Function at 0x180002dd0
Capabilities:
Check if file exists
Delete file
Enumerate threads
Extract resource via kernel32 functions
Get file attributes
Get file size
Link many functions at runtime
Move file
Read file on windows
Resume thread
Suspend thread
Write file on windows

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xfa0]
mov eax, 0x10a0
call fcn.18000d590
sub rsp, rax
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x10d0], rbx
mov qword [rsp + 0x10d8], rsi
mov qword [rsp + 0x10e0], rdi
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xf90], rax
mov byte [0x18001db38], 1
xor r14d, r14d
mov word [rbp + 0xb90], r14w
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0xb92]
call fcn.180009090
mov word [rbp + 0xd90], r14w
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0xd92]
call fcn.180009090
lea rcx, str.Loading_configuration..._r_n
call fcn.1800021c0
mov ecx, 0x400
call fcn.1800044f4
mov rbx, rax
mov qword [rsp + 0x50], r14
lea r8, [rsp + 0x50]
lea rdx, [0x180002280]
lea ecx, [r14 + 4]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov r8d, 0xff
lea rdx, [rbp + 0xb90]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, [rbp + 0xb90]
or rdi, 0xffffffffffffffff
mov rdx, rdi
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], r14w
jne 0x180002ec0
test edx, edx
je 0x18000300e
mov eax, edx
lea rcx, [rbp + 0xb90]
lea rcx, [rcx + rax*2]
nop
cmp word [rcx], 0x5c
je 0x180002ef3
sub rcx, 2
dec edx
jne 0x180002ee0
jmp 0x18000300e
lea eax, [rdx + 1]
lea rsi, [rbp + 0xb90]
lea rsi, [rsi + rax*2]
mov eax, 0xff
sub eax, edx
lea r8d, [rax + rax]
xor edx, edx
mov rcx, rsi
call fcn.180009090
mov rcx, r14
nop dword [rax]
movzx eax, word [rbp + rcx + 0xb90]
mov word [rbp + rcx + 0xd90], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x180002f20
lea rcx, [rbp + 0xd90]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], r14w
jne 0x180002f44
movups xmm0, xmmword [str.mulsesrv.upd.ini]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x180018118]
movups xmmword [rcx + 0x10], xmm1
movzx eax, word [0x180018128]
mov word [rcx + 0x20], ax
movups xmm0, xmmword [str.mulsesrv.ini]
movups xmmword [rsi], xmm0
movsd xmm1, qword [0x180018140]
movsd qword [rsi + 0x10], xmm1
lea rcx, [rbp + 0xd90]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18000300e
lea rcx, [rbp + 0xb90]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x180002fef
lea rdx, [rbp + 0xb90]
lea rcx, [rbp + 0xd90]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
lea r9, [rbp + 0xb90]
lea r8, [rbp + 0xd90]
mov rcx, rbx
test eax, eax
je 0x180002fe0
lea rdx, str.MoveFile_success___S_____S._r_n
call qword [sym.imp.USER32.dll_wsprintfA]
jmp 0x180003006
lea rdx, str.MoveFile_fail___S_____S._r_n
call qword [sym.imp.USER32.dll_wsprintfA]
jmp 0x180003006
lea r8, [rbp + 0xb90]
lea rdx, str.DeleteFile_fail___S._r_n
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfA]
mov rcx, rbx
call fcn.1800021c0
lea r8, [rbp + 0xb90]
lea rdx, str.Configuration_file:__S._r_n
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfA]
mov rcx, rbx
call fcn.1800021c0
mov rcx, rbx
call fcn.18000459c
mov ecx, 0x24
call fcn.1800044f4
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1800030ec
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov dword [rbx + 0x20], eax
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rax + 3]
lea rcx, [rbp + 0xb90]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800030ef
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rbx], eax
cmp eax, 0xffffffff
je 0x1800030ef
mov ecx, eax
call fcn.1800044f4
mov qword [rbx + 4], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x50]
