]
xor rcx, rsp
call fcn.1800deda0
lea r11, [rsp + 0x1120]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.180103f88
nop
call fcn.180103f88
int3
call fcn.180103f88
int3
call fcn.180103f88
int3
call fcn.180103f88
int3
call fcn.180103f88
int3
call fcn.180103f88
int3
call fcn.180103f88
int3