Function at 0x180009350
Capabilities:
Access pe header
Get session user name

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0xbf0]
sub rsp, 0xcf0
mov qword [rbp - 0x78], 0xfffffffffffffffe
mov qword [rsp + 0xd30], rbx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x70]
call fcn.18004b570
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x3b0]
call fcn.18004b570
mov dword [rbp + 0xc20], 0x104
lea rdx, [rbp + 0xc20]
lea rcx, [rbp + 0x3b0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x7d0]
call fcn.18004b570
mov r8d, 0x104
lea rdx, [rbp + 0x7d0]
mov rcx, qword [0x1800a0128]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x7d0]
mov rdi, 0xffffffffffffffff
mov rax, rdi
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x180009400
xor r15d, r15d
cmp rax, 3
jae 0x1800094fc
call fcn.1800013b0
mov rsi, rax
mov r14, qword [0x1800a0128]
mov rcx, r14
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x1800094fc
cmp dword [rax + 0xa0], r15d
je 0x1800094fc
mov edx, dword [rax + 0x50]
add rdx, r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rdx
lea rdx, [rsp + 0x40]
lea rcx, [rsi + 0x58]
call fcn.18000c8d0
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
lea rcx, [rsi + 0x58]
call fcn.18000c900
call fcn.18000a1a0
mov qword [rbp + 0xc28], r15
lea r8, [rbp + 0xc28]
lea edx, [r15 + 0x64]
xor ecx, ecx
call qword [sym.imp.NETAPI32.dll_NetWkstaGetInfo]
test eax, eax
jne 0x1800094fc
mov rcx, qword [rbp + 0xc28]
call qword [sym.imp.NETAPI32.dll_NetApiBufferFree]
cmp byte [rsi + 0x10], r15b
jne 0x1800094fc
call fcn.18002c8b0
lea r9, [rsi + 0x70]
lea r8, [0x180001360]
lea rdx, [0x180082ab0]
lea rcx, [0x1800810e0]
call fcn.18002c820
lea r9, [rsi + 0x68]
lea r8, [0x1800011f0]
lea rdx, [0x180082ac8]
lea rcx, [0x1800810e0]
call fcn.18002c820
xor ecx, ecx
call fcn.18002c8a0
mov byte [rsi + 0x10], 1
mov ecx, 0x80000041
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x5c0]
call fcn.18004b570
call fcn.18000a230
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1a0]
call fcn.18004b570
call fcn.180025c90
mov rbx, rax
cmp byte [rax + 0x218], r15b
je 0x18000954b
lea r8, [rax + 0x10]
jmp 0x180009557
mov rcx, rbx
call fcn.180025d50
lea r8, [rbx + 0x10]
lea rdx, [0x180083490]
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rbx + 0x219]
call fcn.180026590
lea r8, str._smcache.dat
mov edx, 0x104
lea rcx, [rbp + 0x1a0]
call fcn.1800507a4
lea r8, [rbp + 0x1a0]
mov edx, 0x104
lea rcx, [rbp + 0x5c0]
call fcn.1800505c4
lea rdx, str.system
lea rcx, [rbp + 0x3b0]
call fcn.18005062c
test eax, eax
jne 0x180009619
call fcn.180009d20
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1a0]
call fcn.18004b570
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r8d, 0x104
lea rdx, [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea rdx, str.rundll32.exe
mov rcx, rax
call fcn.18005062c
test eax, eax
je 0x1800097be
lea rax, [rbp + 0x5c0]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0x5c0]
mov rax, rdi
nop
inc rax
cmp word [rcx + rax*2], r15w
jne 0x180009630
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.1800266c0
nop
cmp byte [rsp + 0x60], 0
jne 0x1800096a5
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x18000989b
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009896
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800098ba
jmp 0x180009896
lea rsi, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rsi, qword [rsp + 0x68]
call fcn.18000a230
call fcn.180025c90
mov rbx, rax
cmp byte [rax + 0x218], 0
je 0x1800096d1
lea r8, [rax + 0x10]
jmp 0x1800096dd
mov rcx, rbx
call fcn.180025d50
lea r8, [rbx + 0x10]
lea rdx, [0x180083490]
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rbx + 0x219]
call fcn.180026590
lea rcx, [rsi + 4]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], 0
jne 0x180009701
lea r9, [rbp + 0x3b0]
lea r8, [rbp - 0x70]
lea rdx, str._s_s__s.log
cmp rax, 1
jbe 0x18000972a
mov qword [rsp + 0x20], rcx
jmp 0x180009736
lea rax, str.M86_99.lck
mov qword [rsp + 0x20], rax
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
inc rax
test rax, 0xfffffffffffffffe
jne 0x180009782
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180009740
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x1800097be
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800097b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800098c0
call fcn.18002aef0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x9e0]
call fcn.18004b570
lea rax, [rbp + 0x3b0]
nop dword [rax]
lea rdi, [rdi + 1]
cmp word [rax + rdi*2], 0
jne 0x1800097e0
lea r8, [rdi + rdi]
lea rdx, [rbp + 0x3b0]
lea rcx, [rsp + 0x40]
call fcn.180025390
nop
mov rbx, qword [rsp + 0x48]
cmp byte [rsp + 0x40], 0
je 0x180009845
mov rdx, qword [rsp + 0x50]
sub rdx, rbx
mov rcx, rbx
call fcn.180023430
mov r8d, eax
lea rdx, str.GlobalIntelGameSpeed__x
lea rcx, [rbp + 0x9e0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rbp + 0x9e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
call fcn.180009d20
lea rdx, [rbp + 0x5c0]
mov rcx, rax
call fcn.180007910
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
test rbx, rbx
je 0x18000989b
mov rdx, qword [rsp + 0x58]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x180009893
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800098b4
mov rcx, rbx
call fcn.18002aef0
xor eax, eax
mov rbx, qword [rsp + 0xd30]
add rsp, 0xcf0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.18004df84
int3
call fcn.18004df84
int3
call fcn.18004df84
int3