mov r8d, dword [rbx]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800030ef
mov rcx, rbx
call fcn.180001010
mov rcx, rbx
call fcn.180001330
jmp 0x1800030ef
mov rbx, r14
mov qword [0x18001db70], rbx
test rbx, rbx
jne 0x180003156
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [rbx + 3]
lea rcx, str.mulsesrv.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800043a2
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea rdx, str.Error:_Failed_to_load_configuration._r_n
jmp 0x180004380
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp - 0x70]
call fcn.180009090
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp + 0x8f]
call fcn.180009090
lea r9, [rbp - 0x70]
lea r8, str.LogFile
lea rdx, str.Main
mov rcx, rbx
call fcn.180001850
test al, al
je 0x18000325a
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x790]
call fcn.180009090
lea rax, [rbp - 0x70]
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1800031c0
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x790]
call fcn.18000b270
lea rax, [rbp + 0x8f]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x1800031e4
lea rdx, [rbp + 0x8f]
lea rcx, [rbp + 0x88f]
call fcn.18000b270
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x990]
call fcn.180009090
mov r8d, 0xff
lea rdx, [rbp + 0x88f]
lea rcx, [rbp + 0x990]
call fcn.1800050b0
mov rcx, r14
lea rsi, str.mulsesrv.txt
nop dword [rax + rax]
movzx eax, word [rbp + rcx + 0x990]
mov word [rcx + rsi], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x180003240
jmp 0x1800032eb
mov qword [rsp + 0x50], r14
lea r8, [rsp + 0x50]
lea rdx, [0x180002280]
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov r8d, 0xff
lea rsi, str.mulsesrv.txt
mov rdx, rsi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rdx, rdi
inc rdx
cmp word [rsi + rdx*2], 0
jne 0x180003294
test edx, edx
je 0x1800032eb
mov eax, edx
lea rcx, [rsi + rax*2]
cmp word [rcx], 0x5c
je 0x1800032b8
sub rcx, 2
dec edx
jne 0x1800032a8
jmp 0x1800032eb
lea eax, [rdx + 1]
lea rbx, [rsi + rax*2]
mov eax, 0xff
sub eax, edx
lea r8d, [rax + rax]
xor edx, edx
mov rcx, rbx
call fcn.180009090
movups xmm0, xmmword [0x180018200]
movups xmmword [rbx], xmm0
movsd xmm1, qword [0x180018210]
movsd qword [rbx + 0x10], xmm1
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18000335b
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x50]
mov r8d, 0x1a
lea rdx, str.Initializing_mulsesrv..._r_n
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.termsrv.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x18001db68], rax
test rax, rax
jne 0x1800033d1
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [rax + 3]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800043a2
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, 0x24
lea rdx, str.Error:_Failed_to_load_t.s_library._r_n
jmp 0x180004386
lea rdx, [0x180018280]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18001db48], rax
lea rdx, [0x180018290]
mov rcx, qword [0x18001db68]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18001db40], rax
mov ecx, 0x1000
call fcn.1800044f4
mov rbx, rax
mov rcx, qword [0x18001db40]
mov r8, qword [0x18001db68]
sub rcx, r8
mov r9, qword [0x18001db48]
sub r9, r8
mov qword [rsp + 0x20], rcx
lea rdx, str.Base_addr:__0x_p_r_nSvcMain:____t.s.dll0x_p_r_nSvcGlobals:_t.s.dll0x_p_r_n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov rcx, rbx
call fcn.1800021c0
mov rcx, rbx
call fcn.18000459c
lea rcx, str.termsrv.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x180004332
mov edx, 1
lea r8d, [rdx + 0xf]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x180004332
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x180004332
mov edx, dword [rax + 0x30]
mov dword [0x18001db50], edx
movzx ecx, word [rax + 0x36]
mov word [0x18001db54], cx
movzx eax, word [rax + 0x34]
mov word [0x18001db56], ax
shr edx, 0x10
movzx r15d, dl
shl r15w, 8
movzx eax, byte [0x18001db50]
or r15w, ax
je 0x180004332
mov ecx, 0x400
call fcn.1800044f4
mov rbx, rax
movzx ecx, word [0x18001db56]
movzx edx, word [0x18001db54]
movzx r9d, word [0x18001db50]
movzx r8d, word [0x18001db52]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea rdx, str.Version:__d._d._d._d._r_n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov rcx, rbx
call fcn.1800021c0
mov rcx, rbx
call fcn.18000459c
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180003598
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x50]
mov r8d, 0x15
lea rdx, str.Freezing_threads..._r_n
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r13d, eax
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x180003626
mov dword [rsp + 0x58], 0x1c
lea rdx, [rsp + 0x58]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
mov r8d, dword [rsp + 0x60]
cmp r8d, r12d
je 0x18000360b
cmp dword [rsp + 0x64], r13d
jne 0x18000360b
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18000360b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x58]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1800035d4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp - 0x70]
call fcn.180009090
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp + 0x8f]
call fcn.180009090
lea r9, [rbp - 0x70]
lea r8, str.SLPolicyHookNT60
lea rdx, str.Main
mov rcx, qword [0x18001db70]
call fcn.180001850
test al, al
je 0x180003686
xor edx, edx
lea r8d, [rdx + 0xa]
lea rcx, [rbp + 0x8f]
call fcn.180004b08
test eax, eax
setne al
jmp 0x180003688
mov al, 1
mov ecx, 0x600
lea rbx, [0x1800022d0]
cmp r15w, cx
jne 0x180003758
test al, al
je 0x180003758
lea rcx, str.slc.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x18001db60], rax
lea rdx, str.SLGetWindowsInformationDWORD
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18001db78], rax
cmp rax, 0xffffffffffffffff
je 0x180003758
lea rcx, str.Hook_SLGetWindowsInformationDWORD._r_n
call fcn.1800021c0
mov word [0x18001db80], 0xb848
mov qword [0x18001db82], rbx
mov word [0x18001db8a], 0xc350
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0xc
lea r8, [0x18001db90]
mov rdx, qword [0x18001db78]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0xc
lea r8, [0x18001db80]
mov rdx, qword [0x18001db78]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp + 0x190]
call fcn.180009090
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp + 0x28f]
call fcn.180009090
lea r9, [rbp + 0x190]
lea r8, str.SLPolicyHookNT61
lea rdx, str.Main
mov rcx, qword [0x18001db70]
call fcn.180001850
test al, al
je 0x1800037be
xor edx, edx
lea r8d, [rdx + 0xa]
lea rcx, [rbp + 0x28f]
call fcn.180004b08
test eax, eax
setne al
jmp 0x1800037c0
mov al, 1
mov ecx, 0x601
cmp r15w, cx
jne 0x18000388b
test al, al
je 0x1800038c1
lea rcx, str.slc.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x18001db60], rax
lea rdx, str.SLGetWindowsInformationDWORD
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18001db78], rax
cmp rax, 0xffffffffffffffff
je 0x1800038c1
lea rcx, str.Hook_SLGetWindowsInformationDWORD._r_n
call fcn.1800021c0
mov word [0x18001db80], 0xb848
mov qword [0x18001db82], rbx
mov word [0x18001db8a], 0xc350
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0xc
lea r8, [0x18001db90]
mov rdx, qword [0x18001db78]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0xc
lea r8, [0x18001db80]
mov rdx, qword [0x18001db78]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x1800038c1
mov eax, 0x602
cmp r15w, ax
jne 0x1800038c1
lea rcx, str.slc.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x18001db60], rax
lea rdx, str.SLGetWindowsInformationDWORD
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18001db78], rax
mov ecx, 0x100
call fcn.1800044f4
mov r14, rax
xor edx, edx
mov r8d, 0x100
mov rcx, rax
call fcn.180009090
movzx ecx, word [0x18001db56]
movzx edx, word [0x18001db54]
movzx r9d, word [0x18001db50]
movzx r8d, word [0x18001db52]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea rdx, str._d._d._d._d
mov rcx, r14
call qword [sym.imp.USER32.dll_wsprintfA]
mov rdx, r14
mov rbx, qword [0x18001db70]
mov rcx, rbx
call fcn.1800017a0
test rax, rax
je 0x180004225
mov rcx, qword [0x18001db68]
test rcx, rcx
je 0x180004225
movsxd rax, dword [rcx + 0x3c]
mov qword [0x18001db58], rcx
cmp dword [rax + rcx + 0x1c], 0
jbe 0x180004225
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp + 0x390]
call fcn.180009090
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp + 0x48f]
call fcn.180009090
lea r9, [rbp + 0x390]
lea r8, str.LocalOnlyPatch.x64
mov rdx, r14
mov rcx, rbx
call fcn.180001850
test al, al
je 0x180003af9
xor edx, edx
lea r8d, [rdx + 0xa]
lea rcx, [rbp + 0x48f]
call fcn.180004b08
test eax, eax
setne al
test al, al
je 0x180003af9
lea rcx, str.Patch_CEnforcementCore::GetInstanceOfLicense._r_n
call fcn.1800021c0
lea r9, [rbp + 0x190]
lea r8, str.LocalOnlyOffset.x64
mov rdx, r14
mov rcx, qword [0x18001db70]
call fcn.180001a00
xor ecx, ecx
test al, al
cmovne ecx, dword [rbp + 0x297]
mov r15d, ecx
add r15, qword [0x18001db58]
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp + 0x190]
call fcn.180009090
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp + 0x28f]
call fcn.180009090
lea r9, [rbp + 0x190]
lea r8, str.LocalOnlyCode.x64
mov rdx, r14
mov rcx, qword [0x18001db70]
call fcn.180001850
test al, al
je 0x180003af9
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp - 0x70]
call fcn.180009090
lea rax, [rbp + 0x190]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x180003a63
lea rdx, [rbp + 0x190]
lea rcx, [rbp - 0x70]
call fcn.18000b270
lea rax, [rbp + 0x28f]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180003a90
lea rdx, [rbp + 0x28f]
lea rcx, [rbp + 0x8f]
call fcn.18000b270
lea r9, [rbp + 0x590]
lea r8, [rbp + 0x8f]
call fcn.180001b00
test al, al
je 0x180003af9
cmp r15, qword [0x18001db58]
jbe 0x180003af9
movzx ebx, byte [rbp + 0x68f]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea r8, [rbp + 0x690]
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp + 0x990]
call fcn.180009090
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp + 0xa8f]
call fcn.180009090
lea r9, [rbp + 0x990]
lea r8, str.SingleUserPatch.x64
mov rdx, r14
mov rcx, qword [0x18001db70]
call fcn.180001850
test al, al
je 0x180003c9d
xor edx, edx
lea r8d, [rdx + 0xa]
lea rcx, [rbp + 0xa8f]
call fcn.180004b08
test eax, eax
setne al
test al, al
je 0x180003c9d
lea rcx, str.Patch_CSessionArbitrationHelper::IsSingleSessionPerUserEnabled._r_n
call fcn.1800021c0
lea r9, [rbp + 0x190]
lea r8, str.SingleUserOffset.x64
mov rdx, r14
mov rcx, qword [0x18001db70]
call fcn.180001a00
xor ecx, ecx
test al, al
cmovne ecx, dword [rbp + 0x297]
mov r15d, ecx
add r15, qword [0x18001db58]
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp + 0x190]
call fcn.180009090
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp + 0x28f]
call fcn.180009090
lea r9, [rbp + 0x190]
lea r8, str.SingleUserCode.x64
mov rdx, r14
mov rcx, qword [0x18001db70]
call fcn.180001850
test al, al
je 0x180003c9d
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp - 0x70]
call fcn.180009090
lea rax, [rbp + 0x190]
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180003c10
lea rdx, [rbp + 0x190]
lea rcx, [rbp - 0x70]
call fcn.18000b270
lea rax, [rbp + 0x28f]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x180003c34
lea rdx, [rbp + 0x28f]
lea rcx, [rbp + 0x8f]
call fcn.18000b270
lea r9, [rbp + 0x590]
lea r8, [rbp + 0x8f]
call fcn.180001b00
test al, al
je 0x180003c9d
cmp r15, qword [0x18001db58]
jbe 0x180003c9d
movzx ebx, byte [rbp + 0x68f]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea r8, [rbp + 0x690]
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp + 0x390]
call fcn.180009090
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp + 0x48f]
call fcn.180009090
lea r9, [rbp + 0x390]
lea r8, str.DefPolicyPatch.x64
mov rdx, r14
mov rcx, qword [0x18001db70]
call fcn.180001850
test al, al
je 0x180003e3d
xor edx, edx
lea r8d, [rdx + 0xa]
lea rcx, [rbp + 0x48f]
call fcn.180004b08
test eax, eax
setne al
test al, al
je 0x180003e3d
lea rcx, str.Patch_CDefPolicy::Query._r_n
call fcn.1800021c0
lea r9, [rbp + 0x190]
lea r8, str.DefPolicyOffset.x64
mov rdx, r14
mov rcx, qword [0x18001db70]
call fcn.180001a00
xor ecx, ecx
test al, al
cmovne ecx, dword [rbp + 0x297]
mov r15d, ecx
add r15, qword [0x18001db58]
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp + 0x190]
call fcn.180009090
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp + 0x28f]
call fcn.180009090
lea r9, [rbp + 0x190]
lea r8, str.DefPolicyCode.x64
mov rdx, r14
mov rcx, qword [0x18001db70]
call fcn.180001850
test al, al
je 0x180003e3d
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp - 0x70]
call fcn.180009090
lea rax, [rbp + 0x190]
mov r8, rdi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x180003db0
lea rdx, [rbp + 0x190]
lea rcx, [rbp - 0x70]
call fcn.18000b270
lea rax, [rbp + 0x28f]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x180003dd4
lea rdx, [rbp + 0x28f]
lea rcx, [rbp + 0x8f]
call fcn.18000b270
lea r9, [rbp + 0x590]
lea r8, [rbp + 0x8f]
call fcn.180001b00
test al, al
je 0x180003e3d
cmp r15, qword [0x18001db58]
jbe 0x180003e3d
movzx ebx, byte [rbp + 0x68f]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea r8, [rbp + 0x690]
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp + 0x990]
call fcn.180009090
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp + 0xa8f]
call fcn.180009090
lea r9, [rbp + 0x990]
lea r8, str.SLPolicyInternal.x64
mov rdx, r14
mov rcx, qword [0x18001db70]
call fcn.180001850
test al, al
je 0x180004034
xor edx, edx
lea r8d, [rdx + 0xa]
lea rcx, [rbp + 0xa8f]
call fcn.180004b08
test eax, eax
setne al
test al, al
je 0x180004034
lea rcx, str.Hook_SLGetWindowsInformationDWORDWrapper._r_n
call fcn.1800021c0
mov ecx, 0x400
call fcn.1800044f4
mov rbx, rax
lea r9, [rbp + 0x190]
lea r8, str.SLPolicyOffset.x64
mov rdx, r14
mov rcx, qword [0x18001db70]
call fcn.180001a00
xor ecx, ecx
test al, al
cmovne ecx, dword [rbp + 0x297]
mov r15d, ecx
add r15, qword [0x18001db58]
mov word [rsp + 0x78], 0xb848
lea r12, [0x180002490]
mov qword [rsp + 0x7a], r12
mov word [rbp - 0x7e], 0xc350
xor edx, edx
mov r8d, 0x400
mov rcx, rbx
call fcn.180009090
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp - 0x70]
call fcn.180009090
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp + 0x8f]
call fcn.180009090
lea r9, [rbp - 0x70]
lea r8, str.SLPolicyFunc.x64
mov rdx, r14
mov rcx, qword [0x18001db70]
call fcn.180001850
test al, al
je 0x180003fca
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x390]
call fcn.180009090
lea rax, [rbp - 0x70]
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180003f80
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x390]
call fcn.18000b270
lea rax, [rbp + 0x8f]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x180003fa4
lea rdx, [rbp + 0x8f]
lea rcx, [rbp + 0x48f]
call fcn.18000b270
lea r8, [rbp + 0x48f]
jmp 0x180003fd1
lea r8, str.New_Win8SL
mov edx, 0x400
mov rcx, rbx
call fcn.180004e70
lea rdx, str.New_Win8SL
mov rcx, rbx
call fcn.180008fa0
mov rcx, qword [rsp + 0x7a]
test eax, eax
cmovne rcx, r12
mov qword [rsp + 0x7a], rcx
mov rcx, rbx
call fcn.18000459c
cmp r15, qword [0x18001db58]
jbe 0x180004034
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0xc
lea r8, [rsp + 0x78]
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp + 0x390]
call fcn.180009090
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp + 0x48f]
call fcn.180009090
lea r9, [rbp + 0x390]
lea r8, str.SLInitHook.x64
mov rdx, r14
mov rcx, qword [0x18001db70]
call fcn.180001850
test al, al
je 0x180004225
xor edx, edx
lea r8d, [rdx + 0xa]
lea rcx, [rbp + 0x48f]
call fcn.180004b08
test eax, eax
setne al
test al, al
je 0x180004225
lea rcx, str.Hook_CSLQuery::Initialize._r_n
call fcn.1800021c0
mov ecx, 0x400
call fcn.1800044f4
mov rbx, rax
lea r9, [rbp + 0x190]
lea r8, str.SLInitOffset.x64
mov rdx, r14
mov rcx, qword [0x18001db70]
call fcn.180001a00
xor ecx, ecx
test al, al
cmovne ecx, dword [rbp + 0x297]
mov r15d, ecx
add r15, qword [0x18001db58]
mov word [rsp + 0x78], 0xb848
lea r12, [0x1800025f0]
mov qword [rsp + 0x7a], r12
mov word [rbp - 0x7e], 0xc350
xor edx, edx
mov r8d, 0x400
mov rcx, rbx
call fcn.180009090
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp - 0x70]
call fcn.180009090
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp + 0x8f]
call fcn.180009090
lea r9, [rbp - 0x70]
lea r8, str.SLInitFunc.x64
mov rdx, r14
mov rcx, qword [0x18001db70]
call fcn.180001850
test al, al
je 0x1800041bb
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x990]
call fcn.180009090
lea rax, [rbp - 0x70]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x180004172
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x990]
call fcn.18000b270
lea rax, [rbp + 0x8f]
inc rdi
cmp byte [rax + rdi], 0
jne 0x180004193
mov r8, rdi
lea rdx, [rbp + 0x8f]
lea rcx, [rbp + 0xa8f]
call fcn.18000b270
lea r8, [rbp + 0xa8f]
jmp 0x1800041c2
lea r8, str.New_CSLQuery_Initialize
mov edx, 0x400
mov rcx, rbx
call fcn.180004e70
lea rdx, str.New_CSLQuery_Initialize
mov rcx, rbx
call fcn.180008fa0
mov rcx, qword [rsp + 0x7a]
test eax, eax
cmovne rcx, r12
mov qword [rsp + 0x7a], rcx
mov rcx, rbx
call fcn.18000459c
cmp r15, qword [0x18001db58]
jbe 0x180004225
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0xc
lea r8, [rsp + 0x78]
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, r14
call fcn.18000459c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800042a5
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov r8d, 0x15
lea rdx, str.Resumimg_threads..._r_n
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r14d, eax
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1800043a2
mov dword [rsp + 0x58], 0x1c
lea rdx, [rsp + 0x58]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
mov r8d, dword [rsp + 0x60]
cmp r8d, esi
je 0x18000431b
cmp dword [rsp + 0x64], r14d
jne 0x18000431b
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18000431b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1800042e4
mov rcx, rdi
jmp 0x18000439c
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800043a2
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea rdx, str.Error:_Failed_to_detect_t.s_version._r_n
mov r8d, 0x26
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xf90]
xor rcx, rsp
call fcn.1800044a0
lea r11, [rsp + 0x10a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret