Function at 0x180039360
Capabilities:
Check os version
Get windows directory from kuser_shared_data

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x570
mov rax, qword [0x1801724e0]
xor rax, rsp
mov qword [rsp + 0x560], rax
mov dword [rsp + 0x114], r9d
mov r15, r8
mov qword [rsp + 0xc0], r8
mov r13, rdx
mov qword [rsp + 0xd0], rdx
mov r14, rcx
mov r12, qword [rsp + 0x5d0]
mov qword [rsp + 0x70], r12
mov rax, qword [rsp + 0x5d8]
mov qword [rsp + 0xc8], rax
lea rax, [rsp + 0x350]
mov qword [rsp + 0x348], rax
xor r8d, r8d
mov dword [rsp + 0x340], 0x1000000
mov eax, 0x100
mov word [rsp + 0x350], r8w
lea rbx, [rsp + 0x460]
mov qword [rsp + 0x458], rbx
movzx edx, r8w
mov word [rsp + 0x450], dx
movzx esi, ax
mov word [rsp + 0x452], ax
mov word [rsp + 0x460], r8w
mov edi, r8d
movzx eax, word [rcx]
test ax, ax
je 0x1800394b1
cmp byte [sym.ntdll.dll_NlsMbCodePageTag], dil
jne 0x1800b08ce
movzx eax, ax
lea eax, [rax*2 + 2]
movzx ecx, dx
add ecx, eax
mov edi, r8d
movzx eax, si
cmp ecx, eax
ja 0x1800b08f3
test edi, edi
js 0x1800394a9
movzx eax, dx
add rax, rbx
mov qword [rsp + 0x160], rax
mov word [rsp + 0x158], r8w
sub si, dx
mov word [rsp + 0x15a], si
xor r8d, r8d
mov rdx, r14
lea rcx, [rsp + 0x158]
call sym.ntdll.dll_RtlAnsiStringToUnicodeString
movzx eax, word [rsp + 0x158]
add word [rsp + 0x450], ax
mov rbx, qword [rsp + 0x458]
mov r15, qword [rsp + 0xc0]
mov dword [rsp + 0x54], edi
test edi, edi
js 0x1800b0a05
mov qword [rsp + 0x220], 0x48
mov dword [rsp + 0x228], 1
xor edx, edx
lea r8d, [rdx + 0x38]
lea rcx, [rsp + 0x230]
call sym.ntdll.dll_memset
mov rdx, qword [r15 + 0x88]
mov rax, qword gs:[0x30]
mov r8, qword [rax + 0x2c8]
xor r14d, r14d
test r8, r8
je 0x1800b099e
mov rcx, qword [r8]
cmp qword [rsp + 0x220], 0x48
jb 0x180039544
mov rax, rcx
not rax
mov qword [rsp + 0x248], rax
mov rax, rdx
not rax
mov qword [rsp + 0x250], rax
mov rax, qword [rsp + 0x5a8]
mov qword [rsp + 0x258], rax
test rcx, rcx
jne 0x18003b0a4
mov qword [rsp + 0x230], rcx
mov qword [rsp + 0x238], rdx
mov dword [rsp + 0x240], 0x20
test rcx, rcx
jne 0x18003b0b6
test rdx, rdx
jne 0x18003b0c2
mov dword [rsp + 0x240], 0x30
mov esi, dword [r13 + 0x20]
and esi, 0x800000
mov dword [rsp + 0x58], esi
mov edi, r14d
mov dword [rsp + 0x64], r14d
mov byte [rsp + 0x51], 0
test esi, 0x800008
jne 0x18003ac47
lea r15, [rsp + 0x450]
mov qword [rsp + 0x88], r15
mov rax, qword gs:[0x60]
mov qword [rsp + 0x150], rax
mov byte [rsp + 0x51], 0
mov bl, 1
mov byte [rsp + 0x50], bl
mov r13, qword [rsp + 0xc0]
add r13, 0x58
mov rsi, qword [rax + 0x68]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
test rcx, rcx
jne 0x18003a765
mov dword [rsp + 0x118], r14d
mov ecx, 0x7ffe0384
cmp byte [rcx], 0
jne 0x18003a792
xor eax, eax
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xe0], rax
xor r12b, r12b
mov byte [rsp + 0x5c], r12b
movzx edi, word [rsp + 0x450]
cmp di, 8
jb 0x180039fa3
mov r10, qword [rsp + 0x458]
mov rax, qword [r10]
movabs rcx, 0xffffffdfffdfffdf
and rax, rcx
movabs rcx, 0x2d004900500041
cmp rax, rcx
jne 0x18003a74d
movzx ecx, di
lea rax, [r10 + rcx]
mov qword [rsp + 0x178], rax
mov dword [rsp + 0x11c], ecx
mov edx, ecx
cmp edx, 1
jbe 0x180039de9
add ecx, 0xfffffffe
mov edx, ecx
mov dword [rsp + 0x11c], ecx
movzx edi, cx
sub rax, 2
mov qword [rsp + 0x178], rax
cmp word [rax], 0x2d
je 0x180039de9
jmp 0x180039686
mov dword [rdi], r9d
mov esi, dword [rsp + 0x68]
test esi, esi
je 0x18003ade0
lea rcx, [0x18015d070]
call sym.ntdll.dll_RtlAcquireSRWLockExclusive
mov edi, esi
and edi, 0x1f
shl rdi, 4
lea rax, [0x18015bfc0]
add rdi, rax
xor cl, cl
mov byte [rsp + 0x52], cl
mov r14, qword [rdi]
mov r15, qword [rsp + 0x348]
mov r12, qword [0x18015b238]
cmp r14, rdi
je 0x1800397ed
lea rbx, [r14 - 0x70]
cmp esi, dword [rbx + 0x108]
jne 0x1800397b1
test r13b, 8
jne 0x18003adee
movzx ecx, word [rsp + 0x340]
movzx eax, word [rbx + 0x48]
cmp ecx, eax
jne 0x1800397ab
mov rdx, r15
mov qword [rsp + 0x1e0], rdx
mov r9, qword [rbx + 0x50]
mov qword [rsp + 0x1e8], r9
lea r11, [r15 + rcx]
nop word [rax + rax]
cmp rdx, r11
jae 0x1800397c9
movzx r8d, word [rdx]
mov dword [rsp + 0x210], r8d
movzx r10d, word [r9]
mov dword [rsp + 0x150], r10d
cmp r8d, r10d
jne 0x18003978c
add rdx, 2
mov qword [rsp + 0x1e0], rdx
add r9, 2
mov qword [rsp + 0x1e8], r9
jmp 0x180039750
cmp r8d, 0x61
jb 0x1800397a0
cmp r8d, 0x7a
ja 0x18003adfd
add r8d, 0xffffffe0
cmp r10d, 0x61
jae 0x1800397b9
cmp r8d, r10d
je 0x180039772
xor cl, cl
mov byte [rsp + 0x52], cl
mov r14, qword [r14]
jmp 0x1800396fc
cmp r10d, 0x7a
ja 0x18003ae35
add r10d, 0xffffffe0
jmp 0x1800397a6
mov cl, 1
mov byte [rsp + 0x52], cl
mov rax, qword [rbx + 0x98]
cmp dword [rax + 0x18], 0xffffffff
jne 0x180039b08
mov byte [rsp + 0x5f], 1
mov rax, qword [rsp + 0x70]
mov qword [rax], rbx
xor r15d, r15d
test cl, cl
je 0x180039d49
mov edi, r15d
mov eax, 1
lock cmpxchg qword [0x18015d070], r15
jne 0x180039d02
or r12, 0xffffffffffffffff
mov eax, edi
not eax
test eax, eax
jns 0x180039d53
mov dword [rsp + 0xbc], r15d
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
test rcx, rcx
jne 0x18003ae6d
mov dword [rsp + 0x10c], r15d
mov eax, 0x7ffe0384
cmp byte [rax], 0
jne 0x18003ae99
mov dword [rsp + 0x6c], edi
mov esi, dword [rsp + 0x58]
mov rbx, qword [rsp + 0x138]
mov r14, qword [rsp + 0xe8]
mov r15d, 0x1000
cmp edi, 0xc0000135
je 0x180039c9c
mov rax, qword [rsp + 0x70]
mov rbx, qword [rax]
xor r14d, r14d
mov dword [rsp + 0x110], r14d
lea rcx, [0x18015d070]
call sym.ntdll.dll_RtlAcquireSRWLockExclusive
mov rcx, qword [rbx + 0x98]
mov eax, dword [rcx + 0x18]
cmp eax, 0xffffffff
jne 0x180039aeb
mov eax, 1
lock cmpxchg qword [0x18015d070], r14
jne 0x180039d90
mov esi, dword [rsp + 0x58]
mov r15, qword [rsp + 0x70]
mov dword [rsp + 0x54], edi
mov rbx, qword [r15]
test rbx, rbx
je 0x18003b00b
and esi, 0x400
jne 0x18003af53
lea rcx, [0x18015d070]
call sym.ntdll.dll_RtlAcquireSRWLockExclusive
mov rax, qword [r15]
mov r14, rax
mov qword [rsp + 0x1f0], rax
test rax, rax
je 0x18003991a
mov rcx, qword [rax + 0xb0]
test rcx, rcx
jne 0x180039b26
mov qword [rsp + 0x200], r14
mov r8, qword [rsp + 0xc8]
mov rax, qword [r8]
and dword [rax + 0x18], 0xfffffffe
mov rcx, qword [r8]
mov qword [rsp + 0x148], rcx
mov r13, qword [rsp + 0xd0]
mov rax, qword [r13 + 0x38]
mov rbx, qword [r14 + 0x98]
mov r15, qword [rax + 0x98]
cmp r15, rbx
je 0x180039974
cmp dword [rbx + 0x38], 9
jne 0x180039b59
cmp dword [rbx + 0x18], 0xffffffff
jne 0x180039bec
mov byte [rsp + 0x60], 1
mov byte [rsp + 0x53], 1
mov edx, dword [rbx + 0x18]
lea eax, [rdx - 2]
xor r15d, r15d
cmp eax, 0xfffffffc
jbe 0x180039afd
mov qword [rsp + 0x1f8], rcx
mov qword [r8], rcx
cmp edi, 0xc0000135
je 0x180039d63
cmp edi, 0xc000022d
je 0x18003affa
test edi, edi
js 0x1800399cf
mov ecx, dword [r13 + 0x64]
test ecx, ecx
je 0x180039c14
cmp qword [r8], 0
je 0x180039bfe
lea eax, [rcx - 1]
mov dword [r13 + 0x64], eax
mov rax, qword [r14 + 0x98]
cmp dword [rax + 0x18], 0xffffffff
jne 0x180039a1b
mov byte [rsp + 0x61], 1
mov eax, 1
xor r14d, r14d
lock cmpxchg qword [0x18015d070], r14
jne 0x180039c50
mov r12, qword [rsp + 0x70]
mov rcx, qword [r12]
mov rbx, qword [rsp + 0x200]
cmp rbx, rcx
jne 0x180039dd4
mov edi, dword [rsp + 0x54]
jmp 0x18003b018
mov rax, qword [rax]
test byte [rax - 0x38], 0x20
jne 0x1800399dc
mov byte [rsp + 0x61], 0
mov eax, r12d
lock xadd dword [r14 + 0x114], eax
cmp eax, 1
jne 0x1800399e1
lea rcx, [0x18015d070]
call sym.ntdll.dll_RtlAcquireSRWLockExclusive
lea rax, [r14 + 0xa0]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
cmp qword [rdx + 8], rax
jne 0x18003b004
cmp qword [rcx], rax
jne 0x18003b004
mov qword [rcx], rdx
mov qword [rdx + 8], rcx
mov rbx, qword [r14 + 0x98]
mov rdi, qword [rbx]
lea rcx, [0x18015d070]
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
cmp word [r14 + 0x6e], 0
je 0x180039a96
xor edx, edx
mov rcx, r14
call fcn.18007d784
mov rcx, r14
call fcn.180074114
mov rcx, qword [r14 + 0x88]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x180039ab4
call sym.ntdll.dll_RtlReleaseActivationContext
cmp qword [r14 + 0x50], 0
je 0x180039ac4
lea rcx, [r14 + 0x48]
call fcn.180042420
mov r8, r14
xor edx, edx
mov rcx, qword [0x18015c288]
call sym.ntdll.dll_RtlFreeHeap
cmp rdi, rbx
jne 0x1800399e1
mov rcx, rbx
call fcn.180071914
jmp 0x1800399e1
test eax, eax
je 0x18003af0f
inc eax
mov dword [rcx + 0x18], eax
jmp 0x1800398b2
lea eax, [rdx - 1]
mov dword [rbx + 0x18], eax
jmp 0x18003998b
mov rax, qword [rax]
test byte [rax - 0x38], 0x20
jne 0x1800397e0
mov byte [rsp + 0x5f], 0
lock inc dword [rbx + 0x114]
jmp 0x1800397e5
test dword [rcx + 0x20], 0x80000
jne 0x18003991a
mov rdx, qword [rcx + 0x38]
cmp rdx, rax
je 0x18003991a
mov r14, rdx
mov qword [rsp + 0x1f0], rdx
mov qword [rcx + 0x38], rax
jmp 0x18003991a
mov byte [rsp + 0x60], 0
mov rdx, qword [r15 + 0x28]
test rdx, rdx
je 0x180039b77
mov rax, rdx
mov rax, qword [rax]
cmp qword [rax + 8], rbx
je 0x180039974
cmp rax, rdx
jne 0x180039b65
mov byte [rsp + 0x53], 0
test rcx, rcx
je 0x18003af8e
mov rdx, qword [r15 + 0x28]
test rdx, rdx
je 0x180039cfa
mov rax, qword [rdx]
mov qword [rcx], rax
mov qword [rdx], rcx
mov qword [r15 + 0x28], rcx
mov qword [rcx + 8], rbx
lea rdx, [rcx + 0x10]
mov r8, qword [rbx + 0x30]
test r8, r8
je 0x180039c94
mov rax, qword [r8]
mov qword [rdx], rax
mov qword [r8], rdx
mov qword [rbx + 0x30], rdx
mov eax, dword [rcx + 0x18]
and eax, 1
mov qword [rcx + 0x18], r15
jne 0x18003afea
xor r15d, r15d
mov ecx, r15d
mov qword [rsp + 0x148], rcx
mov r8, qword [rsp + 0xc8]
jmp 0x18003998b
mov rax, qword [rbx]
test byte [rax - 0x38], 0x20
jne 0x18003996f
jmp 0x180039b54
mov rax, qword [r14 + 0x98]
cmp dword [rax + 0x38], 2
jge 0x1800399c8
jmp 0x1800399cf
mov rax, qword [r14 + 0x98]
cmp dword [rax + 0x38], 2
jge 0x1800399cf
mov qword [r13 + 0x50], r14
mov dword [r13 + 0x64], 1
mov rax, qword [r13 + 0x38]
mov rcx, qword [rax + 0x98]
mov dword [rcx + 0x38], 3
mov dword [rsp + 0x54], 0x103
jmp 0x1800399cf
mov r8, rax
and r8d, 6
mov edx, 3
cmp r8, 2
cmovne rdx, r12
add rdx, rax
lock cmpxchg qword [0x18015d070], rdx
jne 0x180039dcf
cmp r8, 2
jne 0x1800399f8
xor r8d, r8d
lea rcx, [0x18015d070]
call fcn.180070aac
jmp 0x1800399f8
mov qword [rdx], rdx
jmp 0x180039bbd
mov qword [rsp + 0x30], rbx
mov r15, qword [rsp + 0x70]
mov qword [rsp + 0x28], r15
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x114]
mov r8d, r13d
mov rdx, r14
lea rcx, [rsp + 0x340]
call fcn.180040e38
mov edi, eax
mov dword [rsp + 0x6c], eax
test eax, eax
js 0x180039cf2
mov rcx, qword [r15]
mov rcx, qword [rcx + 0xb0]
call fcn.180040514
mov edi, eax
mov dword [rsp + 0x6c], eax
xor r14d, r14d
jmp 0x1800398cf
mov qword [rcx], rcx
jmp 0x180039b9b
or r12, 0xffffffffffffffff
mov rcx, rax
and ecx, 6
mov edx, 3
cmp rcx, 2
cmovne rdx, r12
add rdx, rax
lock cmpxchg qword [0x18015d070], rdx
jne 0x180039de2
cmp rcx, 2
jne 0x180039813
xor r8d, r8d
lea rcx, [0x18015d070]
call fcn.180070aac
jmp 0x180039813
mov edi, 0xc0000135
jmp 0x1800397fb
mov dword [rsp + 0xbc], 3
jmp 0x180039827
mov edi, 0xc0000135
test esi, esi
jne 0x1800399ae
mov rcx, qword [r14 + 0xb0]
call fcn.1800709b0
mov dword [rsp + 0x54], r15d
mov r8, qword [rsp + 0xc8]
jmp 0x1800399b2
mov rcx, rax
and ecx, 6
mov edx, 3
cmp rcx, 2
cmovne rdx, r12
add rdx, rax
lock cmpxchg qword [0x18015d070], rdx
jne 0x180039de7
cmp rcx, 2
jne 0x1800398c6
xor r8d, r8d
lea rcx, [0x18015d070]
call fcn.180070aac
jmp 0x1800398c6
jmp 0x180039c50
call fcn.18006b460
mov qword [r12], rbx
jmp 0x180039a12
jmp 0x180039d06
jmp 0x180039d90
shr di, 1
je 0x180039fa3
mov r11d, r14d
mov eax, r14d
mov r8, r10
mov qword [rsp + 0x180], r10
mov dword [rsp + 0x120], eax
movzx ecx, di
cmp eax, ecx
jae 0x180039e47
movzx r9d, word [r8]
mov word [rsp + 0x7c], r9w
lea ecx, [r9 - 0x41]
cmp cx, 0x19
jbe 0x18003a801
mov edx, dword [rsi + 0x18]
imul edx, r11d
movzx r11d, r9w
add r11d, edx
inc eax
add r8, 2
mov qword [rsp + 0x180], r8
jmp 0x180039e03
mov r15, r14
mov ebx, r14d
mov dword [rsp + 0x128], ebx
mov r9d, dword [rsi + 0xc]
dec r9d
mov dword [rsp + 0x124], r9d
cmp ebx, r9d
jg 0x180039eb2
lea r8d, [r9 + rbx]
sar r8d, 1
movsxd rdx, r8d
mov ecx, dword [rsi + 0x14]
add rcx, rsi
lea rcx, [rcx + rdx*8]
mov eax, dword [rcx]
cmp r11d, eax
jb 0x180039e92
jbe 0x180039ea0
lea ebx, [r8 + 1]
mov dword [rsp + 0x128], ebx
jmp 0x180039e63
lea r9d, [r8 - 1]
mov dword [rsp + 0x124], r9d
jmp 0x180039e90
mov eax, dword [rcx + 4]
lea rdx, [rax + rax*2]
mov eax, dword [rsi + 0x10]
lea rcx, [rsi + rax]
lea r15, [rcx + rdx*8]
test r15, r15
je 0x18003a8c4
mov edx, dword [r15 + 4]
add rdx, rsi
mov eax, dword [r15 + 0xc]
shr eax, 1
mov qword [rsp + 0x188], r10
mov qword [rsp + 0x190], rdx
movzx ebx, di
mov edi, eax
cmp rbx, rdi
ja 0x18003a811
mov eax, ebx
lea r11, [r10 + rax*2]
mov r14, qword [0x18015b238]
cmp r10, r11
jae 0x180039f33
movzx r8d, word [r10]
mov dword [rsp + 0x140], r8d
movzx r9d, word [rdx]
mov dword [rsp + 0xe8], r9d
cmp r8d, r9d
jne 0x18003a819
add r10, 2
mov qword [rsp + 0x188], r10
add rdx, 2
mov qword [rsp + 0x190], rdx
jmp 0x180039ef3
mov r8d, ebx
sub r8d, edi
test r8d, r8d
jne 0x18003a8c4
test r15, r15
je 0x18003a8c4
test r13, r13
je 0x180039f5b
cmp dword [r15 + 0x14], 1
ja 0x18003a598
cmp dword [r15 + 0x14], 0
jbe 0x18003a8c4
mov ecx, dword [r15 + 0x10]
add rcx, rsi
mov eax, dword [rcx + 0xc]
add rax, rsi
mov qword [rsp + 0xe0], rax
movzx eax, word [rcx + 0x10]
mov word [rsp + 0xda], ax
mov word [rsp + 0xd8], ax
mov r12b, 1
mov byte [rsp + 0x5c], r12b
movzx ebx, r12b
mov r15, qword [rsp + 0x88]
mov byte [rsp + 0x78], r12b
test r12b, r12b
je 0x18003a61d
cmp word [rsp + 0xd8], 0
je 0x18003a8ce
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
test rcx, rcx
jne 0x18003a8d9
xor r14d, r14d
mov dword [rsp + 0xf0], r14d
mov ecx, 0x7ffe0384
cmp byte [rcx], 0
jne 0x18003a90d
mov edi, r14d
mov dword [rsp + 0x80], r14d
test r12b, r12b
je 0x18003a635
cmp word [rsp + 0xd8], 0
je 0x18003a976
mov word [rsp + 0x340], r14w
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
test rcx, rcx
jne 0x18003a98d
mov dword [rsp + 0xf4], r14d
mov edi, 0x7ffe0030
mov rax, rdi
mov qword [rsp + 0x198], rdi
mov word [rsp + 0x16a], r14w
movzx ebx, r14w
mov word [rsp + 0x168], bx
mov qword [rsp + 0x170], rdi
test rax, rax
je 0x18003a0ae
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x18003a075
add rbx, rbx
mov qword [rsp + 0x138], rbx
mov rax, rbx
cmp rbx, 0xfffe
jae 0x18003a9b7
mov word [rsp + 0x168], bx
add ax, 2
mov word [rsp + 0x16a], ax
mov dword [rsp + 0xf8], r14d
test bx, bx
je 0x18003a141
movzx r14d, bx
lea ecx, [r14 + 2]
mov dword [rsp + 0x90], ecx
xor r15d, r15d
mov esi, r15d
mov dword [rsp + 0x98], r15d
movzx eax, word [rsp + 0x342]
cmp ecx, eax
ja 0x18003a9cb
mov dword [rsp + 0xf8], esi
test esi, esi
js 0x18003aa9c
movzx ecx, word [rsp + 0x340]
add rcx, qword [rsp + 0x348]
movzx r8d, bx
mov rdx, rdi
call sym.ntdll.dll_RtlCopyMemory
movzx eax, word [rsp + 0x340]
add ax, r14w
mov word [rsp + 0x340], ax
movzx ecx, ax
shr rcx, 1
mov rax, qword [rsp + 0x348]
xor r14d, r14d
mov word [rax + rcx*2], r14w
mov dword [rsp + 0xfc], r14d
movzx ecx, word [rsp + 0x340]
add ecx, 0x16
mov dword [rsp + 0xa0], ecx
mov ebx, r14d
mov dword [rsp + 0xa8], ebx
movzx eax, word [rsp + 0x342]
cmp ecx, eax
ja 0x18003aaa4
mov dword [rsp + 0xfc], ebx
test ebx, ebx
js 0x18003a1ca
movzx ecx, word [rsp + 0x340]
add rcx, qword [rsp + 0x348]
mov rax, qword [str.SYSTEM32_]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
mov eax, dword [rax + 0x10]
mov dword [rcx + 0x10], eax
movzx eax, word [rsp + 0x340]
add ax, 0x14
mov word [rsp + 0x340], ax
movzx ecx, ax
shr rcx, 1
mov rax, qword [rsp + 0x348]
mov word [rax + rcx*2], r14w
mov dword [rsp + 0x100], r14d
movzx ebx, word [rsp + 0xd8]
mov esi, ebx
movzx ecx, word [rsp + 0x340]
add ecx, 2
add ecx, ebx
mov dword [rsp + 0xb0], ecx
mov edi, r14d
mov dword [rsp + 0xb8], r14d
movzx eax, word [rsp + 0x342]
cmp ecx, eax
ja 0x18003ab6c
mov dword [rsp + 0x100], edi
test edi, edi
js 0x18003a25d
movzx ecx, word [rsp + 0x340]
add rcx, qword [rsp + 0x348]
movzx r8d, bx
mov rdx, qword [rsp + 0xe0]
call sym.ntdll.dll_RtlCopyMemory
movzx eax, word [rsp + 0x340]
add ax, si
mov word [rsp + 0x340], ax
movzx ecx, ax
shr rcx, 1
mov rax, qword [rsp + 0x348]
mov word [rax + rcx*2], r14w
mov dword [rsp + 0x80], edi
mov r15d, 0x1000
test edi, edi
js 0x18003ac3d
mov rax, qword [rsp + 0x150]
mov rax, qword [rax + 0x20]
test rax, rax
je 0x18003a28d
test dword [rax + 8], r15d
jne 0x18003a6ef
xor bl, bl
mov byte [rsp + 0x50], bl
lea rdx, [rsp + 0x340]
mov qword [rsp + 0x88], rdx
test edi, edi
js 0x18003a2af
test bl, bl
jne 0x18003a5b8
mov dword [rsp + 0x64], edi
mov esi, dword [rsp + 0x58]
mov r12, qword [rsp + 0x70]
mov r13, qword [rsp + 0xd0]
test edi, edi
js 0x18003ad18
lea rbx, [rsp + 0x450]
mov qword [rsp + 0x1b8], rbx
cmp word [rsp + 0x340], 0
je 0x18003a648
test byte [0x180156a70], 5
jne 0x18003ac52
bts esi, 9
mov dword [rsp + 0x58], esi
cmp byte [rsp + 0x51], 0
jne 0x18003a741
lea rbx, [rsp + 0x340]
mov qword [rsp + 0x1b8], rbx
test edi, edi
js 0x18003ad18
mov rdx, qword [rbx + 8]
movzx eax, word [rbx]
add rax, rdx
mov qword [rsp + 0x1c8], rax
mov byte [rsp + 0x5e], 0
nop word [rax + rax]
sub rax, 2
mov qword [rsp + 0x1c8], rax
cmp rax, rdx
jb 0x18003a6f6
movzx ecx, word [rax]
cmp cx, 0x2e
je 0x18003a374
cmp cx, 0x2f
je 0x18003a6f6
cmp cx, 0x5c
je 0x18003a6f6
jmp 0x18003a340
mov byte [rsp + 0x5e], 1
lea rdx, [rsp + 0x340]
movzx ecx, word [rsp + 0x340]
add rcx, qword [rsp + 0x348]
mov qword [rsp + 0x1d0], rcx
sub rcx, 2
mov qword [rsp + 0x1d0], rcx
cmp rcx, qword [rsp + 0x348]
jb 0x18003a3b9
cmp word [rcx], 0x2e
je 0x18003ad04
mov word [rcx + 2], r14w
test edi, edi
js 0x18003ad18
mov dword [rsp + 0x54], edi
test edi, edi
js 0x18003b018
bt esi, 0x17
jb 0x18003ad6c
mov rbx, qword [rsp + 0xc8]
mov rax, qword [rbx]
test rax, rax
je 0x18003a559
mov rbx, qword [r13 + 0x28]
mov qword [rsp + 0x138], rbx
mov r13d, esi
mov r14, qword [rsp + 0xd0]
mov r14, qword [r14 + 0x10]
mov qword [rsp + 0xe8], r14
xor r10d, r10d
mov qword [r12], r10
test sil, 0x20
jne 0x18003a69a
bt esi, 9
jae 0x18003af42
movzx edx, word [rsp + 0x340]
add rdx, qword [rsp + 0x348]
mov qword [rsp + 0x130], rdx
lea r8, [rdx - 2]
movzx edx, r8w
mov rcx, r8
mov rax, r8
mov qword [rsp + 0x130], r8
cmp rax, qword [rsp + 0x348]
jbe 0x18003a48c
movzx eax, word [r8]
cmp ax, 0x5c
je 0x18003a47c
cmp ax, 0x2f
je 0x18003a47c
lea r8, [rcx - 2]
jmp 0x18003a44a
lea r8, [rcx + 2]
mov qword [rsp + 0x130], r8
movzx edx, r8w
sub dx, word [rsp + 0x348]
mov qword [rsp + 0x288], r8
movzx ecx, dx
movzx eax, word [rsp + 0x340]
sub ax, cx
movzx r11d, ax
mov word [rsp + 0x280], r11w
movzx eax, word [rsp + 0x342]
sub ax, cx
mov word [rsp + 0x282], ax
mov dword [rsp + 0x68], r10d
lea rdi, [rsp + 0x68]
mov r9d, r10d
mov dword [rsp + 0x108], r10d
mov qword [rsp + 0x1d8], r8
mov dword [rsp + 0x68], r10d
shr r11d, 1
mov dword [rsp + 0x104], r11d
mov rbx, qword [0x18015b238]
nop
mov eax, r11d
dec r11d
mov dword [rsp + 0x104], r11d
test eax, eax
je 0x1800396b6
movzx r10d, word [r8]
add r8, 2
mov qword [rsp + 0x1d8], r8
cmp r10w, 0x61
jb 0x18003a553
cmp r10w, 0x7a
ja 0x18003adad
movzx eax, r10w
sub eax, 0x20
imul r9d, r9d, 0x1003f
add r9d, eax
mov dword [rsp + 0x108], r9d
jmp 0x18003a500
movzx eax, r10w
jmp 0x18003a53f
mov edx, dword [0x18015c294]
add edx, 0x280000
mov dword [rsp + 0x20c], edx
mov r8d, 0x20
mov rcx, qword [0x18015c288]
call sym.ntdll.dll_RtlAllocateHeap
mov qword [rbx], rax
test rax, rax
jne 0x18003a3f0
mov edi, 0xc0000017
mov dword [rsp + 0x54], edi
jmp 0x18003b018
movzx r8d, word [r13]
shr r8w, 1
mov r9, rsi
mov rdx, qword [r13 + 8]
mov rcx, r15
call fcn.18003b6fc
mov rcx, rax
jmp 0x180039f6d
cmp byte [0x18015c298], 0
jne 0x18003a2af
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x270]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [0x180110320]
lea ecx, [r9 + 1]
call sym.ntdll.dll_RtlDosApplyFileIsolationRedirection_Ustr
mov ebx, eax
test eax, eax
jns 0x18003a715
cmp ebx, 0xc0150008
je 0x18003a2af
mov edi, ebx
mov dword [rsp + 0x80], ebx
jmp 0x18003a2af
mov r8d, 0x14d3
mov rdx, r15
xor ecx, ecx
call fcn.18003bc9c
xor r14d, r14d
jmp 0x180039ff2
mov r15d, 0x1000
mov rdx, qword [rsp + 0x88]
jmp 0x18003a2a3
movzx eax, word [rsp + 0x450]
mov rdx, qword [rsp + 0x458]
add rax, rdx
mov qword [rsp + 0x1c0], rax
nop dword [rax]
nop word [rax + rax]
sub rax, 2
mov qword [rsp + 0x1c0], rax
cmp rax, rdx
jb 0x18003a6c3
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x18003acb7
cmp cx, 0x2f
je 0x18003acb7
jmp 0x18003a670
mov qword [rsp + 0x20], r10
mov r9, r12
mov r8d, esi
xor edx, edx
lea rcx, [rsp + 0x340]
call fcn.1800385d0
mov edi, eax
mov dword [rsp + 0x6c], eax
or r12, 0xffffffffffffffff
jmp 0x180039874
mov byte [rsp + 0x5d], 1
or esi, 0x20
mov dword [rsp + 0x58], esi
lea rdx, [rsp + 0x450]
lea rcx, [rsp + 0x340]
call fcn.18003be6c
mov dword [rsp + 0x64], eax
mov edi, eax
jmp 0x18003a31b
mov bl, 1
jmp 0x18003a28f
lea rdx, [0x180110320]
lea rcx, [rsp + 0x340]
call fcn.18003be6c
mov edi, eax
mov dword [rsp + 0x64], eax
jmp 0x18003a3be
mov byte [rsp + 0x51], 1
lea rdx, [rsp + 0x340]
lea rcx, [rsp + 0x270]
call fcn.18003fb24
lea rcx, [rsp + 0x270]
call fcn.180042420
jmp 0x18003a603
or esi, 4
mov dword [rsp + 0x58], esi
jmp 0x18003a30b
movabs rcx, 0x2d005400580045
cmp rax, rcx
jne 0x180039fa3
jmp 0x18003966e
mov eax, dword [rcx]
mov dword [rsp + 0x118], eax
test eax, eax
je 0x180039609
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x22a
jmp 0x18003960e
mov rax, qword gs:[0x60]
test byte [rax + 0x378], 4
je 0x180039617
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
je 0x18003a7ca
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x22b
jmp 0x18003a7cf
mov ecx, 0x7ffe0385
test byte [rcx], 0x20
je 0x180039617
mov ecx, 0x14d0
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x450]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call fcn.1800cb8f0
jmp 0x180039617
add r9w, 0x20
mov word [rsp + 0x7c], r9w
jmp 0x180039e29
mov rax, rdi
jmp 0x180039ee8
cmp r8d, 0x61
jb 0x18003a85e
cmp r8d, 0x7a
ja 0x18003a82b
add r8d, 0xffffffe0
jmp 0x18003a85e
mov rax, r8
shr rax, 8
movzx ecx, word [r14 + rax*2]
mov eax, r8d
shr eax, 4
and eax, 0xf
add ecx, eax
movzx ecx, word [r14 + rcx*2]
mov eax, r8d
and eax, 0xf
add ecx, eax
mov eax, ecx
movzx ecx, word [r14 + rcx*2]
add cx, r8w
movzx r8d, cx
mov dword [rsp + 0x140], r8d
cmp r9d, 0x61
jb 0x18003a8ab
cmp r9d, 0x7a
ja 0x18003a878
add r9d, 0xffffffe0
jmp 0x18003a8ab
mov rax, r9
shr rax, 8
movzx ecx, word [r14 + rax*2]
mov eax, r9d
shr eax, 4
and eax, 0xf
add ecx, eax
movzx ecx, word [r14 + rcx*2]
mov eax, r9d
and eax, 0xf
add ecx, eax
mov eax, ecx
movzx ecx, word [r14 + rcx*2]
add cx, r9w
movzx r9d, cx
mov dword [rsp + 0xe8], r9d
cmp r8d, r9d
je 0x180039f19
sub r8d, r9d
jmp 0x180039f39
movzx ebx, byte [rsp + 0x50]
jmp 0x180039f9b
mov r8d, 0x14d2
jmp 0x18003a623
mov eax, dword [rcx]
mov dword [rsp + 0xf0], eax
test eax, eax
je 0x18003a905
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x22a
xor r14d, r14d
jmp 0x180039fe9
xor r14d, r14d
jmp 0x180039fe4
mov rax, qword gs:[0x60]
test byte [rax + 0x378], 4
je 0x180039ff2
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
je 0x18003a945
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x22b
jmp 0x18003a94a
mov ecx, 0x7ffe0385
movzx eax, byte [rcx]
test al, 0x20
je 0x180039ff2
mov ecx, 0x14d1
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call fcn.1800cb8f0
jmp 0x180039ff2
mov edi, 0xc0000481
mov dword [rsp + 0x80], edi
mov r15d, 0x1000
jmp 0x18003a2af
mov eax, dword [rcx]
mov dword [rsp + 0xf4], eax
test eax, eax
je 0x18003a03f
mov rax, qword gs:[0x60]
mov rdi, qword [rax + 0x90]
add rdi, 0x1e
jmp 0x18003a044
mov ebx, 0xfffc
mov qword [rsp + 0x138], rbx
mov eax, ebx
jmp 0x18003a09a
cmp ecx, 0xfffe
jbe 0x18003a9e4
mov esi, 0xc0000106
mov dword [rsp + 0x98], esi
jmp 0x18003a0ec
lea r15d, [rcx + 0x3f]
and r15d, 0xffffffc0
mov dword [rsp + 0x90], r15d
mov eax, r15d
cmp r15d, 0xfffe
jbe 0x18003aa11
mov r15d, 0xfffe
mov dword [rsp + 0x90], r15d
mov eax, r15d
mov ecx, eax
lea rax, [rsp + 0x350]
mov rdx, qword [rsp + 0x348]
cmp rdx, rax
je 0x18003aa3a
call fcn.1800d0568
mov r12, rax
mov qword [rsp + 0x1a0], rax
jmp 0x18003aa70
call fcn.18003b5e0
mov r12, rax
mov qword [rsp + 0x1a0], rax
test rax, rax
je 0x18003aa70
movzx eax, word [rsp + 0x340]
test ax, ax
je 0x18003aa70
movzx r8d, ax
mov rdx, qword [rsp + 0x348]
mov rcx, r12
call sym.ntdll.dll_RtlCopyMemory
test r12, r12
jne 0x18003aa86
mov esi, 0xc0000017
mov dword [rsp + 0x98], esi
jmp 0x18003a0ec
mov qword [rsp + 0x348], r12
mov word [rsp + 0x342], r15w
jmp 0x18003a0ec
xor r14d, r14d
jmp 0x18003a141
cmp ecx, 0xfffe
jbe 0x18003aabd
mov ebx, 0xc0000106
mov dword [rsp + 0xa8], ebx
jmp 0x18003a175
lea edi, [rcx + 0x3f]
and edi, 0xffffffc0
mov dword [rsp + 0xa0], edi
mov eax, edi
cmp edi, 0xfffe
jbe 0x18003aae2
mov edi, 0xfffe
mov dword [rsp + 0xa0], edi
mov eax, edi
mov ecx, eax
lea rax, [rsp + 0x350]
mov rdx, qword [rsp + 0x348]
cmp rdx, rax
je 0x18003ab0b
call fcn.1800d0568
mov rsi, rax
mov qword [rsp + 0x1a8], rax
jmp 0x18003ab41
call fcn.18003b5e0
mov rsi, rax
mov qword [rsp + 0x1a8], rax
test rax, rax
je 0x18003ab41
movzx eax, word [rsp + 0x340]
test ax, ax
je 0x18003ab41
movzx r8d, ax
mov rdx, qword [rsp + 0x348]
mov rcx, rsi
call sym.ntdll.dll_RtlCopyMemory
test rsi, rsi
jne 0x18003ab57
mov ebx, 0xc0000017
mov dword [rsp + 0xa8], ebx
jmp 0x18003a175
mov qword [rsp + 0x348], rsi
mov word [rsp + 0x342], di
jmp 0x18003a175
cmp ecx, 0xfffe
jbe 0x18003ab85
mov edi, 0xc0000106
mov dword [rsp + 0xb8], edi
jmp 0x18003a20b
lea r15d, [rcx + 0x3f]
and r15d, 0xffffffc0
mov dword [rsp + 0xb0], r15d
mov eax, r15d
cmp r15d, 0xfffe
jbe 0x18003abb2
mov r15d, 0xfffe
mov dword [rsp + 0xb0], r15d
mov eax, r15d
mov ecx, eax
lea rax, [rsp + 0x350]
mov rdx, qword [rsp + 0x348]
cmp rdx, rax
je 0x18003abdb
call fcn.1800d0568
mov r14, rax
mov qword [rsp + 0x1b0], rax
jmp 0x18003ac11
call fcn.18003b5e0
mov r14, rax
mov qword [rsp + 0x1b0], rax
test rax, rax
je 0x18003ac11
movzx eax, word [rsp + 0x340]
test ax, ax
je 0x18003ac11
movzx r8d, ax
mov rdx, qword [rsp + 0x348]
mov rcx, r14
call sym.ntdll.dll_RtlCopyMemory
test r14, r14
jne 0x18003ac24
mov edi, 0xc0000017
mov dword [rsp + 0xb8], edi
jmp 0x18003ac35
mov qword [rsp + 0x348], r14
mov word [rsp + 0x342], r15w
xor r14d, r14d
jmp 0x18003a20b
movzx ebx, byte [rsp + 0x50]
jmp 0x18003a63b
mov r15d, 0x1000
jmp 0x18003a2c4
lea rax, [0x180118d88]
lea rcx, str.API_set
cmp byte [rsp + 0x51], 0
cmove rax, rcx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x340]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x450]
mov qword [rsp + 0x28], rax
lea rax, str.DLL__wZ_was_redirected_to__wZ_by__s_n
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, str.LdrpPreprocessDllName
mov edx, 0xa1e
lea rcx, str.minkernel_ntdllldrutil.c
call fcn.1800ca394
jmp 0x18003a2f8
mov byte [rsp + 0x5d], 0
lea rcx, [rsp + 0x450]
call fcn.18003e414
cmp eax, 5
je 0x18003a6cf
lea rdx, [rsp + 0x340]
lea rcx, [rsp + 0x450]
call fcn.18003fb24
mov edi, eax
mov dword [rsp + 0x64], eax
test eax, eax
js 0x18003a31b
or esi, 0x600
mov dword [rsp + 0x58], esi
jmp 0x18003a31b
movzx eax, word [rsp + 0x340]
sub ax, 2
mov word [rdx], ax
jmp 0x18003a399
test byte [0x180156a70], 3
je 0x18003ad59
mov dword [rsp + 0x30], edi
lea rax, [rsp + 0x450]
mov qword [rsp + 0x28], rax
lea rax, str.LdrpPreprocessDllName_for_DLL__wZ_failed_with_status_0x_08lx_n
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, str.LdrpPreprocessDllName
mov edx, 0xa58
lea rcx, str.minkernel_ntdllldrutil.c
call fcn.1800ca394
test byte [0x180156a70], 0x10
je 0x18003a3c6
int3
mov rax, qword [r13 + 0x28]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, esi
mov r8, qword [r13 + 0x10]
lea rdx, [rsp + 0x340]
mov rcx, qword [r13 + 0xa8]
call fcn.1800c9ff0
mov edi, eax
mov dword [rsp + 0x54], eax
jmp 0x18003b018
movzx edx, r10w
movzx eax, r10w
shr rax, 8
movzx ecx, word [rbx + rax*2]
mov eax, edx
shr eax, 4
and eax, 0xf
add ecx, eax
movzx ecx, word [rbx + rcx*2]
and edx, 0xf
add ecx, edx
movzx ecx, word [rbx + rcx*2]
add cx, r10w
movzx eax, cx
jmp 0x18003a53f
mov esi, 0x80000000
mov dword [rsp + 0x68], esi
jmp 0x1800396c5
test byte [rbx + 0x68], 1
je 0x1800397b1
jmp 0x18003971f
mov rax, r8
shr rax, 8
movzx ecx, word [r12 + rax*2]
mov eax, r8d
shr eax, 4
and eax, 0xf
add ecx, eax
movzx ecx, word [r12 + rcx*2]
mov eax, r8d
and eax, 0xf
add ecx, eax
mov eax, ecx
movzx ecx, word [r12 + rcx*2]
add cx, r8w
movzx r8d, cx
jmp 0x1800397a0
mov rax, r10
shr rax, 8
movzx ecx, word [r12 + rax*2]
mov eax, r10d
shr eax, 4
and eax, 0xf
add ecx, eax
movzx ecx, word [r12 + rcx*2]
mov eax, r10d
and eax, 0xf
add ecx, eax
mov eax, ecx
movzx ecx, word [r12 + rcx*2]
add cx, r10w
movzx r10d, cx
jmp 0x1800397a6
mov eax, dword [rcx]
mov dword [rsp + 0x10c], eax
test eax, eax
je 0x180039848
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x90]
add rax, 0x22a
jmp 0x18003984d
mov rax, qword gs:[0x60]
test byte [rax + 0x378], 4
je 0x180039856
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
je 0x18003aed0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x90]
add rax, 0x22b
jmp 0x18003aed5
mov eax, 0x7ffe0385
movzx eax, byte [rax]
test al, 0x20
je 0x180039856
mov ecx, 0x14a0
mov qword [rsp + 0x28], r15
lea rax, [rsp + 0x340]
mov qword [rsp + 0x20], rax
movzx r9d, byte [rsp + 0xbc]
xor r8d, r8d
xor edx, edx
call fcn.1800cb8f0
jmp 0x180039856
mov rax, qword gs:[0x30]
mov qword [rsp + 0x298], rax
test word [rax + 0x17ee], r15w
je 0x18003af32
inc dword [rcx + 0x1c]
jmp 0x1800398b2
mov dword [rsp + 0x110], 0xc0000135
jmp 0x1800398b2
mov dword [rsp + 0x6c], 0xc0000135
or r12, 0xffffffffffffffff
jmp 0x180039c9c
cmp edi, 0xc0000135
jne 0x1800398eb
mov rbx, qword [rbx + 0xb0]
mov qword [rsp + 0x290], rbx
or dword [rbx + 0x20], 0x4000000
mov dl, 1
mov rcx, rbx
call fcn.1800426e8
mov rax, qword [rbx + 0x28]
mov edi, dword [rax]
mov dword [rsp + 0x54], edi
jmp 0x1800398eb
mov edx, dword [0x18015c294]
add edx, 0x240000
mov dword [rsp + 0x208], edx
mov r8d, 0x20
mov rcx, qword [0x18015c288]
call sym.ntdll.dll_RtlAllocateHeap
mov rcx, rax
mov qword [rsp + 0x148], rax
test rax, rax
jne 0x18003afe1
mov dword [0], 0xc0000017
xor r15d, r15d
mov ecx, r15d
mov r8, qword [rsp + 0xc8]
jmp 0x18003998b
or dword [rax + 0x18], 1
jmp 0x180039b85
and r15d, 0xfffffffe
or r15d, eax
mov dword [rcx + 0x18], r15d
jmp 0x180039bd1
mov dword [rsp + 0x54], r15d
jmp 0x1800399b2
mov ecx, 3
int 0x29
mov r12, qword [rsp + 0x70]
mov r13, qword [rsp + 0xd0]
lea rcx, [rsp + 0x220]
call sym.ntdll.dll_RtlDeactivateActivationContextUnsafeFast
mov rbx, qword [rsp + 0x458]
test edi, edi
js 0x1800b0a0d
lea rax, [rsp + 0x460]
cmp rax, rbx
jne 0x1800b0a24
lea rax, [rsp + 0x460]
mov qword [rsp + 0x458], rax
mov dword [rsp + 0x450], 0x1000000
mov word [rsp + 0x460], r14w
lea rax, [rsp + 0x350]
mov rcx, qword [rsp + 0x348]
cmp rax, rcx
jne 0x18003b0d7
mov eax, edi
mov rcx, qword [rsp + 0x560]
xor rcx, rsp
call fcn.18008b0e0
add rsp, 0x570
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov eax, dword [rcx + 0x10]
and al, 0x70
cmp al, 0x20
je 0x18003954d
jmp 0x1800b09a6
cmp qword [rcx + 8], rdx
je 0x18003957a
jmp 0x18003b0c7
test rcx, rcx
jne 0x18003b0b6
lea rax, [rsp + 0x230]
mov qword [r8], rax
jmp 0x180039585
call sym.ntdll.dll_RtlDeleteBoundaryDescriptor
jmp 0x18003b07f
call sym.ntdll.dll_RtlAnsiStringToUnicodeSize
mov rbx, qword [rsp + 0x458]
movzx esi, word [rsp + 0x452]
movzx edx, word [rsp + 0x450]
xor r8d, r8d
jmp 0x180039445
mov r15d, 0xfffe
cmp ecx, r15d
jbe 0x1800b0908
mov edi, 0xc0000106
jmp 0x180039458
lea esi, [rcx + 0x3f]
and esi, 0xffffffc0
cmp esi, r15d
cmova esi, r15d
lea rax, [rsp + 0x460]
mov ecx, esi
cmp rbx, rax
je 0x1800b0931
mov rdx, rbx
call fcn.1800d0568
mov rbx, rax
jmp 0x1800b095f
call fcn.18003b5e0
mov rbx, rax
test rax, rax
je 0x1800b095f
movzx edx, word [rsp + 0x450]
test dx, dx
je 0x1800b0967
movzx r8d, dx
mov rdx, qword [rsp + 0x458]
mov rcx, rax
call sym.ntdll.dll_RtlCopyMemory
movzx edx, word [rsp + 0x450]
xor r8d, r8d
test rbx, rbx
jne 0x1800b0989
mov edi, 0xc0000017
mov rbx, qword [rsp + 0x458]
movzx esi, word [rsp + 0x452]
jmp 0x180039458
mov qword [rsp + 0x458], rbx
mov word [rsp + 0x452], si
jmp 0x180039458
mov rcx, r14
jmp 0x18003950d
mov qword [rsp + 0x2a8], r14
mov dword [rsp + 0x2b8], 4
mov qword [rsp + 0x2c0], r8
mov qword [rsp + 0x2c8], rcx
mov qword [rsp + 0x2d0], rcx
mov eax, dword [rcx + 0x10]
mov qword [rsp + 0x2d8], rax
mov dword [rsp + 0x2a0], 0xc0150014
mov dword [rsp + 0x2a4], 1
lea rcx, [rsp + 0x2a0]
call sym.ntdll.dll_RtlRaiseException
xor r14d, r14d
jmp 0x18003b02d
mov qword [r12], r14
mov rax, qword [r13 + 0x28]
mov dword [rax], edi
mov rbx, qword [rsp + 0x458]
jmp 0x18003b035
mov rcx, rbx
call sym.ntdll.dll_RtlDeleteBoundaryDescriptor
nop
jmp 0x18003b046