Function at 0x180013dec
Capabilities:
Access pe header
Map section object

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x7f0]
sub rsp, 0x900
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rbp + 0x7e0], rax
xor ebx, ebx
mov dword [rbp - 0x28], ecx
xorps xmm0, xmm0
mov word [rbp - 0x40], bx
xorps xmm1, xmm1
mov qword [rbp + 0x48], rbx
lea rax, [rbp]
mov qword [rbp - 8], rbx
mov qword [rbp + 0x60], rax
lea r14d, [rbx + 1]
lea rax, [rbp - 0x18]
mov dword [rbp - 0x80], r14d
mov qword [rbp + 0x68], rax
lea rcx, [rbp + 0x270]
lea rax, [rbp + 0x120]
mov dword [rbp - 0x78], r14d
mov qword [rbp + 0x70], rax
mov r15, r8
lea rax, [rbp + 0x158]
mov qword [rbp - 0x30], rbx
mov qword [rbp + 0x78], rax
mov rsi, rdx
lea rax, [rbp + 0x190]
mov dword [rbp - 0x38], ebx
mov qword [rbp + 0x80], rax
xor edx, edx
lea rax, [rbp + 0x1c8]
mov dword [rbp - 0x3c], ebx
mov r8d, 0x1f8
mov qword [rbp + 0x88], rax
mov r12d, ebx
mov dword [rbp - 0x7c], ebx
mov r13d, ebx
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp + 0x100], xmm1
movups xmmword [rbp + 0x110], xmm1
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
call sub.ntdll.dll_memset
lea ecx, [r14 + 0x7f]
mov word [rbp + 0x4e0], bx
lea rax, [rbp + 0x4e0]
mov qword [rbp + 0x140], rcx
mov qword [rbp + 0x130], rax
lea rax, [rbp + 0x4e0]
mov qword [rbp + 0x138], rax
lea rax, [rbp + 0x4e0]
mov qword [rbp + 0x128], rax
lea rax, [rbp + 0x760]
mov qword [rbp + 0x168], rax
lea rax, [rbp + 0x760]
mov qword [rbp + 0x170], rax
lea rax, [rbp + 0x760]
mov qword [rbp + 0x160], rax
lea rax, [rbp + 0x560]
mov qword [rbp + 0x1a0], rax
lea rax, [rbp + 0x560]
mov qword [rbp + 0x1a8], rax
lea rax, [rbp + 0x560]
mov qword [rbp + 0x198], rax
lea rax, [rbp + 0x5e0]
mov qword [rbp + 0x1d8], rax
lea rax, [rbp + 0x5e0]
mov qword [rbp + 0x1e0], rax
lea rax, [rbp + 0x5e0]
mov qword [rbp + 0x1d0], rax
mov qword [rbp + 0x148], rcx
mov dword [rbp + 0x120], 0x800000
mov qword [rbp + 0x178], rcx
mov qword [rbp + 0x180], rcx
mov word [rbp + 0x760], bx
mov dword [rbp + 0x158], 0x800000
mov qword [rbp + 0x1b0], rcx
mov qword [rbp + 0x1b8], rcx
mov word [rbp + 0x560], bx
mov dword [rbp + 0x190], 0x800000
mov qword [rbp + 0x1e8], rcx
mov qword [rbp + 0x1f0], rcx
mov word [rbp + 0x5e0], bx
mov dword [rbp + 0x1c8], 0x800000
lea rax, [rbp + 0x660]
mov qword [rbp + 0x220], rcx
mov qword [rbp + 0x210], rax
lea edi, [rbx + 2]
lea rax, [rbp + 0x660]
mov qword [rbp + 0x228], rcx
mov qword [rbp + 0x218], rax
lea rax, [rbp + 0x660]
mov qword [rbp + 0x208], rax
lea rax, [rbp + 0x6e0]
mov qword [rbp + 0x248], rax
lea rax, [rbp + 0x6e0]
mov qword [rbp + 0x250], rax
lea rax, [rbp + 0x6e0]
mov qword [rbp + 0x240], rax
movzx eax, word [rsi + 0x10]
mov word [rbp + 0x274], ax
mov word [rbp + 0x660], bx
mov dword [rbp + 0x200], 0x800000
mov qword [rbp + 0x258], rcx
mov qword [rbp + 0x260], rcx
mov word [rbp + 0x6e0], bx
mov dword [rbp + 0x238], 0x800000
mov qword [rbp - 0x10], rbx
test byte [rsi + 4], dil
je 0x1800140d1
lea rdx, [rbp + 0x238]
lea ecx, [rbx + 0x48]
call fcn.180014fa0
mov ebx, eax
test eax, eax
js 0x180014195
movzx ecx, word [rsi + 0x12]
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_SetThreadUILanguage]
nop dword [rax + rax]
mov dword [rbp - 0x3c], r14d
lea rdx, [rbp + 0x200]
mov ecx, 0x38
call fcn.180014fa0
mov ebx, eax
test eax, eax
js 0x18001463a
movups xmm0, xmmword [rbp + 0x200]
mov rdx, qword [rsi + 0x18]
lea rcx, [rbp + 0x2f8]
or r14, 0xffffffffffffffff
cmp qword [rsi + 0x20], 0x10000
mov rax, r14
movdqu xmmword [rbp + 0x278], xmm0
cmovb rax, qword [rsi + 0x20]
mov qword [rbp + 0x320], rax
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
movzx edx, word [rbp + 0x2f8]
xor r9d, r9d
test dx, dx
je 0x18001419c
movzx ecx, word [rbp + 0x2fa]
mov r8d, 0xfffe
movzx eax, dx
and cx, r8w
and ax, r8w
cmp ax, cx
jae 0x18001416c
mov rax, qword [rbp + 0x300]
mov ecx, edx
shr rcx, 1
cmp word [rax + rcx*2], r9w
je 0x18001419c
xor edx, edx
lea r9, str.BasepCreateActCtx
lea r8, str.SXS:__s___AssemblyDirectory_is_not_null_terminated_n
lea ecx, [rdx + 0x33]
call qword [sym.imp.ntdll.dll_DbgPrintEx]
nop dword [rax + rax]
mov ebx, 0xc000000d
jmp 0x180014636
xor edi, edi
jmp 0x180014660
mov rax, qword [rsi + 8]
test rax, rax
je 0x180014ead
cmp word [rax], r9w
je 0x180014ead
test byte [rsi + 4], 0x40
mov rdx, rax
mov qword [rbp + 0x328], r15
mov qword [rbp - 0x58], r14
je 0x1800141ef
lea rcx, [rbp + 0x308]
mov dword [rbp + 0x270], 8
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov ecx, dword [rbp + 0x270]
jmp 0x180014d4b
lea rcx, [rbp]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov rcx, qword [rsi + 8]
call qword [sym.imp.ntdll.dll_RtlDetermineDosPathNameType_U]
nop dword [rax + rax]
mov rcx, qword [rbp + 8]
lea rdx, [rbp - 0x18]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U_WithStatus]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x180014636
mov rcx, qword [rbp + 8]
mov edx, 0x2e
call qword [sym.imp.ntdll.dll_wcsrchr]
nop dword [rax + rax]
test byte [rsi + 4], 0x80
mov r15, rax
mov qword [rbp + 0x50], rax
je 0x180014275
mov rcx, qword [rsi + 0x30]
xor ebx, ebx
mov qword [rbp - 0x48], rcx
mov r14d, ebx
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], rbx
lea ecx, [rbx + 1]
mov dword [rbp - 0x80], ebx
jmp 0x1800145aa
xor eax, eax
mov dword [rsp + 0x28], 0x60
mov qword [rbp + 0x18], rax
lea r9, [rbp + 0xf0]
lea rax, [rbp - 0x18]
mov dword [rbp + 0x10], 0x30
xorps xmm0, xmm0
mov qword [rbp + 0x20], rax
lea r8, [rbp + 0x10]
mov dword [rbp + 0x28], 0x40
mov edx, 0x1200a9
mov dword [rsp + 0x20], 5
lea rcx, [rbp - 0x60]
movdqu xmmword [rbp + 0x30], xmm0
call qword [sym.imp.ntdll.dll_NtOpenFile]
nop dword [rax + rax]
xor edx, edx
mov ebx, eax
test eax, eax
jns 0x180014346
cmp eax, 0xc0000034
je 0x180014636
add eax, 0x3fffff77
cmp eax, edi
jbe 0x180014636
cmp ebx, 0xc0000204
je 0x180014636
cmp ebx, 0xc0150002
je 0x180014636
cmp ebx, 0xc0150004
je 0x180014636
cmp ebx, 0xc000000f
je 0x180014636
mov rax, qword [rbp + 0x20]
lea r8, str.SXS:__s___NtOpenFile__wZ__failed_n
mov qword [rsp + 0x20], rax
lea r9, str.BasepCreateActCtx
mov ecx, 0x33
call qword [sym.imp.ntdll.dll_DbgPrintEx]
nop dword [rax + rax]
jmp 0x180014636
test r15, r15
je 0x180014424
lea rdx, str..dll
mov rcx, r15
call qword [sym.imp.ntdll.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x180014389
lea rdx, [0x1800864f0]
mov rcx, r15
call qword [sym.imp.ntdll.dll__wcsicmp]
nop dword [rax + rax]
xor edx, edx
test eax, eax
jne 0x180014424
mov rax, qword [rbp - 0x60]
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], 0x11000000
xor r8d, r8d
mov dword [rsp + 0x20], edi
lea edx, [r9 + 4]
call qword [sym.imp.ntdll.dll_NtCreateSection]
nop dword [rax + rax]
xor edx, edx
mov ebx, eax
test eax, eax
jns 0x1800144cf
cmp eax, 0xc000007b
je 0x180014422
add eax, 0x3ffffed1
cmp eax, edi
jbe 0x180014422
cmp ebx, 0xc000035a
je 0x180014422
cmp ebx, 0xc0000034
je 0x180014410
lea eax, [rbx + 0x3fffff77]
cmp eax, edi
jbe 0x180014410
cmp ebx, 0xc0000204
je 0x180014410
cmp ebx, 0xc0150002
je 0x180014410
cmp ebx, 0xc0150004
je 0x180014410
cmp ebx, 0xc000000f
je 0x180014410
mov edi, edx
lea r8, str.SXS:__s___NtCreateSection___failed._Status__0x_x_n
mov dword [rsp + 0x20], ebx
mov edx, edi
jmp 0x180014329
mov ebx, edx
mov r15d, edx
mov rcx, qword [rbp - 0x50]
test rcx, rcx
jne 0x180014466
mov rax, qword [rbp - 0x60]
lea edx, [rcx + 4]
mov qword [rsp + 0x30], rax
lea rcx, [rbp - 0x50]
mov dword [rsp + 0x28], 0x8000000
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], edi
call qword [sym.imp.ntdll.dll_NtCreateSection]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x50]
xor edx, edx
mov ebx, eax
test ebx, ebx
js 0x180014559
mov dword [rsp + 0x48], edi
lea rax, [rbp - 8]
mov dword [rsp + 0x40], edx
lea r8, [rbp - 0x20]
mov dword [rsp + 0x38], 1
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rdx
mov qword [rbp - 0x20], rdx
mov rdx, r14
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
nop dword [rax + rax]
xor ecx, ecx
mov ebx, eax
test eax, eax
js 0x1800144de
mov rax, qword [rbp - 0x20]
xor ebx, ebx
mov r14d, dword [rbp - 0x80]
test r15d, r15d
jne 0x1800144c6
or rax, 1
mov qword [rbp - 0x48], rax
jmp 0x1800145aa
mov r15d, 1
mov dword [rbp - 0x7c], r15d
jmp 0x180014427
cmp ebx, 0xc0000017
je 0x18001453f
cmp ebx, 0xc0000034
je 0x180014519
add eax, 0x3fffff77
cmp eax, edi
jbe 0x180014519
cmp ebx, 0xc0000204
je 0x180014519
cmp ebx, 0xc0150002
je 0x180014519
cmp ebx, 0xc0150004
je 0x180014519
cmp ebx, 0xc000000f
je 0x180014519
mov edi, ecx
lea r9, str.BasepCreateActCtx
mov edx, edi
lea r8, str.SXS:__s___NtMapViewOfSection_failed_n
mov ecx, 0x33
call qword [sym.imp.ntdll.dll_DbgPrintEx]
nop dword [rax + rax]
jmp 0x180014636
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
xor ebx, ebx
mov qword [rbp - 0x50], rbx
mov ecx, ebx
jmp 0x1800145a6
cmp ebx, 0xc0000040
je 0x1800145a1
cmp ebx, 0xc0000034
je 0x180014595
lea eax, [rbx + 0x3fffff77]
cmp eax, edi
jbe 0x180014595
cmp ebx, 0xc0000204
je 0x180014595
cmp ebx, 0xc0150002
je 0x180014595
cmp ebx, 0xc0150004
je 0x180014595
cmp ebx, 0xc000000f
je 0x180014595
mov edi, edx
lea r8, str.SXS:__s___NtCreateSection___failed._Status__0x_x._n
jmp 0x180014417
mov ecx, r12d
xor ebx, ebx
mov r14d, dword [rbp - 0x80]
mov rax, qword [rbp - 0x48]
test rax, rax
je 0x1800145ec
mov r8, qword [rbp - 8]
lea r9, [rbp + 0x48]
and rax, 0xfffffffffffffffc
mov rdx, rax
call qword [sym.imp.ntdll.dll_RtlImageNtHeaderEx]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x1800145dc
xor ebx, ebx
lea r12d, [rbx + 1]
jmp 0x1800145f7
mov dword [rbp - 0x78], r14d
cmp ebx, 0xc000007b
jne 0x18001463a
xor ebx, ebx
jmp 0x1800145f7
cmp qword [rsi + 0x20], rbx
mov r12d, ebx
setne r12b
mov eax, r12d
mov dword [rbp - 0x78], ebx
neg eax
lea r15, [rbp - 0x60]
lea rax, [rbp - 0x60]
sbb r14, r14
and r14, rax
lea rax, [rbp + 0x100]
test r12d, r12d
cmovne r15, rax
jne 0x18001498e
cmp qword [rsi + 0x20], rbx
je 0x18001499e
mov ebx, 0xc000007b
mov r13, r14
mov r12, r15
mov r14d, dword [rbp - 0x80]
xor edi, edi
cmp dword [rbp - 0x3c], edi
je 0x18001465b
mov rdx, qword [rbp + 0x240]
lea r8, [rbp + 0x40]
lea ecx, [rdi + 8]
call qword [sym.imp.ntdll.dll_RtlSetThreadPreferredUILanguages]
nop dword [rax + rax]
test r14d, r14d
je 0x180014671
cmp qword [rbp - 0x48], 0
je 0x180014671
cmp dword [rbp - 0x7c], edi
jne 0x180014671
and qword [rbp - 0x48], 0xfffffffffffffffc
cmp dword [rbp - 0x78], edi
je 0x18001467f
lea rcx, [rbp - 0x60]
call fcn.180014f54
test r12, r12
je 0x18001468c
mov rcx, r12
call fcn.180014f54
xor r12d, r12d
test r13, r13
je 0x1800146a1
test r14d, r14d
je 0x1800146a1
mov rcx, r13
call fcn.180014f54
lea rcx, [rbp + 0xd0]
call fcn.180014f54
cmp dword [rbp - 0x38], r12d
je 0x1800146c8
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1800146c8
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp - 0x10]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 0x138]
test rax, rax
je 0x18001472f
cmp rax, rcx
je 0x18001471a
lea rcx, [rbp + 0x50]
mov qword [rbp + 0x58], rax
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x138]
mov rax, qword [rbp + 0x148]
mov qword [rbp + 0x140], rax
mov qword [rbp + 0x130], rcx
mov qword [rbp + 0x128], rcx
test rcx, rcx
je 0x18001473f
mov word [rcx], r12w
movzx eax, word [rbp + 0x148]
mov rcx, qword [rbp + 0x170]
mov word [rbp + 0x122], ax
mov rax, qword [rbp + 0x168]
mov word [rbp + 0x120], r12w
test rax, rax
je 0x18001479d
cmp rax, rcx
je 0x180014788
lea rcx, [rbp - 0x70]
mov qword [rbp - 0x68], rax
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x170]
mov rax, qword [rbp + 0x180]
mov qword [rbp + 0x178], rax
mov qword [rbp + 0x168], rcx
mov qword [rbp + 0x160], rcx
test rcx, rcx
je 0x1800147ad
mov word [rcx], r12w
movzx eax, word [rbp + 0x180]
mov rcx, qword [rbp + 0x1a8]
mov word [rbp + 0x15a], ax
mov rax, qword [rbp + 0x1a0]
mov word [rbp + 0x158], r12w
test rax, rax
je 0x180014811
cmp rax, rcx
je 0x1800147fc
lea rcx, [rbp + 0x90]
mov qword [rbp + 0x98], rax
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x1a8]
mov rax, qword [rbp + 0x1b8]
mov qword [rbp + 0x1b0], rax
mov qword [rbp + 0x1a0], rcx
mov qword [rbp + 0x198], rcx
test rcx, rcx
je 0x180014821
mov word [rcx], r12w
movzx eax, word [rbp + 0x1b8]
mov rcx, qword [rbp + 0x1e0]
mov word [rbp + 0x192], ax
mov rax, qword [rbp + 0x1d8]
mov word [rbp + 0x190], r12w
test rax, rax
je 0x180014885
cmp rax, rcx
je 0x180014870
lea rcx, [rbp + 0xa0]
mov qword [rbp + 0xa8], rax
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x1e0]
mov rax, qword [rbp + 0x1f0]
mov qword [rbp + 0x1e8], rax
mov qword [rbp + 0x1d8], rcx
mov qword [rbp + 0x1d0], rcx
test rcx, rcx
je 0x180014895
mov word [rcx], r12w
movzx eax, word [rbp + 0x1f0]
mov rcx, qword [rbp + 0x218]
mov word [rbp + 0x1ca], ax
mov rax, qword [rbp + 0x210]
mov word [rbp + 0x1c8], r12w
test rax, rax
je 0x1800148f9
cmp rax, rcx
je 0x1800148e4
lea rcx, [rbp + 0xb0]
mov qword [rbp + 0xb8], rax
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x218]
mov rax, qword [rbp + 0x228]
mov qword [rbp + 0x220], rax
mov qword [rbp + 0x210], rcx
mov qword [rbp + 0x208], rcx
test rcx, rcx
je 0x180014909
mov word [rcx], r12w
movzx eax, word [rbp + 0x228]
mov rcx, qword [rbp + 0x248]
mov word [rbp + 0x202], ax
mov rax, qword [rbp + 0x250]
mov word [rbp + 0x200], r12w
test rcx, rcx
je 0x180014958
cmp rcx, rax
je 0x180014958
mov qword [rbp + 0xc8], rcx
lea rcx, [rbp + 0xc0]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
nop dword [rax + rax]
mov rax, qword [rbp + 0x250]
test rax, rax
je 0x180014961
mov word [rax], r12w
mov eax, ebx
mov rcx, qword [rbp + 0x7e0]
xor rcx, rsp
call fcn.180024680
mov rbx, qword [rsp + 0x940]
add rsp, 0x900
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test byte [rsi + 4], 8
jne 0x18001499e
mov ebx, 0xc000008a
jmp 0x180014630
test byte [rsi + 4], 8
movups xmm0, xmmword [rbp]
mov dword [rbp + 0x480], r13d
mov qword [rbp + 0x488], rbx
movdqu xmmword [rbp + 0x470], xmm0
je 0x180014a44
mov rdx, qword [rsi + 0x20]
cmp rdx, 0x10000
jae 0x180014a31
cmp rdx, 1
je 0x180014a44
mov r9d, edx
lea r8, str.._lu
mov edx, 8
lea rcx, [rbp + 0x4d0]
call qword [sym.imp.ntdll.dll_swprintf_s]
nop dword [rax + rax]
lea rcx, [rbp + 0x4d0]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x180014a02
add ax, ax
mov word [rbp + 0x480], ax
mov eax, 0x10
mov word [rbp + 0x482], ax
lea rax, [rbp + 0x4d0]
mov qword [rbp + 0x488], rax
jmp 0x180014a44
lea rcx, [rbp + 0x480]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
movups xmm0, xmmword [0x18007fe00]
mov rcx, qword [rbp + 0x50]
movdqu xmmword [rbp + 0x490], xmm0
test rcx, rcx
je 0x180014a86
lea rdx, str..Manifest
call qword [sym.imp.ntdll.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x180014a86
mov eax, 0xffee
mov dword [rbp - 0x40], 0x12
add word [rbp + 0x470], ax
lea r8, [rbp + 0x470]
mov edx, 3
lea rcx, [rbp + 0x120]
call qword [sym.imp.ntdll.dll_RtlMultiAppendUnicodeStringBuffer]
nop dword [rax + rax]
mov ebx, eax
mov r13, r14
test eax, eax
js 0x180014633
movups xmm0, xmmword [rbp - 0x18]
lea r8, [rbp + 0x470]
mov edx, 3
lea rcx, [rbp + 0x158]
movd eax, xmm0
movdqu xmmword [rbp + 0x470], xmm0
sub ax, word [rbp - 0x40]
mov word [rbp + 0x470], ax
call qword [sym.imp.ntdll.dll_RtlMultiAppendUnicodeStringBuffer]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x180014633
xor r13d, r13d
test r12d, r12d
je 0x180014b8f
movups xmm0, xmmword [rbp]
lea r8, [rbp + 0x4a0]
movups xmm1, xmmword [rbp + 0x480]
lea edx, [r13 + 3]
movdqu xmmword [rbp + 0x4a0], xmm0
lea rcx, [rbp + 0x190]
movups xmm0, xmmword [0x18007fe10]
movdqu xmmword [rbp + 0x4b0], xmm1
movdqu xmmword [rbp + 0x4c0], xmm0
call qword [sym.imp.ntdll.dll_RtlMultiAppendUnicodeStringBuffer]
nop dword [rax + rax]
mov ebx, eax
mov r13, r14
test eax, eax
js 0x180014633
movups xmm0, xmmword [rbp - 0x18]
lea r8, [rbp + 0x4a0]
mov edx, 3
lea rcx, [rbp + 0x1c8]
movdqu xmmword [rbp + 0x4a0], xmm0
call qword [sym.imp.ntdll.dll_RtlMultiAppendUnicodeStringBuffer]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x180014633
xor r13d, r13d
call fcn.180025fa4
test eax, eax
je 0x180014ba0
bts dword [rbp + 0x270], 0xc
mov rax, qword gs:[0x30]
cmp dword [rax + 0x179c], r13d
mov eax, dword [rbp + 0x270]
je 0x180014bc2
bts eax, 0xd
mov dword [rbp + 0x270], eax
mov ecx, 0x3000
and eax, ecx
cmp eax, ecx
jne 0x180014bde
call fcn.180025f40
test eax, eax
je 0x180014bde
bts dword [rbp + 0x270], 0xe
test r12d, r12d
je 0x180014bec
test byte [rbp - 0x28], 1
mov ecx, r13d
jne 0x180014bf1
mov ecx, 1
mov r11, qword [rsi + 0x20]
lea r9, [rbp + 0x2c0]
cmp r11, 1
lea r10, [rbp + 0xd0]
mov eax, r12d
lea r8, [rbp + 0x70]
cmovne r9, r13
lea rbx, [rbp + 0x80]
mov qword [rsp + 0x80], r9
cmovne r10, r13
cmovne r8, r13
neg eax
lea rax, [rbp + 0x60]
sbb rdx, rdx
and rdx, rax
lea rax, [rbp + 0x60]
test r12d, r12d
cmovne rax, rbx
neg ecx
sbb rcx, rcx
and rcx, rax
lea rax, [rbp + 0x288]
mov qword [rsp + 0x78], rax
lea rax, [rbp + 0x270]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], r10
mov qword [rsp + 0x60], r8
xor r8d, r8d
mov qword [rsp + 0x58], r11
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
call fcn.18001501c
mov ecx, dword [rbp + 0x270]
mov ebx, eax
test ecx, ecx
jne 0x180014d03
test eax, eax
jns 0x180014cdd
cmp eax, 0xc0000034
je 0x180014cdd
add eax, 0x3fffff77
cmp eax, edi
jbe 0x180014cdd
cmp ebx, 0xc0000204
je 0x180014cdd
cmp ebx, 0xc0150002
je 0x180014cdd
cmp ebx, 0xc0150004
je 0x180014cdd
cmp ebx, 0xc000000f
je 0x180014cdd
mov edi, r13d
lea r9, str.BasepCreateActCtx
mov edx, edi
lea r8, str.SXS:__s___BasepSxsCreateStreams___failed_n
mov ecx, 0x33
call qword [sym.imp.ntdll.dll_DbgPrintEx]
nop dword [rax + rax]
jmp 0x180014630
test dil, cl
jne 0x180014d1b
mov ecx, ebx
call fcn.180015258
mov ecx, dword [rbp + 0x270]
test eax, eax
cmovne ebx, r13d
test ebx, ebx
jns 0x180014d2f
cmp ebx, 0xc0000034
je 0x180014cdd
lea eax, [rbx + 0x3fffff77]
jmp 0x180014cb6
cmp qword [rsi + 0x20], 1
mov r12, r15
mov r13, r14
je 0x180014d4b
mov rax, qword [rbp + 0x70]
movups xmm0, xmmword [rax]
movdqu xmmword [rbp + 0x2c8], xmm0
xor r14d, r14d
test cl, 8
jne 0x180014e2b
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x180014d69
mov qword [rbp - 0x30], rcx
jmp 0x180014e1b
lea rax, [rbp - 0x18]
mov dword [rsp + 0x28], 0x60
xorps xmm0, xmm0
mov qword [rbp + 0x20], rax
lea r9, [rbp + 0xf0]
mov dword [rbp + 0x10], 0x30
lea r8, [rbp + 0x10]
mov qword [rbp + 0x18], r14
mov edx, 0x120089
mov dword [rbp + 0x28], 0x40
lea rcx, [rbp - 0x30]
mov dword [rsp + 0x20], 5
movdqu xmmword [rbp + 0x30], xmm0
call qword [sym.imp.ntdll.dll_NtOpenFile]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x180014e10
cmp eax, 0xc0000034
je 0x180014636
add eax, 0x3fffff77
cmp eax, edi
jbe 0x180014636
cmp ebx, 0xc0000204
je 0x180014636
cmp ebx, 0xc0150002
je 0x180014636
cmp ebx, 0xc0150004
je 0x180014636
cmp ebx, 0xc000000f
je 0x180014636
xor edx, edx
jmp 0x180014319
mov rcx, qword [rbp - 0x30]
mov dword [rbp - 0x38], 1
call fcn.18000e1e0
test eax, eax
jne 0x180014e2b
or dword [rbp + 0x270], 0x40
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x20]
test dword [rax + 8], 0x8000
je 0x180014e4d
bts dword [rbp + 0x270], 7
lea rcx, [rbp + 0x270]
call fcn.18001c5f4
mov ebx, eax
test eax, eax
jns 0x180014ea5
cmp eax, 0xc0000022
je 0x180014e99
cmp eax, 0xc0000034
je 0x180014e99
add eax, 0x3fffff77
cmp eax, edi
jbe 0x180014e99
cmp ebx, 0xc0000204
je 0x180014e99
cmp ebx, 0xc0150002
je 0x180014e99
cmp ebx, 0xc0150004
je 0x180014e99
cmp ebx, 0xc000000f
je 0x180014e99
mov edi, r14d
lea r8, str.SXS:__s___Calling_csrss_server_failed._Status__0x_x_n
jmp 0x180014417
mov ebx, r14d
jmp 0x180014636
xor edx, edx
mov qword [rsp + 0x20], rax
lea r9, str.BasepCreateActCtx
lea r8, str.SXS:__s___empty_lpSource__ls_n
lea ecx, [rdx + 0x33]
call qword [sym.imp.ntdll.dll_DbgPrintEx]
nop dword [rax + rax]
jmp 0x18001418b