Function at 0x180003ef0
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov rdi, rcx
lea rcx, [0x180083228]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rcx, str.kernel32.dll
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r13, rax
call fcn.18001bc40
test eax, 0xfffffffc
jne 0x1800045e4
cmp eax, 2
je 0x1800045e4
mov qword [rsp + 0x398], rbx
lea rcx, [0x180083228]
mov qword [rsp + 0x3a0], rsi
mov qword [rsp + 0x3a8], r15
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, listen
lea r14, [0x180084cd8]
test rax, rax
jne 0x180003f7e
mov eax, esi
jmp 0x180003fbe
lea rdx, str.NtOpenFile
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x180003f9a
mov eax, listen
jmp 0x180003fbe
lea r8, [0x180095870]
mov rcx, rax
lea rdx, [0x180003410]
call fcn.18001bcd0
test eax, eax
je 0x180003ffd
cmp eax, 1
je 0x180003ffd
cmp eax, 3
je 0x180003ffd
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x20]
lea rax, [rsp + 0x20]
mov qword [rsp + 0x20], r14
mov rdx, rdi
mov qword [rsp + 0x58], rax
call fcn.180008f00
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x180003ff9
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor bl, bl
jmp 0x180003fff
mov bl, 1
lea rcx, [0x180083228]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x180004015
mov eax, esi
jmp 0x180004055
lea rdx, str.NtClose
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x180004031
mov eax, listen
jmp 0x180004055
lea r8, [0x180095880]
mov rcx, rax
lea rdx, [0x180003a10]
call fcn.18001bcd0
test eax, eax
je 0x180004093
cmp eax, 1
je 0x180004093
cmp eax, 3
je 0x180004093
mov dword [rsp + 0x68], eax
lea rcx, [rsp + 0x60]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], r14
mov rdx, rdi
mov qword [rbp - 0x68], rax
call fcn.180008f00
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x18000408e
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor r15b, r15b
jmp 0x180004096
mov r15b, 1
lea rcx, [0x180083228]
and r15b, bl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x1800040af
mov eax, esi
jmp 0x1800040ef
lea rdx, str.NtCreateSection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1800040cb
mov eax, listen
jmp 0x1800040ef
lea r8, [0x180095888]
mov rcx, rax
lea rdx, [0x1800038d0]
call fcn.18001bcd0
test eax, eax
je 0x180004126
cmp eax, 1
je 0x180004126
cmp eax, 3
je 0x180004126
mov dword [rbp - 0x58], eax
lea rcx, [rbp - 0x60]
lea rax, [rbp - 0x60]
mov qword [rbp - 0x60], r14
mov rdx, rdi
mov qword [rbp - 0x28], rax
call fcn.180008f00
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x180004123
mov rax, qword [rcx]
lea rdx, [rbp - 0x60]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor r15b, r15b
lea rcx, [0x180083228]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x18000413c
mov eax, esi
jmp 0x18000417c
lea rdx, str.NtQueryAttributesFile
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x180004158
mov eax, listen
jmp 0x18000417c
lea r8, [0x180095868]
mov rcx, rax
lea rdx, [0x180003980]
call fcn.18001bcd0
test eax, eax
je 0x1800041b4
cmp eax, 1
je 0x1800041b4
cmp eax, 3
je 0x1800041b4
mov dword [rbp - 0x18], eax
lea rcx, [rbp - 0x20]
lea rax, [rbp - 0x20]
mov qword [rbp - 0x20], r14
mov rdx, rdi
mov qword [rbp + 0x18], rax
call fcn.180008f00
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x1800041b0
mov rax, qword [rcx]
lea rdx, [rbp - 0x20]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor bl, bl
jmp 0x1800041b6
mov bl, 1
lea rcx, str.kernel32.dll
and bl, r15b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r15, qword [rsp + 0x3a8]
test rax, rax
jne 0x1800041d7
mov eax, esi
jmp 0x180004217
lea rdx, [0x180083280]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1800041f3
mov eax, listen
jmp 0x180004217
lea r8, [0x180095878]
mov rcx, rax
lea rdx, [0x180003480]
call fcn.18001bcd0
test eax, eax
je 0x18000424d
cmp eax, 1
je 0x18000424d
cmp eax, 3
je 0x18000424d
mov dword [rbp + 0x28], eax
lea rcx, [rbp + 0x20]
lea rax, [rbp + 0x20]
mov qword [rbp + 0x20], r14
mov rdx, rdi
mov qword [rbp + 0x58], rax
call fcn.180008f00
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x18000424b
mov rax, qword [rcx]
lea rdx, [rbp + 0x20]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor bl, bl
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18000429f
lea rdx, [0x180083290]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x180004279
lea esi, [rax + 0xc]
jmp 0x18000429f
lea r8, [0x180095860]
mov rcx, rax
lea rdx, [0x1800036b0]
call fcn.18001bcd0
mov esi, eax
test eax, eax
je 0x1800042dd
cmp eax, 1
je 0x1800042dd
cmp eax, 3
je 0x1800042dd
lea rax, [rbp + 0x60]
mov qword [rbp + 0x60], r14
mov rdx, rdi
mov qword [rbp + 0x98], rax
lea rcx, [rbp + 0x60]
mov dword [rbp + 0x68], esi
call fcn.180008f00
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x1800042d9
mov rax, qword [rcx]
lea rdx, [rbp + 0x60]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor al, al
jmp 0x1800042df
mov al, 1
mov rsi, qword [rsp + 0x3a0]
and bl, al
je 0x1800045c9
lea rdx, str.NtOpenFile
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov edx, 1
call fcn.18001bfc0
test eax, 0xfffffffc
jne 0x180004318
cmp eax, 2
jne 0x180004363
mov dword [rbp + 0xa8], eax
lea rcx, [rbp + 0xa0]
lea rax, [rbp + 0xa0]
mov qword [rbp + 0xa0], r14
mov rdx, rdi
mov qword [rbp + 0xd8], rax
call fcn.180008f00
mov rcx, qword [rbp + 0xd8]
test rcx, rcx
je 0x180004361
mov rax, qword [rcx]
lea r8, [rbp + 0xa0]
cmp rcx, r8
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor bl, bl
lea rdx, str.NtClose
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov edx, 1
call fcn.18001bfc0
test eax, 0xfffffffc
jne 0x180004390
cmp eax, 2
je 0x180004390
mov al, 1
jmp 0x1800043db
mov dword [rbp + 0xe8], eax
lea rcx, [rbp + 0xe0]
lea rax, [rbp + 0xe0]
mov qword [rbp + 0xe0], r14
mov rdx, rdi
mov qword [rbp + 0x118], rax
call fcn.180008f00
mov rcx, qword [rbp + 0x118]
test rcx, rcx
je 0x1800043d9
mov rax, qword [rcx]
lea r8, [rbp + 0xe0]
cmp rcx, r8
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor al, al
lea rdx, str.NtCreateSection
mov rcx, r12
and bl, al
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov edx, 1
call fcn.18001bfc0
test eax, 0xfffffffc
jne 0x180004406
cmp eax, 2
jne 0x180004451
mov dword [rbp + 0x128], eax
lea rcx, [rbp + 0x120]
lea rax, [rbp + 0x120]
mov qword [rbp + 0x120], r14
mov rdx, rdi
mov qword [rbp + 0x158], rax
call fcn.180008f00
mov rcx, qword [rbp + 0x158]
test rcx, rcx
je 0x18000444f
mov rax, qword [rcx]
lea r8, [rbp + 0x120]
cmp rcx, r8
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor bl, bl
lea rdx, str.NtQueryAttributesFile
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov edx, 1
call fcn.18001bfc0
test eax, 0xfffffffc
jne 0x18000447e
cmp eax, 2
je 0x18000447e
mov al, 1
jmp 0x1800044c9
mov dword [rbp + 0x168], eax
lea rcx, [rbp + 0x160]
lea rax, [rbp + 0x160]
mov qword [rbp + 0x160], r14
mov rdx, rdi
mov qword [rbp + 0x198], rax
call fcn.180008f00
mov rcx, qword [rbp + 0x198]
test rcx, rcx
je 0x1800044c7
mov rax, qword [rcx]
lea r8, [rbp + 0x160]
cmp rcx, r8
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor al, al
lea rdx, [0x180083280]
mov rcx, r13
and bl, al
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov edx, 1
call fcn.18001bfc0
test eax, 0xfffffffc
jne 0x1800044f4
cmp eax, 2
jne 0x18000453f
mov dword [rbp + 0x1a8], eax
lea rcx, [rbp + 0x1a0]
lea rax, [rbp + 0x1a0]
mov qword [rbp + 0x1a0], r14
mov rdx, rdi
mov qword [rbp + 0x1d8], rax
call fcn.180008f00
mov rcx, qword [rbp + 0x1d8]
test rcx, rcx
je 0x18000453d
mov rax, qword [rcx]
lea r8, [rbp + 0x1a0]
cmp rcx, r8
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor bl, bl
lea rdx, [0x180083290]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov edx, 1
call fcn.18001bfc0
test eax, 0xfffffffc
jne 0x18000456c
cmp eax, 2
je 0x18000456c
mov al, 1
jmp 0x1800045b7
mov dword [rbp + 0x1e8], eax
lea rcx, [rbp + 0x1e0]
lea rax, [rbp + 0x1e0]
mov qword [rbp + 0x1e0], r14
mov rdx, rdi
mov qword [rbp + 0x218], rax
call fcn.180008f00
mov rcx, qword [rbp + 0x218]
test rcx, rcx
je 0x1800045b5
mov rax, qword [rcx]
lea rdx, [rbp + 0x1e0]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor al, al
and bl, al
mov byte [rdi + 0x80], bl
jne 0x1800045c9
mov rcx, rdi
call sym.anonymous.dll_public:_void___cdecl_DllManager::DisableDllRedirection_void____ptr64
movzx eax, bl
mov rbx, qword [rsp + 0x398]
add rsp, 0x360
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
mov dword [rbp + 0x228], eax
lea r14, [0x180084cd8]
lea rax, [rbp + 0x220]
mov qword [rbp + 0x220], r14
mov rdx, rdi
mov qword [rbp + 0x258], rax
lea rcx, [rbp + 0x220]
call fcn.180008f00
mov rcx, qword [rbp + 0x258]
test rcx, rcx
je 0x180004634
mov rax, qword [rcx]
lea rdx, [rbp + 0x220]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor al, al
add rsp, 0x360
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret