Function at 0x1800083f0
Capabilities:
Enumerate process modules
Get common file path
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x10980
call fcn.18005f3d0
sub rsp, rax
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x10970], rax
mov qword [rsp + 0x60], r8
mov rbx, rdx
mov qword [rsp + 0xc8], rcx
mov qword [rsp + 0xe0], rdx
mov qword [rsp + 0xd0], r8
xor r14d, r14d
mov r13d, r14d
mov dword [rsp + 0xf8], r14d
xor edx, edx
mov r8d, 0x8000
lea rcx, [rsp + 0x110]
call fcn.18004c900
xor edx, edx
mov r8d, 0x7d00
lea rcx, [rsp + 0x8110]
call fcn.18004c900
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0xfe10]
call fcn.18004c900
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x10030]
call fcn.18004c900
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0xff20]
call fcn.18004c900
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x10250]
call fcn.18004c900
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x10140]
call fcn.18004c900
mov qword [rsp + 0xd8], r14
mov byte [rsp + 0x31], r13b
mov byte [rsp + 0x30], r13b
xor r15b, r15b
mov byte [rsp + 0x3c], r13b
mov r12d, r14d
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x58], r14d
mov esi, r14d
mov dword [rsp + 0x48], r14d
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x10560]
call fcn.18004c900
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x10360]
call fcn.18004c900
mov edi, 0x1000
mov qword [rsp + 0x98], rdi
mov dword [rsp + 0x7c], edi
mov dword [rsp + 0x4c], r14d
mov edx, 0x104
lea rcx, [rsp + 0xff20]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rdx, [rsp + 0xff20]
lea rcx, [rsp + 0x10140]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, str.WinSxS
lea rcx, [rsp + 0xff20]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
test rbx, rbx
je 0x1800085a7
mov r8d, edi
mov rdx, rbx
lea rcx, [rsp + 0x110]
call fcn.18004c130
mov r13d, 0xffffffff
cmp qword [rsp + 0xc8], rsi
jne 0x1800085cd
mov r14, qword [0x180082d08]
mov qword [rsp + 0x50], r14
test r14, r14
jne 0x1800085da
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r14, rax
jmp 0x1800085d5
mov r14, qword [rsp + 0xc8]
mov qword [rsp + 0x50], r14
mov qword [rsp + 0xa8], r14
cmp rbx, 0
jne 0x18000860f
lea r9, [rsp + 0xf8]
mov r8d, 0x8000
lea rdx, [rsp + 0x110]
mov rcx, r14
call qword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x1800095c4
inc r13d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x68], r13d
mov dword [rsp + 0x80], r13d
mov edi, r13d
mov dword [rsp + 0x34], r13d
mov dword [rsp + 0x78], r13d
mov eax, r13d
cmp qword [rsp + r13*8 + 0x110], rsi
je 0x180008720
mov ecx, esi
test ecx, ecx
jne 0x180008706
lea rbx, [rsp + 0x110]
lea rbx, [rbx + rax*8]
mov r9d, 0x104
lea r8, [rsp + 0xfe10]
mov rdx, qword [rbx]
mov rcx, r14
call qword [sym.imp.PSAPI.DLL_GetModuleBaseNameA]
lea rdx, [0x18006cda0]
lea rcx, [rsp + 0xfe10]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x180008693
mov dword [rsp + 0x4c], edi
mov ecx, edi
jmp 0x180008706
lea rdx, [0x18006cdb0]
lea rcx, [rsp + 0xfe10]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x180008702
mov r9d, 0x104
lea r8, [rsp + 0xfe10]
mov rdx, qword [rbx]
mov rcx, r14
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
lea rcx, [rsp + 0x10140]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rcx, eax
cmp rcx, 0x104
jae 0x1800095f2
mov byte [rsp + rcx + 0xfe10], sil
lea rdx, [rsp + 0x10140]
lea rcx, [rsp + 0xfe10]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov ecx, dword [rsp + 0x4c]
inc edi
mov dword [rsp + 0x34], edi
mov dword [rsp + 0x78], edi
mov eax, edi
cmp qword [rsp + rdi*8 + 0x110], rsi
jne 0x180008644
mov ecx, 1
test r15b, r15b
jne 0x180008fdb
mov edi, r13d
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0xf0], rdi
mov rbx, qword [rsp + r13*8 + 0x110]
test rbx, rbx
je 0x180008fd7
mov byte [rsp + 0x31], r15b
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0xfe10]
call fcn.18004c900
mov r9d, 0x104
lea r8, [rsp + 0xfe10]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
lea rdx, [rsp + 0xfe10]
lea rcx, [rsp + 0x10030]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x10250]
call fcn.18004c900
lea rcx, [rsp + 0xff20]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd r8, eax
lea rdx, [rsp + 0x10030]
lea rcx, [rsp + 0x10250]
call fcn.18004c130
lea rcx, [rsp + 0xfe10]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rcx, [rsp + 0xfe10]
test rax, rax
jne 0x18000885b
xor edx, edx
mov r8d, 0x104
call fcn.18004c900
mov r9d, 0x104
lea r8, [rsp + 0xfe10]
mov rdx, qword [rsp + r13*8 + 0x110]
mov rcx, r14
call qword [sym.imp.PSAPI.DLL_GetModuleBaseNameA]
lea rcx, [rsp + 0xfe10]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180008957
lea rdx, [rsp + 0xff20]
lea rcx, [rsp + 0x10250]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x180008957
lea rcx, [rsp + 0xfe10]
mov rbx, rdi
shl rbx, 5
mov rax, qword [rsp + r13*8 + 0x110]
mov qword [rsp + rbx + 0x8110], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + rbx + 0x8120], 0
mov qword [rsp + rbx + 0x8118], rax
mov ebx, dword [rsp + 0x109e0]
lea eax, [rbx - 7]
cmp eax, 2
jbe 0x180008fbc
cmp ebx, 1
jne 0x180008a41
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], rax
mov rbx, rdi
shl rbx, 5
mov rdi, qword [rsp + rbx + 0x8110]
lea r9d, [rax + 0x18]
lea r8, [rsp + 0xb0]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.PSAPI.DLL_GetModuleInformation]
mov rbx, qword [rsp + rbx + 0x8118]
mov rcx, qword [rsp + 0x60]
cmp rcx, rbx
jb 0x180008ce2
mov eax, dword [rsp + 0xb8]
add rax, rbx
cmp rcx, rax
ja 0x180008ce2
mov r9d, 0x200
lea r8, [0x1800838c0]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.PSAPI.DLL_GetModuleBaseNameA]
sub rdi, rbx
mov rbx, qword [rsp + 0x60]
add rdi, rbx
mov qword [rsp + 0xd8], rdi
mov r15b, 1
mov r12d, r13d
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x58], r13d
mov edi, dword [rsp + 0x34]
mov ecx, 1
jmp 0x180008fe0
cmp byte [0x180082c9e], 0
je 0x1800089a8
lea rcx, [rsp + 0x10030]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x18000888c
mov rdx, rdi
shl rdx, 5
mov rcx, qword [rsp + r13*8 + 0x110]
mov qword [rsp + rdx + 0x8110], rcx
mov qword [rsp + rdx + 0x8118], rax
mov eax, 1
mov qword [rsp + rdx + 0x8120], rax
jmp 0x18000888c
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x10760]
call fcn.18004c900
test r14, r14
je 0x18000888c
mov dword [rsp + 0x28], 0x104
lea rax, [rsp + 0x10760]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rsp + 0x10030]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rdx, [rsp + 0x10760]
mov rcx, r14
call fcn.180007d10
test rax, rax
je 0x18000888c
mov rdx, rdi
shl rdx, 5
mov rcx, qword [rsp + r13*8 + 0x110]
mov qword [rsp + rdx + 0x8110], rcx
mov qword [rsp + rdx + 0x8118], rax
mov eax, 1
mov qword [rsp + rdx + 0x8120], rax
mov byte [rsp + 0x31], al
jmp 0x18000888c
lea eax, [rbx - 0xb]
cmp eax, 1
ja 0x180008cf6
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], rax
mov r13, rdi
shl r13, 5
mov rax, qword [rsp + r13 + 0x8110]
mov qword [rsp + 0x90], rax
mov r9d, 0x18
lea r8, [rsp + 0xb0]
mov rdx, rax
mov rcx, r14
call qword [sym.imp.PSAPI.DLL_GetModuleInformation]
mov rdx, qword [rsp + r13 + 0x8110]
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
jb 0x180008cef
mov eax, dword [rsp + 0xb8]
add rax, rdx
cmp rbx, rax
ja 0x180008cef
mov r13, qword [rsp + r13 + 0x8118]
cmp byte [rsp + 0x31], 0
jne 0x180008af9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, rax
mov byte [rsp + 0x20], 0
mov r9, r13
mov r8, qword [rsp + 0xb0]
call fcn.180007830
test al, al
je 0x180008cef
mov rdx, qword [rsp + 0x90]
movsxd rax, dword [r13 + 0x3c]
movzx ecx, word [rax + r13 + 0x18]
mov r8d, 0x10b
cmp cx, r8w
jne 0x180008b1b
mov byte [rsp + 0x30], 0
mov edi, dword [rax + r13 + 0x78]
jmp 0x180008b38
mov r8d, 0x20b
cmp cx, r8w
jne 0x180008c7e
mov byte [rsp + 0x30], 1
mov edi, dword [rax + r13 + 0x88]
add rdi, r13
mov r12d, dword [rdi + 0x1c]
add r12, r13
mov qword [rsp + 0x70], r12
xor r14d, r14d
mov dword [rsp + 0xe8], r14d
cmp r14d, dword [rdi + 0x14]
jae 0x180008c65
mov eax, dword [r12]
mov rcx, rbx
sub rcx, rax
sub rcx, rdx
mov eax, dword [rsp + 0x98]
cmp rcx, rax
jae 0x180008c54
mov eax, ecx
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x7c], ecx
mov r15d, dword [rdi + 0x20]
add r15, r13
mov ebx, dword [rdi + 0x24]
add rbx, r13
mov qword [rsp + 0x88], rbx
mov r9d, 0x200
lea r8, [0x1800838c0]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.PSAPI.DLL_GetModuleBaseNameA]
xor edx, edx
mov r8d, 0x200
lea rcx, [0x1800836c0]
call fcn.18004c900
mov esi, dword [rdi + 0x10]
mov dword [rsp + 0x48], esi
xor edx, edx
mov dword [rsp + 0x44], edx
cmp edx, dword [rdi + 0x18]
jae 0x180008bf8
movzx eax, word [rbx]
cmp eax, r14d
je 0x180008bf2
add rbx, 2
mov qword [rsp + 0x88], rbx
inc edx
jmp 0x180008bd1
add esi, eax
mov dword [rsp + 0x48], esi
lea ecx, [rdx*4]
add r15, rcx
mov ecx, dword [r15]
add rcx, r13
call fcn.180006b00
test al, al
je 0x180008c24
mov edx, dword [r15]
add rdx, r13
lea rcx, [0x1800836c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [r12]
mov rdx, qword [rsp + 0x90]
add rax, rdx
mov qword [rsp + 0xd8], rax
mov r15b, 1
mov byte [rsp + 0x32], r15b
mov ebx, dword [rsp + 0x40]
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x58], ebx
mov rbx, qword [rsp + 0x60]
add r12, 4
mov qword [rsp + 0x70], r12
inc r14d
jmp 0x180008b4a
mov r12d, dword [rsp + 0x38]
mov rdi, qword [rsp + 0xa0]
mov r13d, dword [rsp + 0x40]
mov r14, qword [rsp + 0x50]
jmp 0x180008cfb
xor eax, eax
jmp 0x1800095cf
mov rdi, qword [rsp + 0xa0]
mov rbx, rcx
jmp 0x180008cfb
mov r13d, dword [rsp + 0x40]
jmp 0x180008cfb
mov rbx, qword [rsp + 0x60]
mov eax, dword [rsp + 0x109e0]
add eax, 0xfffffffe
cmp eax, 4
ja 0x180008fbc
shl rdi, 5
mov qword [rsp + 0xa0], rdi
mov r14, qword [rsp + rdi + 0x8118]
test r14, r14
je 0x180008fb7
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + rdi + 0x8110]
mov qword [rsp + 0x90], rax
mov r9d, 0x18
lea r8, [rsp + 0xb0]
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.PSAPI.DLL_GetModuleInformation]
mov rdx, qword [rsp + 0x90]
cmp rbx, rdx
jb 0x180008fb7
mov eax, dword [rsp + 0xb8]
add rax, rdx
cmp rbx, rax
ja 0x180008fb7
cmp byte [rsp + 0x31], 0
jne 0x180008dc5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, rax
mov byte [rsp + 0x20], 0
mov r9, r14
mov r8, qword [rsp + 0xb0]
call fcn.180007830
test al, al
je 0x180008fb7
mov rdx, qword [rsp + 0x90]
movsxd rax, dword [r14 + 0x3c]
movzx ecx, word [rax + r14 + 0x18]
mov r8d, 0x10b
cmp cx, r8w
jne 0x180008de7
mov byte [rsp + 0x30], 0
mov r13d, dword [rax + r14 + 0x78]
jmp 0x180008e04
mov r8d, 0x20b
cmp cx, r8w
jne 0x180008f4c
mov byte [rsp + 0x30], 1
mov r13d, dword [rax + r14 + 0x88]
add r13, r14
mov ecx, dword [r13 + 0x1c]
add rcx, r14
mov qword [rsp + 0x70], rcx
mov ebx, dword [r13 + 0x20]
add rbx, r14
mov qword [rsp + 0x100], rbx
mov edi, dword [r13 + 0x24]
add rdi, r14
mov qword [rsp + 0x88], rdi
cmp dword [rsp + 0x109e0], 5
jne 0x180008f37
xor r14d, r14d
mov r8, qword [rsp + 0x60]
mov dword [rsp + 0x44], r14d
cmp r14d, dword [r13 + 0x14]
jae 0x180008f32
mov eax, dword [rcx]
add rax, rdx
cmp rax, r8
jne 0x180008f21
mov r9d, 0x200
lea r8, [0x1800838c0]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.PSAPI.DLL_GetModuleBaseNameA]
xor edx, edx
mov r8d, 0x200
lea rcx, [0x1800836c0]
call fcn.18004c900
mov esi, dword [r13 + 0x10]
mov dword [rsp + 0x48], esi
xor ecx, ecx
mov dword [rsp + 0x44], ecx
cmp ecx, dword [r13 + 0x18]
jae 0x180008ec2
movzx eax, word [rdi]
cmp eax, r14d
je 0x180008ebc
add rdi, 2
mov qword [rsp + 0x88], rdi
inc ecx
jmp 0x180008e9a
add esi, eax
mov dword [rsp + 0x48], esi
lea ecx, [rcx*4]
add rbx, rcx
mov qword [rsp + 0x100], rbx
mov ecx, dword [rbx]
mov rax, qword [rsp + 0xa0]
mov rdi, qword [rsp + rax + 0x8118]
add rcx, rdi
call fcn.180006b00
test al, al
je 0x180008f04
mov edx, dword [rbx]
add rdx, rdi
lea rcx, [0x1800836c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov r15b, 1
mov byte [rsp + 0x32], r15b
mov r13d, dword [rsp + 0x40]
mov ebx, r13d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x58], ebx
mov r12d, r13d
jmp 0x180008f3c
add rcx, 4
mov qword [rsp + 0x70], rcx
inc r14d
jmp 0x180008e47
mov r12d, dword [rsp + 0x38]
mov r13d, dword [rsp + 0x40]
mov r14, qword [rsp + 0x50]
mov edi, dword [rsp + 0x34]
mov ecx, 1
jmp 0x180008fc5
xor eax, eax
jmp 0x1800095cf
mov r14, qword [rsp + 0x50]
mov ecx, 1
mov edi, dword [rsp + 0x34]
inc r13d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x68], r13d
jmp 0x180008725
mov edi, dword [rsp + 0x34]
mov rbx, qword [rsp + 0x60]
mov r13d, dword [rsp + 0x109e0]
lea eax, [r13 - 7]
cmp eax, 3
ja 0x18000931d
mov dword [rsp + 0x20], ecx
xor r9d, r9d
mov r8, rbx
xor edx, edx
mov rcx, r14
call fcn.1800083f0
mov qword [rsp + 0xf0], rax
mov ecx, 2
mov eax, dword [rsp + 0x80]
cmp eax, 1
cmovbe eax, ecx
mov dword [rsp + 0x80], eax
mov dword [rsp + 0x68], edi
cmp edi, eax
jb 0x180009315
mov eax, edi
shl rax, 5
mov r14, qword [rsp + rax + 0x8118]
test r14, r14
je 0x1800092fe
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], rcx
mov rax, qword [rsp + rax + 0x8110]
mov qword [rsp + 0x90], rax
lea r9d, [rcx + 0x18]
lea r8, [rsp + 0xb0]
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.PSAPI.DLL_GetModuleInformation]
cmp byte [rsp + 0x31], 0
jne 0x1800090b9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, rax
mov byte [rsp + 0x20], 0
mov r9, r14
mov r8, qword [rsp + 0xb0]
call fcn.180007830
test al, al
je 0x1800092fe
movsxd rcx, dword [r14 + 0x3c]
movzx eax, word [rcx + r14 + 0x18]
mov edx, 0x10b
cmp ax, dx
jne 0x1800090d1
xor al, al
jmp 0x1800090e1
mov edx, 0x20b
cmp ax, dx
jne 0x180009289
mov al, 1
mov byte [rsp + 0x30], al
cmp byte [rsp + 0x3c], 0
jne 0x18000929e
test al, al
jne 0x1800090fb
mov r13d, dword [rcx + r14 + 0x78]
jmp 0x180009103
mov r13d, dword [rcx + r14 + 0x88]
add r13, r14
mov ebx, dword [r13 + 0x1c]
add rbx, r14
mov qword [rsp + 0x70], rbx
mov edi, dword [r13 + 0x24]
add rdi, r14
mov qword [rsp + 0x88], rdi
mov eax, dword [r13 + 0x20]
add rax, r14
mov qword [rsp + 0x98], rax
xor r12d, r12d
mov dword [rsp + 0x44], r12d
cmp r12d, dword [r13 + 0x14]
jae 0x180009290
mov ecx, dword [rbx]
add rcx, r14
call fcn.180006b00
test al, al
je 0x180009278
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x10360]
call fcn.18004c900
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x10560]
call fcn.18004c900
mov ecx, dword [rbx]
add rcx, r14
lea r8, [rsp + 0x10360]
lea rdx, [rsp + 0x10560]
call fcn.180006ca0
test al, al
je 0x180009278
lea rcx, [rsp + 0x10560]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x10360]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, qword [rsp + 0xf0]
jne 0x180009278
mov r9d, 0x200
lea r8, [0x1800838c0]
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.PSAPI.DLL_GetModuleBaseNameA]
xor edx, edx
mov r8d, 0x200
lea rcx, [0x1800836c0]
call fcn.18004c900
mov esi, dword [r13 + 0x10]
mov dword [rsp + 0x48], esi
xor ecx, ecx
mov dword [rsp + 0x44], ecx
cmp ecx, dword [r13 + 0x18]
jae 0x180009233
movzx eax, word [rdi]
cmp eax, r12d
je 0x18000922d
add rdi, 2
mov qword [rsp + 0x88], rdi
inc ecx
jmp 0x18000920b
add esi, eax
mov dword [rsp + 0x48], esi
lea ebx, [rcx*4]
add rbx, qword [rsp + 0x98]
mov ecx, dword [rbx]
add rcx, r14
call fcn.180006b00
test al, al
je 0x180009262
mov edx, dword [rbx]
add rdx, r14
lea rcx, [0x1800836c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov r15b, 1
mov byte [rsp + 0x32], r15b
mov edi, dword [rsp + 0x34]
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x58], edi
jmp 0x180009294
add rbx, 4
mov qword [rsp + 0x70], rbx
inc r12d
jmp 0x180009133
mov byte [rsp + 0x3c], 1
jmp 0x18000929e
mov edi, dword [rsp + 0x34]
mov rbx, qword [rsp + 0x60]
mov r12d, dword [rsp + 0x38]
jmp 0x1800092fe
test r15b, r15b
jne 0x180009315
dec edi
mov dword [rsp + 0x34], edi
mov eax, dword [rsp + 0x80]
jmp 0x18000902a
mov r13d, dword [rsp + 0x109e0]
cmp qword [rsp + 0x118], 0
je 0x180009388
mov edi, 1
mov eax, edi
nop
shl rax, 5
cmp byte [0x180082c9e], 0
je 0x180009358
cmp qword [rsp + rax + 0x8120], 1
jne 0x180009379
mov rcx, qword [rsp + rax + 0x8118]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x180009379
cmp qword [rsp + rax + 0x8120], 1
jne 0x180009379
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rsp + rax + 0x8118]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
inc edi
mov eax, edi
cmp qword [rsp + rdi*8 + 0x110], 0
jne 0x180009330
test r15b, r15b
je 0x1800095be
lea rdx, str.NtdllDefWindowProc_A
lea rcx, [0x1800836c0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea rcx, [0x1800836c0]
test eax, eax
jne 0x1800093c9
lea rdx, str.DefWindowProcA
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [0x18006cde8]
jmp 0x180009451
lea rdx, str.NtdllDefWindowProc_W
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea rcx, [0x1800836c0]
test eax, eax
jne 0x1800093f7
lea rdx, str.DefWindowProcW
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [0x18006ce20]
jmp 0x180009451
lea rdx, str.NtdllDialogWndProc_A
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea rcx, [0x1800836c0]
test eax, eax
jne 0x180009425
lea rdx, str.DefDlgProcA
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [0x18006ce58]
jmp 0x180009451
lea rdx, str.NtdllDialogWndProc_W
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x180009463
lea rdx, str.DefDlgProcW
lea rcx, [0x1800836c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [0x18006ce90]
lea rcx, [0x1800838c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov r12d, dword [rsp + 0x4c]
cmp r13d, 9
je 0x18000950d
cmp r13d, 0xa
je 0x1800095ba
cmp r13d, 7
je 0x1800095a8
cmp r13d, 5
je 0x180009539
cmp r13d, 8
je 0x180009533
cmp r13d, 0xc
jne 0x180009526
cmp byte [0x180081331], 0
je 0x18000950d
movzx eax, byte [0x180082c9e]
cmp al, 1
je 0x1800094c9
test al, al
jne 0x18000950d
mov eax, r12d
shl rax, 5
cmp qword [rsp + rax + 0x8120], 1
je 0x18000950d
lea rdx, [0x18006cee0]
lea rcx, [0x1800838c0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x18000950d
mov dword [rsp + 0x20], 9
xor r9d, r9d
mov r8, rbx
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xc8]
call fcn.1800083f0
test rax, rax
jne 0x1800095cf
cmp byte [0x1800836c0], 0
je 0x1800095c4
lea rax, [0x1800836c0]
jmp 0x1800095cf
mov rax, qword [rsp + 0xd8]
jmp 0x1800095cf
cmp r13d, 5
jne 0x1800095a3
cmp byte [0x180081331], 1
jne 0x1800095a3
movzx eax, byte [0x180082c9e]
cmp al, 1
je 0x180009563
test al, al
jne 0x1800095a3
mov eax, r12d
shl rax, 5
cmp qword [rsp + rax + 0x8120], 1
je 0x1800095a3
lea rdx, [0x18006ced0]
lea rcx, [0x1800838c0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1800095a3
mov dword [rsp + 0x20], 8
xor r9d, r9d
mov r8, rbx
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xc8]
call fcn.1800083f0
test rax, rax
jne 0x1800095cf
mov eax, r12d
jmp 0x1800095cf
cmp byte [0x1800838c0], 0
je 0x1800095c4
lea rax, [0x1800838c0]
jmp 0x1800095cf
mov eax, esi
jmp 0x1800095cf
cmp r13d, 0xa
je 0x1800095c8
xor eax, eax
jmp 0x1800095cf
mov rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x10970]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x10980
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.180049f80
nop
int3