Function at 0x18003db34
Capabilities:
Check if file exists
Check os version
Get file attributes
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x370
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rsp + 0x360], rax
mov qword [rsp + 0x128], r9
mov rsi, r8
mov ebx, ecx
mov qword [r11 - 0x2b0], rdx
mov rcx, qword [rsp + 0x3d0]
mov qword [rsp + 0x108], rcx
mov rdi, qword [rsp + 0x3d8]
mov rax, qword [rsp + 0x3e0]
mov qword [rsp + 0x130], rax
mov r13, qword [rsp + 0x3f0]
mov rdx, qword [rsp + 0x3f8]
mov qword [rsp + 0x110], rdx
xor r12d, r12d
movsd xmm0, qword [str..pif]
movsd qword [rsp + 0x140], xmm0
movzx eax, word [0x180088898]
mov word [rsp + 0x148], ax
mov qword [r11 - 0x2a8], r12
mov qword [r11 - 0x290], r12
test rcx, rcx
je 0x18003ef4a
mov eax, 0x8000
cmp word [rcx], ax
ja 0x18003ef4a
mov qword [r11 - 0x318], r12
mov qword [r11 - 0x320], r12
mov qword [r11 - 0x308], r12
mov qword [rsp + 0x78], r12
mov word [rsp + 0x70], r12w
mov qword [r11 - 0x2e8], r12
mov word [r11 - 0x2f0], r12w
mov qword [r11 - 0x2f8], r12
mov word [r11 - 0x300], r12w
mov qword [r11 - 0x2d8], r12
mov word [r11 - 0x2e0], r12w
mov qword [r11 - 0x2c8], r12
mov word [r11 - 0x2d0], r12w
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x68], r12
and ebx, 0xfffffff0
mov dword [rsp + 0xf4], ebx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x20]
cmp qword [rcx + 0x10], r12
je 0x18003dc90
test byte [rsp + 0x3e8], 0x10
jne 0x18003dc90
mov byte [rsp + 0x34], r12b
lea r15d, [r12 + 1]
jmp 0x18003dc9b
mov r15d, 1
mov byte [rsp + 0x34], r15b
cmp ebx, 0x10
jne 0x18003ddc6
mov rcx, qword gs:[0x60]
test r13, r13
je 0x18003dcd9
test dword [r13 + 0x3c], 0x100
je 0x18003dcd9
mov rax, qword [r13 + 0x50]
mov qword [rdi + 0x60], rax
mov rax, qword [r13 + 0x58]
mov qword [rdi + 0x68], rax
mov rax, qword [r13 + 0x60]
mov qword [rdi + 0x70], rax
jmp 0x18003dd93
mov rax, qword [rcx + 0x20]
mov r8, qword [rax + 0x20]
mov qword [rdi + 0x60], r8
mov rax, qword [rcx + 0x20]
mov rdx, qword [rax + 0x28]
mov qword [rdi + 0x68], rdx
mov rax, qword [rcx + 0x20]
mov rdx, qword [rax + 0x30]
mov qword [rdi + 0x70], rdx
mov rax, qword [rcx + 0x20]
test dword [rax + 0xa4], 0x600
je 0x18003dd93
test r8, r8
je 0x18003dd35
lea rdx, [rsp + 0xe8]
mov rcx, r8
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_GetHandleInformation]
nop dword [rax + rax]
test eax, eax
jne 0x18003dd35
mov qword [rdi + 0x60], r12
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x18003dd68
lea rdx, [rsp + 0xe8]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_GetHandleInformation]
nop dword [rax + rax]
test eax, eax
jne 0x18003dd68
mov rax, qword [rdi + 0x68]
cmp qword [rdi + 0x70], rax
jne 0x18003dd64
mov qword [rdi + 0x70], r12
mov qword [rdi + 0x68], r12
mov rcx, qword [rdi + 0x70]
test rcx, rcx
je 0x18003dd93
cmp rcx, qword [rdi + 0x68]
je 0x18003dd93
lea rdx, [rsp + 0xe8]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_GetHandleInformation]
nop dword [rax + rax]
test eax, eax
jne 0x18003dd93
mov qword [rdi + 0x70], r12
mov rcx, qword [rdi + 0x60]
call fcn.18003fa2c
test al, al
je 0x18003dda4
