Function at 0x1800173e0
Capabilities:
Access pe header
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
mov edx, 1
cmp edi, edx
jne 0x1800173fd
call fcn.1800246a4
mov edx, edi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x180017418
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x250
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, qword gs:[0x60]
xor r12d, r12d
mov r14d, edx
mov r15, rcx
mov dil, r12b
mov eax, edx
mov rbp, qword [rbx + 0x20]
test edx, edx
je 0x18001768d
cmp eax, 1
jne 0x180017647
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x180032610
lea rdx, [0x1800590e0]
lea rcx, [0x180058fe0]
call qword [sym.imp.ntdll.dll_RtlSetThreadPoolStartFunc]
nop dword [rax + rax]
mov r8, qword [sym.imp.api_ms_win_core_sidebyside_l1_1_0.dll_ReleaseActCtx]
lea rdx, [0x1800429b0]
lea rcx, [0x1800153f0]
call qword [sym.imp.ntdll.dll_LdrSetDllManifestProber]
nop dword [rax + rax]
mov edi, r14d
call fcn.180017880
movzx eax, word [rsi + 0x5c]
lea r13d, [r14 + 1]
sub ax, di
cmp ax, r13w
ja 0x180017725
cmp word [rsi + 0x48], 6
jb 0x180017725
mov eax, dword [rbx + 0x2c0]
lea rcx, [rsp + 0x40]
lea rdx, str.Windows
test eax, eax
je 0x1800176e3
mov qword [rsp + 0x28], rdx
lea r9, str.Sessions
mov edx, 0x200
mov dword [rsp + 0x20], eax
lea r8, str._ws_ld_ws
call fcn.180017918
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x98]
mov rax, qword gs:[0x60]
mov rdx, qword [rcx + 8]
sub rdx, qword [rax + 0x380]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x88]
add rax, rdx
mov qword [0x1800b2bf8], rax
lea rdx, [rax + 0x3a]
mov qword [0x1800b2bf0], rdx
test rdx, rdx
je 0x1800175a0
cmp qword [rbx + 0x2f0], r12
jne 0x1800175a0
lea rcx, [rbx + 0x2e8]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov rax, qword [0x1800b2bf8]
movups xmm0, xmmword [rax + 0x7f8]
movups xmmword [0x1800b2c10], xmm0
psrldq xmm0, 8
movq rcx, xmm0
mov qword [0x1800b2c18], rcx
test rcx, rcx
jne 0x180032618
mov qword [0x1800b2c18], r12
test dword [rbp + 8], 0x4000
je 0x180017743
cmp dword [rbp + 0xc], r12d
jne 0x18003263d
lea rax, [0x1800b2c00]
mov qword [0x1800b2c08], rax
mov qword [0x1800b2c00], rax
call qword [sym.imp.ntdll.dll_RtlGetSuiteMask]
nop dword [rax + rax]
test al, 0x10
je 0x18001762c
mov byte [rsp + 0x30], r12b
mov ebx, r12d
mov sil, r12b
call fcn.1800178d8
test eax, eax
je 0x18001777c
test sil, sil
jne 0x1800327a8
lea rcx, [section..data]
call fcn.18001bab4
mov rcx, r15
call qword [sym.imp.ntdll.dll_LdrDisableThreadCalloutsForDll]
nop dword [rax + rax]
mov edx, r14d
call fcn.18001779c
mov bl, al
test al, al
je 0x1800327c7
mov al, bl
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180024680
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rcx, qword [0x1800b2020]
lea rax, [sym.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x38], rax
lea rax, [sym.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x38], rax
lea rax, [sym.KERNEL32.dll_LoadLibraryExA]
mov qword [rsp + 0x38], rax
lea rax, [sym.KERNEL32.dll_LoadLibraryExW]
mov qword [rsp + 0x38], rax
mov dword [section..data], r12d
mov qword [0x1800b2020], r12
call qword [sym.imp.api_ms_win_eventing_provider_l1_1_0.dll_EventUnregister]
nop dword [rax + rax]
jmp 0x180017647
lea rax, [rsp + 0x40]
mov r8d, 0x100
sub rdx, rax
lea rax, [r8 + 0x7ffffefe]
test rax, rax
je 0x180017711
movzx eax, word [rdx + rcx]
test ax, ax
je 0x180017711
mov word [rcx], ax
add rcx, r13
sub r8, rdi
jne 0x1800176f1
test r8, r8
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r12w
jmp 0x18001752f
xor r8d, r8d
lea rcx, [0x180085cf8]
mov rdx, rdi
call qword [sym.imp.ntdll.dll_RtlSetProtectedPolicy]
nop dword [rax + rax]
jmp 0x1800174f4
mov r8d, 4
mov qword [rsp + 0x28], r12
lea rcx, [rbp + 0x60]
mov dword [rsp + 0x20], r8d
lea r9, [rsp + 0x34]
lea rdx, [0x180085d08]
call qword [sym.imp.ntdll.dll_LdrQueryImageFileExecutionOptions]
nop dword [rax + rax]
test eax, eax
js 0x1800175dc
jmp 0x18003262e
lea rcx, [rsp + 0x30]
call fcn.180017a60
test eax, eax
je 0x180017623
jmp 0x180032643
mov bl, r12b
jmp 0x180017659
sub rax, qword [rax + 0x9e8]
add rcx, rax
mov qword [0x1800b2c18], rcx
jmp 0x1800175cf
mov ecx, dword [rsp + 0x34]
call sym.KERNEL32.dll_SetSearchPathMode
nop
jmp 0x1800175dc
int3
call fcn.1800673e8
mov ebx, eax
call fcn.180017d4c
test eax, eax
mov eax, ebx
je 0x180032665
mov ecx, 0x2008
and eax, ecx
cmp eax, ecx
je 0x180032674
jmp 0x18001762c
mov ecx, 0x108
and eax, ecx
cmp eax, ecx
je 0x18001762c
xor edx, edx
lea rcx, str.tsappcmp.dll
mov r8d, 0x800
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
nop dword [rax + rax]
mov rbp, rax
test rax, rax
je 0x180017623
lea rdx, [0x18008ab78]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
lea rdx, [0x18008ab90]
mov rcx, rbp
mov qword [0x1800b2dd0], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
lea rdx, [0x18008aba8]
mov rcx, rbp
mov qword [0x1800b2dd8], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
lea rdx, [0x18008abc0]
mov rcx, rbp
mov qword [0x1800b2de0], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
lea rdx, [0x18008abd8]
mov rcx, rbp
mov qword [0x1800b2de8], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
lea rdx, [0x18008abf0]
mov rcx, rbp
mov qword [0x1800b2df0], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
lea rdx, [0x18008ac08]
mov rcx, rbp
mov qword [0x1800b2df8], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
lea rdx, [0x18008ac20]
mov rcx, rbp
mov qword [0x1800b2e00], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
lea rdx, [0x18008ac38]
mov rcx, rbp
mov qword [0x1800b2e08], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [0x1800b2e10], rax
mov sil, dil
jmp 0x180017623
cmp byte [rsp + 0x30], r12b
je 0x18001762c
mov ecx, ebx
call qword [sym.imp.KERNELBASE.dll_GetRegistryExtensionFlags]
nop dword [rax + rax]
nop
jmp 0x18001762c
test dil, dil
je 0x180017659
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_LdrSetDllManifestProber]
nop dword [rax + rax]
nop
jmp 0x180017659