mov qword [rdi + 0x60], r12
mov rcx, qword [rdi + 0x68]
call fcn.18003fa2c
test al, al
je 0x18003ddb5
mov qword [rdi + 0x68], r12
mov rcx, qword [rdi + 0x70]
call fcn.18003fa2c
test al, al
je 0x18003ddc6
mov qword [rdi + 0x70], r12
lea eax, [rbx - 0x40]
test eax, 0xffffffbf
movzx eax, byte [rsp + 0x34]
cmove eax, r15d
mov byte [rsp + 0x34], al
mov ecx, 0x20
lea r14d, [rcx - 0x1e]
mov rax, qword [rsp + 0xf8]
cmp word [rax], cx
je 0x18003ef3a
cmp word [rax], 9
je 0x18003ef3a
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x18003de03
mov dword [rsp + 0x38], ecx
lea ebx, [rcx + 0x105]
mov dword [rsp + 0xec], ebx
call qword [sym.imp.KERNELBASE.dll_KernelBaseGetGlobalData]
nop dword [rax + rax]
mov edx, dword [rax]
mov r8d, ebx
add r8, r8
add edx, 0x200000
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rsp + 0x90], rax
test rax, rax
jne 0x18003de6b
mov dword [rsp + 0x30], 0xc0000017
jmp 0x18003edbd
mov r8d, dword [rsp + 0xec]
mov rbx, qword [rsp + 0x90]
mov rdx, rbx
mov rcx, qword [rsp + 0xf8]
call sym.KERNEL32.dll_GetShortPathNameW
mov dword [rsp + 0x3c], eax
test eax, eax
je 0x18003edb5
cmp eax, dword [rsp + 0xec]
ja 0x18003edb5
mov rdx, rbx
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov r8b, r15b
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x98]
call qword [sym.imp.ntdll.dll_RtlUnicodeStringToOemString]
nop dword [rax + rax]
mov dword [rsp + 0x30], eax
test eax, eax
js 0x18003edbd
movzx edx, word [rsp + 0x98]
mov dword [rsp + 0x3c], edx
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x120], rcx
mov ebx, r15d
mov dword [rsp + 0xf0], ebx
mov eax, edx
dec edx
mov dword [rsp + 0x3c], edx
test eax, eax
je 0x18003df38
cmp byte [rcx], 0x2e
je 0x18003df38
cmp byte [rcx], 0x5c
jne 0x18003df21
mov ebx, r15d
jmp 0x18003df24
add ebx, r15d
mov dword [rsp + 0xf0], ebx
add rcx, r15
mov qword [rsp + 0x120], rcx
jmp 0x18003df06
or rdx, 0xffffffffffffffff
mov rax, rdx
mov rcx, qword [rsp + 0xf8]
inc rax
cmp word [rcx + rax*2], r12w
jne 0x18003df47
mov dword [rsp + 0x38], eax
mov r8d, 0x22
cmp r8w, word [rsi]
jne 0x18003df81
add rsi, r14
mov qword [rsp + 0x48], rsi
movzx eax, word [rsi]
test ax, ax
je 0x18003dfb6
add rsi, r14
mov qword [rsp + 0x48], rsi
cmp r8w, ax
je 0x18003dfb6
jmp 0x18003df69
mov r12d, eax
mov rax, rdx
xor edx, edx
inc rax
cmp word [rsi + rax*2], dx
jne 0x18003df89
cmp r12, rax
ja 0x18003dfc4
mov r8, r12
mov rdx, rsi
call qword [sym.imp.ntdll.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x18003dfbe
lea rsi, [rsi + r12*2]
mov qword [rsp + 0x48], rsi
mov r12d, 0x20
jmp 0x18003e02d
mov r8d, 0x22
mov qword [rsp + 0x48], rsi
movzx eax, word [rsi]
cmp ax, 9
je 0x18003eda8
mov r12d, 0x20
cmp ax, r12w
je 0x18003eda8
cmp ax, r8w
jne 0x18003e00c
add rsi, r14
mov qword [rsp + 0x48], rsi
movzx eax, word [rsi]
test ax, ax
je 0x18003dfb6
add rsi, r14
mov qword [rsp + 0x48], rsi
cmp ax, r8w
je 0x18003dfb6
jmp 0x18003dff4
movabs rcx, 0x100000201
cmp ax, r12w
ja 0x18003ed98
movzx eax, ax
bt rcx, rax
jae 0x18003ed98
cmp word [rsi], 9
je 0x18003ed8b
cmp word [rsi], r12w
je 0x18003ed8b
or rax, 0xffffffffffffffff
xor r12d, r12d
inc rax
cmp word [rsi + rax*2], r12w
jne 0x18003e048
mov dword [rsp + 0x3c], eax
add ax, ax
mov word [rsp + 0x58], ax
add ax, r14w
mov word [rsp + 0x5a], ax
mov qword [rsp + 0x60], rsi
mov r8b, r15b
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntdll.dll_RtlUnicodeStringToOemString]
nop dword [rax + rax]
mov dword [rsp + 0x30], eax
test eax, eax
js 0x18003edbd
mov ecx, 0x80
sub ecx, ebx
movzx eax, word [rsp + 0x80]
cmp eax, ecx
jb 0x18003e0b4
mov dword [rsp + 0x30], 0xc000000d
jmp 0x18003edc0
call qword [sym.imp.KERNELBASE.dll_KernelBaseGetGlobalData]
nop dword [rax + rax]
mov edx, dword [rax]
add edx, 0x200000
mov rcx, qword gs:[0x60]
mov r12d, 0x208
mov r8d, r12d
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rsp + 0x50], rax
xor ebx, ebx
test rax, rax
je 0x18003de5e
call qword [sym.imp.KERNELBASE.dll_KernelBaseGetGlobalData]
nop dword [rax + rax]
mov edx, dword [rax]
add edx, 0x200000
mov rcx, qword gs:[0x60]
mov r8d, r12d
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rsp + 0x68], rax
test rax, rax
je 0x18003de5e
mov r12d, 0x104
cmp dword [rsp + 0xf4], 0x20
jne 0x18003e165
lea r8, str.wowexec.pif
mov edx, r12d
mov rcx, qword [rsp + 0x50]
call fcn.18000b370
mov dword [rsp + 0x38], ebx
jmp 0x18003e22e
cmp dword [rsp + 0x38], r12d
jb 0x18003e179
mov dword [rsp + 0x30], 0xc000000d
jmp 0x18003edbd
mov r8, qword [rsp + 0xf8]
mov rdx, r12
mov rsi, qword [rsp + 0x50]
mov rcx, rsi
call fcn.18000b370
mov edx, 0x2e
mov rcx, rsi
call qword [sym.imp.ntdll.dll_wcsrchr]
nop dword [rax + rax]
mov qword [rsp + 0x48], rax
test rax, rax
je 0x18003e16c
mov rcx, rsi
sub rcx, rax
sar rcx, 1
add rcx, r12
cmp rcx, 5
jb 0x18003e16c
lea r8, [rsp + 0x140]
mov edx, 0xa
mov rcx, rax
call fcn.1800179d8
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
mov dword [rsp + 0x38], eax
cmp eax, 0xffffffff
je 0x18003e21f
test al, 0x10
jne 0x18003e21f
or rbx, 0xffffffffffffffff
xor eax, eax
inc rbx
cmp word [rsi + rbx*2], ax
jne 0x18003e1f8
add ebx, r15d
mov dword [rsp + 0x38], ebx
mov r9d, ebx
mov r8, qword [rsp + 0x50]
mov rdx, r12
mov rcx, qword [rsp + 0x68]
call fcn.180007094
jmp 0x18003e223
mov dword [rsp + 0x38], ebx
xor r10d, r10d
test ebx, ebx
jne 0x18003e307
mov edx, 0x5c
mov rsi, qword [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_wcsrchr]
nop dword [rax + rax]
mov rdx, rax
mov qword [rsp + 0x48], rax
xor r10d, r10d
test rax, rax
jne 0x18003e274
lea edx, [rax + 0x3a]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_wcsrchr]
nop dword [rax + rax]
mov rdx, rax
mov qword [rsp + 0x48], rax
xor r10d, r10d
mov rax, rdx
add rdx, r14
mov qword [rsp + 0x48], rdx
test rax, rax
je 0x18003e2b7
movabs r9, 0x100000201
movzx r8d, word [rdx]
mov eax, 0x20
cmp r8w, ax
ja 0x18003e3a7
bt r9, r8
jae 0x18003e3a7
mov ecx, ebx
mov rax, qword [rsp + 0x50]
mov word [rax + rcx*2], r10w
test ebx, ebx
je 0x18003e2fe
mov qword [rsp + 0x28], r10
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, r12d
lea r8, [rsp + 0x140]
mov rdx, qword [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SearchPathW]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x38], eax
cmp eax, r12d
jae 0x18003de5e
xor r10d, r10d
test eax, eax
jne 0x18003e307
mov rax, qword [rsp + 0x68]
mov word [rax], r10w
mov rsi, qword [rsp + 0x128]
test rsi, rsi
jne 0x18003e425
lea rdx, [rsp + 0x150]
mov esi, 0x20a
mov ecx, esi
call qword [sym.imp.ntdll.dll_RtlGetCurrentDirectory_U]
nop dword [rax + rax]
mov dword [rsp + 0x3c], eax
mov ecx, eax
and rcx, 0xfffffffffffffffe
cmp rcx, rsi
jae 0x18003e420
xor r12d, r12d
mov word [rsp + rcx + 0x150], r12w
mov ebx, 0x105
mov r8d, ebx
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x150]
call sym.KERNEL32.dll_GetShortPathNameW
mov ecx, eax
mov dword [rsp + 0x3c], eax
cmp eax, ebx
ja 0x18003edc0
test eax, eax
jne 0x18003e3c7
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
movzx ecx, word [rsp + 0x58]
shr ecx, 1
mov dword [rsp + 0x3c], ecx
jmp 0x18003e3e1
mov ecx, ebx
mov rax, qword [rsp + 0x50]
mov word [rax + rcx*2], r8w
add ebx, r15d
mov dword [rsp + 0x38], ebx
add rdx, r14
mov qword [rsp + 0x48], rdx
jmp 0x18003e28e
add ax, ax
mov word [rsp + 0x58], ax
lea rax, [rsp + 0x150]
mov qword [rsp + 0x60], rax
mov word [rsp + 0x5a], si
lea eax, [rcx - 2]
cmp eax, 0x40
ja 0x18003e408
mov r8b, r15b
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntdll.dll_RtlUnicodeStringToAnsiString]
nop dword [rax + rax]
mov dword [rsp + 0x30], eax
jmp 0x18003e410
mov dword [rsp + 0x30], 0xc000000d
cmp dword [rsp + 0x30], r12d
jge 0x18003e4e3
jmp 0x18003edc0
call fcn.180024840
xor r9d, r9d
lea r8, [rsp + 0x150]
mov ebx, 0x105
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFullPathNameW]
nop dword [rax + rax]
mov dword [rsp + 0x3c], eax
lea ecx, [rax - 1]
cmp ecx, r12d
ja 0x18003e46e
mov r8d, ebx
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x150]
call sym.KERNEL32.dll_GetShortPathNameW
mov dword [rsp + 0x3c], eax
xor r12d, r12d
cmp eax, ebx
ja 0x18003edc0
test eax, eax
je 0x18003e49e
lea rcx, [rsp + 0x150]
mov qword [rsp + 0x60], rcx
add ax, ax
mov word [rsp + 0x58], ax
mov esi, 0x20a
mov word [rsp + 0x5a], si
jmp 0x18003e4b2
mov rdx, rsi
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov r8b, r15b
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntdll.dll_RtlUnicodeStringToAnsiString]
nop dword [rax + rax]
mov dword [rsp + 0x30], eax
test eax, eax
js 0x18003edc0
cmp word [rsp + 0x70], 0x42
ja 0x18003e0a7
mov rax, qword [rsp + 0x78]
movsx ecx, byte [rax]
cmp byte [rax], 0x5a
jg 0x18003e4f6
sub cx, 0x41
jmp 0x18003e4fa
sub cx, 0x61
mov word [rdi + 0xec], cx
test r13, r13
je 0x18003e5b5
test dword [r13 + 0x3c], 0x200
je 0x18003e5b5
mov rcx, qword [r13 + 8]
test rcx, rcx
je 0x18003e531
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r12w
jne 0x18003e525
jmp 0x18003e534
mov rax, r12
lea ebx, [rax*2 + 0x2a]
call qword [sym.imp.KERNELBASE.dll_KernelBaseGetGlobalData]
nop dword [rax + rax]
mov edx, dword [rax]
mov esi, ebx
add edx, 0x200000
mov rcx, qword gs:[0x60]
mov r8d, ebx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
mov qword [rsp + 0x100], rax
test rax, rax
je 0x18003e5b5
lea rcx, [0x180085644]
cmp qword [r13 + 8], r12
cmovne rcx, qword [r13 + 8]
mov qword [rsp + 0x20], rcx
mov r9d, dword [r13 + 0x50]
lea r8, str.hotkey._u__s
mov edx, esi
mov rcx, rax
call fcn.180017918
btr dword [r13 + 0x3c], 9
mov qword [r13 + 0x50], r12
mov qword [r13 + 8], rbx
mov dword [rsp + 0x40], r14d
movzx ebx, word [rsp + 0x80]
add ebx, 6
mov ecx, 0xfffffffc
and ebx, ecx
mov dword [rsp + 0x38], ebx
movzx eax, word [rsp + 0x98]
add eax, 4
and eax, ecx
add ebx, eax
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x108]
cmp word [rax], r12w
mov r12d, 3
je 0x18003e60d
mov r14d, r12d
mov dword [rsp + 0x40], r12d
movzx eax, word [rax]
add eax, r12d
and eax, ecx
add ebx, eax
mov dword [rsp + 0x38], ebx
movzx eax, word [rsp + 0x70]
xor esi, esi
test ax, ax
je 0x18003e62c
add r14d, r15d
mov dword [rsp + 0x40], r14d
add eax, 4
and eax, ecx
add ebx, eax
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x68]
cmp word [rax], si
je 0x18003e68e
add r14d, r15d
mov dword [rsp + 0x40], r14d
mov rdx, rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov r8b, r15b
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0xa8]
call qword [sym.imp.ntdll.dll_RtlUnicodeStringToAnsiString]
nop dword [rax + rax]
mov dword [rsp + 0x30], eax
test eax, eax
js 0x18003edbd
movzx eax, word [rsp + 0xa8]
add eax, 4
and eax, 0xfffffffc
add ebx, eax
mov dword [rsp + 0x38], ebx
test r13, r13
je 0x18003e7c0
add ebx, 0x68
mov dword [rsp + 0x38], ebx
add r14d, r15d
mov dword [rsp + 0x40], r14d
mov rdx, qword [r13 + 0x10]
test rdx, rdx
je 0x18003e704
add r14d, r15d
mov dword [rsp + 0x40], r14d
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov r8b, r15b
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0xb8]
call qword [sym.imp.ntdll.dll_RtlUnicodeStringToAnsiString]
nop dword [rax + rax]
mov dword [rsp + 0x30], eax
test eax, eax
js 0x18003edbd
movzx eax, word [rsp + 0xb8]
add eax, 4
and eax, 0xfffffffc
add ebx, eax
mov dword [rsp + 0x38], ebx
mov rdx, qword [r13 + 0x18]
test rdx, rdx
je 0x18003e762
add r14d, r15d
mov dword [rsp + 0x40], r14d
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov r8b, r15b
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0xc8]
call qword [sym.imp.ntdll.dll_RtlUnicodeStringToOemString]
nop dword [rax + rax]
mov dword [rsp + 0x30], eax
test eax, eax
js 0x18003edbd
movzx eax, word [rsp + 0xc8]
add eax, 4
and eax, 0xfffffffc
add ebx, eax
mov dword [rsp + 0x38], ebx
mov rdx, qword [r13 + 8]
test rdx, rdx
je 0x18003e7c0
add r14d, r15d
mov dword [rsp + 0x40], r14d
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov r8b, r15b
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0xd8]
call qword [sym.imp.ntdll.dll_RtlUnicodeStringToAnsiString]
nop dword [rax + rax]
mov dword [rsp + 0x30], eax
test eax, eax
js 0x18003edbd
movzx eax, word [rsp + 0xd8]
add eax, 4
and eax, 0xfffffffc
add ebx, eax
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x110]
test rax, rax
je 0x18003e7f4
add r14d, r15d
mov dword [rsp + 0x40], r14d
lea rdx, [rsp + 0x118]
mov rcx, rax
call fcn.18003f93c
test eax, eax
js 0x18003e16c
add ebx, 8
mov dword [rsp + 0x38], ebx
mov edx, ebx
mov ecx, r14d
call qword [sym.imp.ntdll.dll_CsrAllocateCaptureBuffer]
nop dword [rax + rax]
mov rsi, rax
xor r14d, r14d
test rax, rax
je 0x18003de5e
lea rbx, [rdi + 0x80]
movzx edx, word [rsp + 0x80]
add edx, 6
and edx, 0xfffffffc
mov r8, rbx
mov rcx, rax
call qword [sym.imp.ntdll.dll_CsrAllocateMessagePointer]
nop dword [rax + rax]
movzx r8d, word [rsp + 0x80]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rbx]
call sym.KERNEL32.dll_RtlMoveMemory
movzx ecx, word [rsp + 0x80]
mov rax, qword [rbx]
mov byte [rcx + rax], 0xd
movzx ecx, word [rsp + 0x80]
mov rax, qword [rbx]
mov byte [rcx + rax + 1], 0xa
movzx ecx, word [rsp + 0x80]
mov rax, qword [rbx]
mov byte [rcx + rax + 2], r14b
movzx eax, word [rsp + 0x80]
add ax, r12w
mov word [rdi + 0xe4], ax
lea rbx, [rdi + 0x88]
movzx edx, word [rsp + 0x98]
add edx, 4
and edx, 0xfffffffc
mov r8, rbx
mov rcx, rsi
call qword [sym.imp.ntdll.dll_CsrAllocateMessagePointer]
nop dword [rax + rax]
movzx r8d, word [rsp + 0x98]
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rbx]
call sym.KERNEL32.dll_RtlMoveMemory
movzx ecx, word [rsp + 0x98]
mov rax, qword [rbx]
mov byte [rcx + rax], r14b
movzx eax, word [rsp + 0x98]
add ax, r15w
mov word [rdi + 0xe6], ax
lea rax, [rdi + 0x90]
cmp qword [rsp + 0xb0], r14
je 0x18003e96e
movzx edx, word [rsp + 0xa8]
add edx, 4
and edx, 0xfffffffc
mov r8, rax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_CsrAllocateMessagePointer]
nop dword [rax + rax]
movzx r8d, word [rsp + 0xa8]
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rdi + 0x90]
call sym.KERNEL32.dll_RtlMoveMemory
movzx ecx, word [rsp + 0xa8]
mov rax, qword [rdi + 0x90]
mov byte [rcx + rax], r14b
movzx eax, word [rsp + 0xa8]
add ax, r15w
mov word [rdi + 0xe8], ax
jmp 0x18003e979
mov word [rdi + 0xe8], r14w
mov qword [rax], r14
lea rax, [rdi + 0xa0]
mov rbx, qword [rsp + 0x108]
cmp word [rbx], r14w
mov r14d, 0xfffffffc
je 0x18003e9d1
movzx edx, word [rbx]
add edx, r12d
and edx, r14d
mov r8, rax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_CsrAllocateMessagePointer]
nop dword [rax + rax]
movzx r8d, word [rbx]
mov rdx, qword [rbx + 8]
mov rcx, qword [rdi + 0xa0]
call sym.KERNEL32.dll_RtlMoveMemory
movzx eax, word [rbx]
mov dword [rdi + 0xa8], eax
xor r12d, r12d
jmp 0x18003e9de
xor r12d, r12d
mov dword [rdi + 0xa8], r12d
mov qword [rax], r12
lea rax, [rdi + 0x98]
movzx ecx, word [rsp + 0x70]
test cx, cx
je 0x18003ea40
lea edx, [rcx + 4]
and edx, r14d
mov r8, rax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_CsrAllocateMessagePointer]
nop dword [rax + rax]
movzx r8d, word [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rdi + 0x98]
call sym.KERNEL32.dll_RtlMoveMemory
movzx ecx, word [rsp + 0x70]
mov rax, qword [rdi + 0x98]
mov byte [rcx + rax], r12b
movzx eax, word [rsp + 0x70]
add ax, r15w
mov word [rdi + 0xea], ax
jmp 0x18003ea4b
mov qword [rax], r12
mov word [rdi + 0xea], r12w
lea rax, [rdi + 0xb0]
test r13, r13
je 0x18003eb01
mov r8, rax
mov edx, 0x68
mov rcx, rsi
call qword [sym.imp.ntdll.dll_CsrAllocateMessagePointer]
nop dword [rax + rax]
mov ecx, dword [r13 + 0x20]
mov rax, qword [rdi + 0xb0]
mov dword [rax + 0x20], ecx
mov ecx, dword [r13 + 0x24]
mov rax, qword [rdi + 0xb0]
mov dword [rax + 0x24], ecx
mov ecx, dword [r13 + 0x28]
mov rax, qword [rdi + 0xb0]
mov dword [rax + 0x28], ecx
mov ecx, dword [r13 + 0x2c]
mov rax, qword [rdi + 0xb0]
mov dword [rax + 0x2c], ecx
mov ecx, dword [r13 + 0x30]
mov rax, qword [rdi + 0xb0]
mov dword [rax + 0x30], ecx
mov ecx, dword [r13 + 0x34]
mov rax, qword [rdi + 0xb0]
mov dword [rax + 0x34], ecx
mov ecx, dword [r13 + 0x38]
mov rax, qword [rdi + 0xb0]
mov dword [rax + 0x38], ecx
mov ecx, dword [r13 + 0x3c]
mov rax, qword [rdi + 0xb0]
mov dword [rax + 0x3c], ecx
movzx ecx, word [r13 + 0x40]
mov rax, qword [rdi + 0xb0]
mov word [rax + 0x40], cx
mov rax, qword [rdi + 0xb0]
mov dword [rax], 0x68
jmp 0x18003eb04
mov qword [rax], r12
lea rax, [rdi + 0xb8]
cmp qword [rsp + 0xc0], r12
je 0x18003eb78
movzx edx, word [rsp + 0xb8]
add edx, 4
and edx, r14d
mov r8, rax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_CsrAllocateMessagePointer]
nop dword [rax + rax]
movzx r8d, word [rsp + 0xb8]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdi + 0xb8]
call sym.KERNEL32.dll_RtlMoveMemory
movzx ecx, word [rsp + 0xb8]
mov rax, qword [rdi + 0xb8]
mov byte [rcx + rax], r12b
movzx eax, word [rsp + 0xb8]
add eax, r15d
mov dword [rdi + 0xc0], eax
jmp 0x18003eb82
mov qword [rax], r12
mov dword [rdi + 0xc0], r12d
lea rax, [rdi + 0xc8]
cmp qword [rsp + 0xd0], r12
je 0x18003ebf6
movzx edx, word [rsp + 0xc8]
add edx, 4
and edx, r14d
mov r8, rax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_CsrAllocateMessagePointer]
nop dword [rax + rax]
movzx r8d, word [rsp + 0xc8]
mov rdx, qword [rsp + 0xd0]
mov rcx, qword [rdi + 0xc8]
call sym.KERNEL32.dll_RtlMoveMemory
movzx ecx, word [rsp + 0xc8]
mov rax, qword [rdi + 0xc8]
mov byte [rcx + rax], r12b
movzx eax, word [rsp + 0xc8]
add eax, r15d
mov dword [rdi + 0xd0], eax
jmp 0x18003ec00
mov qword [rax], r12
mov dword [rdi + 0xd0], r12d
lea rax, [rdi + 0xd8]
cmp qword [rsp + 0xe0], r12
je 0x18003ec74
movzx edx, word [rsp + 0xd8]
add edx, 4
and edx, r14d
mov r8, rax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_CsrAllocateMessagePointer]
nop dword [rax + rax]
movzx r8d, word [rsp + 0xd8]
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rdi + 0xd8]
call sym.KERNEL32.dll_RtlMoveMemory
movzx ecx, word [rsp + 0xd8]
mov rax, qword [rdi + 0xd8]
mov byte [rcx + rax], r12b
movzx eax, word [rsp + 0xd8]
add eax, r15d
mov dword [rdi + 0xe0], eax
jmp 0x18003ec7e
mov qword [rax], r12
mov dword [rdi + 0xe0], r12d
lea rax, [rdi + 0xf0]
cmp qword [rsp + 0x110], 0
je 0x18003ecbb
mov r8, rax
mov edx, 8
mov rcx, rsi
call qword [sym.imp.ntdll.dll_CsrAllocateMessagePointer]
nop dword [rax + rax]
mov rcx, qword [rdi + 0xf0]
mov rax, qword [rsp + 0x118]
mov qword [rcx], rax
jmp 0x18003ecbe
mov qword [rax], r12
mov ebx, dword [rsp + 0xf4]
mov eax, 0x20
cmp ebx, eax
jne 0x18003ecd5
or qword [rdi + 0x48], 0xffffffffffffffff
jmp 0x18003eceb
cmp byte [rsp + 0x34], r12b
je 0x18003ece2
mov qword [rdi + 0x48], r12
jmp 0x18003eceb
call fcn.1800202f0
mov qword [rdi + 0x48], rax
mov word [rdi + 0xee], r12w
mov dword [rdi + 0x50], ebx
call qword [sym.imp.api_ms_win_core_console_l1_1_0.dll_GetConsoleCP]
nop dword [rax + rax]
mov dword [rdi + 0x78], eax
mov eax, dword [rsp + 0x3e8]
mov dword [rdi + 0x7c], eax
mov r9d, 0xb8
mov r8d, 0x10010005
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ntdll.dll_CsrClientCallServer]
nop dword [rax + rax]
mov dword [rsp + 0x30], eax
cmp eax, 0xc0000022
jne 0x18003ed52
cmp dword [rdi + 0xc0], r12d
jne 0x18003ed52
mov rcx, rsi
call qword [sym.imp.ntdll.dll_CsrFreeCaptureBuffer]
nop dword [rax + rax]
jmp 0x18003edc0
mov rcx, rsi
call qword [sym.imp.ntdll.dll_CsrFreeCaptureBuffer]
nop dword [rax + rax]
cmp dword [rsp + 0x30], r12d
jl 0x18003ed82
cmp dword [rdi + 0x34], r12d
jl 0x18003ed82
mov eax, dword [rdi + 0x40]
mov rcx, qword [rsp + 0x130]
mov dword [rcx], eax
mov dword [rsp + 0x30], r12d
jmp 0x18003edc0
mov eax, dword [rdi + 0x34]
mov dword [rsp + 0x30], eax
jmp 0x18003edc0
add rsi, r14
mov qword [rsp + 0x48], rsi
jmp 0x18003e02d
add rsi, r14
mov qword [rsp + 0x48], rsi
movzx eax, word [rsi]
jmp 0x18003e016
add rsi, r14
mov qword [rsp + 0x48], rsi
jmp 0x18003dfc9
mov dword [rsp + 0x30], 0xc0000039
xor r12d, r12d
cmp qword [rsp + 0x50], r12
je 0x18003ede7
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x50]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
cmp qword [rsp + 0x68], r12
je 0x18003ee0e
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x68]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
cmp qword [rsp + 0x88], r12
je 0x18003ee2c
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntdll.dll_RtlFreeOemString]
nop dword [rax + rax]
cmp qword [rsp + 0xa0], r12
je 0x18003ee4a
lea rcx, [rsp + 0x98]
call qword [sym.imp.ntdll.dll_RtlFreeOemString]
nop dword [rax + rax]
cmp qword [rsp + 0xb0], r12
je 0x18003ee68
lea rcx, [rsp + 0xa8]
call qword [sym.imp.ntdll.dll_RtlFreeAnsiString]
nop dword [rax + rax]
cmp qword [rsp + 0x78], r12
je 0x18003ee80
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntdll.dll_RtlFreeAnsiString]
nop dword [rax + rax]
cmp qword [rsp + 0xc0], r12
je 0x18003ee9e
lea rcx, [rsp + 0xb8]
call qword [sym.imp.ntdll.dll_RtlFreeAnsiString]
nop dword [rax + rax]
cmp qword [rsp + 0xd0], r12
je 0x18003eebc
lea rcx, [rsp + 0xc8]
call qword [sym.imp.ntdll.dll_RtlFreeAnsiString]
nop dword [rax + rax]
cmp qword [rsp + 0xe0], r12
je 0x18003eeda
lea rcx, [rsp + 0xd8]
call qword [sym.imp.ntdll.dll_RtlFreeAnsiString]
nop dword [rax + rax]
cmp qword [rsp + 0x90], r12
je 0x18003ef07
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x90]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
cmp qword [rsp + 0x100], r12
je 0x18003ef34
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x100]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov eax, dword [rsp + 0x30]
jmp 0x18003ef59
add rax, r14
mov qword [rsp + 0xf8], rax
jmp 0x18003ddec
mov ecx, 0xc000000d
call sym.KERNEL32.dll_BaseSetLastNTError
mov eax, 0xc000000d
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.180024680
add rsp, 0x370
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret