Function at 0x1800c8690
Capabilities:
Get file attributes
Read .ini file

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x900
mov qword [rsp + 0xf8], 0xfffffffffffffffe
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x8f0], rax
mov rsi, r9
mov qword [rsp + 0x88], r9
mov r15, r8
mov qword [rsp + 0x70], r8
mov r14d, edx
mov r13, rcx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0xc0], rcx
mov dword [rsp + 0x80], edx
mov qword [rsp + 0xd0], r8
mov qword [rsp + 0xc8], r9
mov rbx, qword [rsp + 0x960]
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0xd8], rbx
mov rax, qword [rsp + 0x988]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0xe0], rax
lea rdx, [sym.vrvhook64.dll_MyNtCreateFile]
lea rcx, [0x18028d500]
call fcn.18000dae0
mov rdi, rax
test rax, rax
je 0x1800c9ffe
mov rcx, rax
call fcn.18000d7e0
mov r12, rax
mov qword [rsp + 0xb8], rax
cmp dword [0x18025caa4], 0
jne 0x1800c87bd
mov eax, dword [rsp + 0x990]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x980]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x978]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x970]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x968]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9, rsi
mov r8, r15
mov edx, r14d
mov rcx, r13
call r12
jmp 0x1800c9ffe
mov rcx, rdi
call fcn.180083ad0
test eax, eax
je 0x1800c8823
mov eax, dword [rsp + 0x990]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x980]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x978]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x970]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x968]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9, rsi
mov r8, r15
mov edx, r14d
mov rcx, r13
call r12
jmp 0x1800c9ffe
test r15, r15
je 0x1800c9fa8
mov rdi, qword [r15 + 0x10]
test rdi, rdi
je 0x1800c9fa8
cmp qword [rdi + 8], 0
je 0x1800c9fa8
mov byte [rsp + 0x1a0], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x1a1]
call fcn.1800f4fb0
cmp dword [0x1801e68d0], 0
jne 0x1800c889e
cmp dword [0x180220ad8], 0
jne 0x1800c889e
cmp dword [0x1802210f4], 0
jne 0x1800c889e
cmp dword [0x1801e3950], 0
jne 0x1800c889e
cmp dword [0x180221ea4], 0
jne 0x1800c889e
cmp dword [0x18021adec], 0
jne 0x1800c889e
xor ebx, ebx
jmp 0x1800c978b
xor ebx, ebx
mov word [rsp + 0x3c0], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x3c2]
call fcn.1800f4fb0
cmp qword [rdi + 8], rbx
je 0x1800c9f4c
movzx eax, word [rdi]
test ax, ax
je 0x1800c9f4c
mov edi, 0x104
cmp ax, di
jae 0x1800c9f4c
mov rdx, qword [r15 + 0x10]
movzx r8d, word [rdx]
mov rdx, qword [rdx + 8]
lea rcx, [rsp + 0x3c0]
call fcn.1800f6e10
mov word [rsp + 0x5c6], bx
lea rax, [rsp + 0x3c0]
test rax, rax
jne 0x1800c896e
mov eax, dword [rsp + 0x990]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x980]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x978]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x970]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x968]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9, rsi
mov r8, r15
mov edx, r14d
mov rcx, r13
call r12
jmp 0x1800c9ffe
mov word [rsp + 0x5d0], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x5d2]
call fcn.1800f4fb0
mov r8d, 8
lea rdx, str.__UNC_
lea rcx, [rsp + 0x3c0]
call fcn.1800fcd4c
test eax, eax
jne 0x1800c8a09
mov rcx, rbx
lea rdx, [0x18016797c]
nop word [rax + rax]
movzx eax, word [rcx + rdx]
mov word [rsp + rcx + 0x5d0], ax
add rcx, 2
test ax, ax
jne 0x1800c89c0
lea rdi, [rsp + 0x5d0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x3d0]
xor ecx, ecx
movzx eax, word [rdx + rcx]
mov word [rdi + rcx - 2], ax
add rcx, 2
test ax, ax
jne 0x1800c89f0
mov edi, 0x104
jmp 0x1800c8a49
mov r8d, 4
lea rdx, [0x180167970]
lea rcx, [rsp + 0x3c0]
call fcn.1800fcd4c
test eax, eax
jne 0x1800c9e70
mov rcx, rbx
nop
movzx eax, word [rsp + rcx + 0x3c8]
mov word [rsp + rcx + 0x5d0], ax
add rcx, 2
test ax, ax
jne 0x1800c8a30
mov rcx, rbx
nop dword [rax]
movzx eax, word [rsp + rcx + 0x5d0]
mov word [rsp + rcx + 0x3c0], ax
add rcx, 2
test ax, ax
jne 0x1800c8a50
cmp word [rsp + 0x3c0], bx
je 0x1800c9e11
lea rdx, [0x180165c78]
lea rcx, [rsp + 0x3c0]
call fcn.1800fe0a4
test eax, eax
je 0x1800c9e11
mov r8d, 5
lea rdx, [0x180165c68]
lea rcx, [rsp + 0x3c0]
call fcn.1800fcd4c
test eax, eax
je 0x1800c9e11
mov edx, 0x5c
lea rcx, [rsp + 0x3c0]
call fcn.1800fb920
test rax, rax
je 0x1800c9e11
lea rdx, str.PIPE_
lea rcx, [rsp + 0x3c0]
call fcn.1800fb870
test rax, rax
jne 0x1800c9e11
cmp dword [0x180221ea4], ebx
je 0x1800c8da2
lea rdx, str.EXPLORER.EXE
lea rcx, [0x180259780]
call fcn.18010b680
test eax, eax
je 0x1800c8b41
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], edi
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
lea r8, [rsp + 0x3c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rdx, str.EXPLORER.EXE
lea rcx, [0x180259780]
call fcn.18010b680
test eax, eax
jne 0x1800c8da2
cmp dword [rsp + 0x978], 2
jne 0x1800c8da2
cmp dword [0x1802663bc], ebx
jne 0x1800c8d9c
lea r8d, [rax + 1]
lea rdx, str.EdpBigData.ini
lea rcx, [rsp + 0x100]
call fcn.18001f690
nop
cmp qword [rax + 0x20], 0x10
jb 0x1800c8b9c
mov r9, qword [rax + 8]
jmp 0x1800c8ba0
lea r9, [rax + 8]
mov r8d, 1
lea rdx, str.CustomName
lea rcx, str.CUSTOMERS
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edi, eax
cmp qword [rsp + 0x120], 0x10
jb 0x1800c8bd4
mov rcx, qword [rsp + 0x108]
call fcn.1800f4b9c
mov qword [rsp + 0x120], 0xf
mov qword [rsp + 0x118], rbx
mov byte [rsp + 0x108], 0
cmp edi, 2
jne 0x1800c8d9c
mov byte [rsp + 0x2b0], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x2b1]
call fcn.1800f4fb0
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x104
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
lea r8, [rsp + 0x3c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rdx, rbx
nop
movzx eax, byte [rsp + rdx + 0x2b0]
mov byte [rsp + rdx + 0x1a0], al
inc rdx
test al, al
jne 0x1800c8c50
lea rdx, [rsp + 0x5d0]
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
test byte [rsp + 0x5d0], 0x10
je 0x1800c8d1c
xor edx, edx
lea rcx, [rsp + 0x1a0]
call fcn.1800f6de4
cmp eax, 0xffffffff
jne 0x1800c8d9c
lea rax, [rsp + 0x100]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x120], 0xf
mov qword [rsp + 0x118], rbx
mov byte [rsp + 0x108], 0
xor r8d, r8d
lea rdx, [0x180152644]
lea rcx, [rsp + 0x100]
call fcn.180003700
nop
lea rax, [rsp + 0x100]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [0x180152644]
lea rdx, [rsp + 0x2b0]
lea ecx, [r9 + 1]
call fcn.1800a33e0
jmp 0x1800c8d9c
xor edx, edx
lea rcx, [rsp + 0x1a0]
call fcn.1800f6de4
cmp eax, 0xffffffff
jne 0x1800c8d9c
lea rax, [rsp + 0x100]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x120], 0xf
mov qword [rsp + 0x118], rbx
mov byte [rsp + 0x108], 0
xor r8d, r8d
lea rdx, [0x180152644]
lea rcx, [rsp + 0x100]
call fcn.180003700
nop
lea rax, [rsp + 0x100]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [0x180152644]
lea rdx, [rsp + 0x2b0]
lea ecx, [r9 + 1]
call fcn.1800a33e0
mov dword [0x1802663bc], ebx
cmp dword [0x1802210f4], 0
je 0x1800c8e48
cmp dword [0x1802216b0], 0
je 0x1800c8e48
lea rdx, [0x18025c000]
lea rcx, str._WINRAR.EXE_HAOZIP.EXE_7ZFM.EXE_7ZG.EXE_KUAIZIP.EXE_
call fcn.1800f4d08
test rax, rax
je 0x1800c8e48
mov byte [rsp + 0x5d0], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x5d1]
call fcn.1800f4fb0
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x104
lea rax, [rsp + 0x5d0]
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
lea r8, [rsp + 0x3c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movzx ecx, byte [rsp + 0x5d0]
call fcn.180068530
test eax, eax
je 0x1800c8e48
mov qword [r13], 0xffffffffffffffff
mov dword [rsi], ebx
xor eax, eax
jmp 0x1800c9ffe
lea rsi, [0x180259780]
lea rdi, str.EXPLORER.EXE
mov ecx, 0xd
repe cmpsb byte [rsi], byte [rdi]
jne 0x1800c9709
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r15d, eax
lea rcx, [0x1801e00e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rsi, qword [0x18028d470]
mov rcx, qword [rsi + 8]
mov rdi, rsi
cmp byte [rcx + 0x21], 0
jne 0x1800c8ea8
nop dword [rax]
cmp dword [rcx + 0x18], r15d
jae 0x1800c8e9c
mov rcx, qword [rcx + 0x10]
jmp 0x1800c8ea2
mov rdi, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x21], 0
je 0x1800c8e90
mov qword [rsp + 0x190], rdi
mov rcx, qword [0x18028d440]
mov qword [rsp + 0x188], rcx
mov r12, rsi
test rcx, rcx
je 0x1800c8ecc
cmp rcx, rcx
je 0x1800c8edf
call fcn.1800f8c38
mov rsi, qword [0x18028d470]
mov rcx, qword [0x18028d440]
cmp rdi, r12
je 0x1800c8ef4
cmp r15d, dword [rdi + 0x18]
jb 0x1800c8ef4
lea rdx, [rsp + 0x188]
jmp 0x1800c8f0c
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xa8], rcx
lea rdx, [rsp + 0xa8]
lea rdi, [rsp + 0xe8]
mov rax, qword [rdx]
mov qword [rdi], rax
mov rax, qword [rdx + 8]
mov qword [rdi + 8], rax
mov rax, qword [rsp + 0xe8]
test rax, rax
je 0x1800c8f34
cmp rax, rcx
je 0x1800c8f39
call fcn.1800f8c38
cmp qword [rsp + 0xf0], rsi
jne 0x1800c8fba
lea rcx, [0x1801e00e0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [rsp + 0x990]
mov dword [rsp + 0x50], edx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x980]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x978]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x970]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x968]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x88]
mov r8, qword [rsp + 0x70]
mov edx, r14d
mov rcx, r13
call qword [rsp + 0xb8]
jmp 0x1800c9ffe
lea rcx, [0x1801e00e0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x1801b0420], 2
je 0x1800c96da
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x3c0]
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x1800c96fd
lea rdx, [0x180165c78]
lea rcx, [rsp + 0x3c0]
call fcn.1800fe0a4
test eax, eax
je 0x1800c96f6
mov r8d, 5
lea rdx, [0x180165c68]
lea rcx, [rsp + 0x3c0]
call fcn.1800fcd4c
test eax, eax
je 0x1800c96ef
mov edx, 0x5c
lea rcx, [rsp + 0x3c0]
call fcn.1800fb920
test rax, rax
je 0x1800c96e8
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x1800c96e1
lea rcx, [0x1801e0108]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rsp + 0x7e0], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x7e1]
call fcn.1800f4fb0
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x104
lea rax, [rsp + 0x7e0]
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
lea r8, [rsp + 0x3c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r13d, ebx
mov rax, qword [0x1802665e0]
mov rdi, qword [rax]
mov rsi, qword [0x1802665b8]
mov r12, qword [0x1802665e0]
test rsi, rsi
je 0x1800c90e9
cmp rsi, qword [0x1802665b8]
je 0x1800c90ee
call fcn.1800f8c38
cmp rdi, r12
je 0x1800c9253
test rsi, rsi
jne 0x1800c9106
call fcn.1800f8c38
mov r11, rbx
jmp 0x1800c9109
mov r11, qword [rsi]
cmp rdi, qword [r11 + 0x28]
jne 0x1800c9114
call fcn.1800f8c38
cmp dword [rdi + 0x10], r15d
jne 0x1800c9166
cmp r13d, 1
jg 0x1800c9253
inc r13d
test rsi, rsi
jne 0x1800c9136
call fcn.1800f8c38
mov r11, rbx
jmp 0x1800c9139
mov r11, qword [rsi]
cmp rdi, qword [r11 + 0x28]
jne 0x1800c9144
call fcn.1800f8c38
cmp qword [rdi + 0x38], 0x10
jb 0x1800c9151
mov rdx, qword [rdi + 0x20]
jmp 0x1800c9155
lea rdx, [rdi + 0x20]
lea rcx, [rsp + 0x7e0]
call fcn.18010b680
test eax, eax
je 0x1800c918b
test rsi, rsi
jne 0x1800c9175
call fcn.1800f8c38
mov r11, rbx
jmp 0x1800c9178
mov r11, qword [rsi]
cmp rdi, qword [r11 + 0x28]
jne 0x1800c9183
call fcn.1800f8c38
mov rdi, qword [rdi]
jmp 0x1800c90d4
test rsi, rsi
jne 0x1800c919a
call fcn.1800f8c38
mov rdx, rbx
jmp 0x1800c919d
mov rdx, qword [rsi]
cmp rdi, qword [rdx + 0x28]
jne 0x1800c91a8
call fcn.1800f8c38
cmp dword [rdi + 0x14], 0
je 0x1800c91da
lea rcx, [0x1801e0108]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r12, qword [rsp + 0x68]
mov qword [r12], 0xffffffffffffffff
mov r9, qword [rsp + 0x88]
mov dword [r9], ebx
xor eax, eax
jmp 0x1800c9ffe
lea rcx, [0x1801e0108]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [rsp + 0x990]
mov dword [rsp + 0x50], edx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x980]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x978]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x970]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x968]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x88]
mov r8, qword [rsp + 0x70]
mov edx, r14d
mov rcx, qword [rsp + 0x68]
call qword [rsp + 0xb8]
jmp 0x1800c9ffe
lea rcx, [0x1801e0108]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [rsp + 0x2b0], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x2b1]
call fcn.1800f4fb0
mov byte [rsp + 0x5d0], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x5d1]
call fcn.1800f4fb0
mov dword [rsp + 0xa8], ebx
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x5d0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2b0]
lea r8, [rsp + 0x7e0]
mov edx, r15d
mov rcx, qword [0x1801e1b08]
call fcn.18003c2f0
test eax, eax
je 0x1800c9704
lea rcx, [0x1801e0108]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov qword [rsp + 0x158], 0xf
mov qword [rsp + 0x150], rbx
mov byte [rsp + 0x140], 0
mov dword [rsp + 0x130], r15d
mov dword [rsp + 0x134], ebx
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2b0]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x138]
call fcn.180003700
mov rdx, qword [0x1802665e0]
mov rsi, qword [rdx]
lea r9, [rsp + 0x130]
mov r8, qword [rsi + 8]
mov rdx, rsi
lea rcx, [0x1802665b8]
call fcn.1800a6fe0
mov rdi, rax
mov edx, 1
lea rcx, [0x1802665b8]
call fcn.180080cf0
mov qword [rsi + 8], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rdi
lea rcx, [0x1801e0108]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [rsp + 0xa8]
cmp edx, 1
jne 0x1800c952f
mov byte [rsp + 0x188], 0
xor eax, eax
mov qword [rsp + 0x189], rax
mov byte [rsp + 0x191], al
lea r8, [rsp + 0x188]
lea rdx, [rsp + 0x5d0]
lea rcx, [rsp + 0x2b0]
call fcn.1800b7370
test eax, eax
jne 0x1800c969f
lea rcx, [0x1801e0108]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov qword [rsp + 0x128], 0xf
mov qword [rsp + 0x120], rbx
mov byte [rsp + 0x110], 0
mov dword [rsp + 0x100], r15d
mov dword [rsp + 0x104], 1
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2b0]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x108]
call fcn.180003700
mov rdx, qword [0x1802665e0]
mov rsi, qword [rdx]
lea r9, [rsp + 0x100]
mov r8, qword [rsi + 8]
mov rdx, rsi
lea rcx, [0x1802665b8]
call fcn.1800a6fe0
mov rdi, rax
mov edx, 1
lea rcx, [0x1802665b8]
call fcn.180080cf0
mov qword [rsi + 8], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rdi
lea rcx, [0x1801e0108]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r12, qword [rsp + 0x68]
mov qword [r12], 0xffffffffffffffff
mov r9, qword [rsp + 0x88]
mov dword [r9], ebx
mov dword [0x1802663b8], 1
cmp qword [rsp + 0x128], 0x10
jb 0x1800c94d8
mov rcx, qword [rsp + 0x110]
call fcn.1800f4b9c
mov qword [rsp + 0x128], 0xf
mov qword [rsp + 0x120], rbx
mov byte [rsp + 0x110], 0
cmp qword [rsp + 0x158], 0x10
jb 0x1800c950c
mov rcx, qword [rsp + 0x140]
call fcn.1800f4b9c
mov qword [rsp + 0x158], 0xf
mov qword [rsp + 0x150], rbx
mov byte [rsp + 0x140], 0
xor eax, eax
jmp 0x1800c9ffe
cmp edx, 2
jne 0x1800c969f
lea rdx, [rsp + 0x5d0]
lea rcx, [rsp + 0x2b0]
call fcn.1800b97f0
test eax, eax
jne 0x1800c969f
lea rcx, [0x1801e0108]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov qword [rsp + 0x128], 0xf
mov qword [rsp + 0x120], rbx
mov byte [rsp + 0x110], 0
mov dword [rsp + 0x100], r15d
mov dword [rsp + 0x104], 1
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2b0]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x108]
call fcn.180003700
mov rdx, qword [0x1802665e0]
mov rsi, qword [rdx]
lea r9, [rsp + 0x100]
mov r8, qword [rsi + 8]
mov rdx, rsi
lea rcx, [0x1802665b8]
call fcn.1800a6fe0
mov rdi, rax
mov edx, 1
lea rcx, [0x1802665b8]
call fcn.180080cf0
mov qword [rsi + 8], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rdi
lea rcx, [0x1801e0108]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r12, qword [rsp + 0x68]
mov qword [r12], 0xffffffffffffffff
mov r9, qword [rsp + 0x88]
mov dword [r9], ebx
mov dword [0x1802663b8], 1
cmp qword [rsp + 0x128], 0x10
jb 0x1800c9648
mov rcx, qword [rsp + 0x110]
call fcn.1800f4b9c
mov qword [rsp + 0x128], 0xf
mov qword [rsp + 0x120], rbx
mov byte [rsp + 0x110], 0
cmp qword [rsp + 0x158], 0x10
jb 0x1800c967c
mov rcx, qword [rsp + 0x140]
call fcn.1800f4b9c
mov qword [rsp + 0x158], 0xf
mov qword [rsp + 0x150], rbx
mov byte [rsp + 0x140], 0
xor eax, eax
jmp 0x1800c9ffe
cmp qword [rsp + 0x158], 0x10
jb 0x1800c96b7
mov rcx, qword [rsp + 0x140]
call fcn.1800f4b9c
mov qword [rsp + 0x158], 0xf
mov qword [rsp + 0x150], rbx
mov byte [rsp + 0x140], 0
mov r15, qword [rsp + 0x70]
jmp 0x1800c9709
mov r15, qword [rsp + 0x70]
jmp 0x1800c9709
mov r15, qword [rsp + 0x70]
jmp 0x1800c9709
mov r15, qword [rsp + 0x70]
jmp 0x1800c9709
mov r15, qword [rsp + 0x70]
jmp 0x1800c9709
mov r15, qword [rsp + 0x70]
jmp 0x1800c9709
mov r15, qword [rsp + 0x70]
jmp 0x1800c9709
mov r15, qword [rsp + 0x70]
cmp dword [0x18021adec], 0
je 0x1800c978b
cmp dword [0x1801e1bdc], 0
jne 0x1800c978b
cmp dword [0x18025a0a8], 0
je 0x1800c978b
cmp dword [0x1801e1bd8], 0
je 0x1800c978b
mov rax, qword [r15 + 0x10]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1800c978b
mov edx, 0x3a
call fcn.1800fc52c
mov rdi, rax
test rax, rax
je 0x1800c978b
mov dword [rsp + 0xa8], ebx
cmp dword [rsp + 0x978], 2
jne 0x1800c978b
lea rcx, [rax - 2]
call fcn.18005f5d0
test eax, eax
jne 0x1800c978b
lea r8, [rsp + 0xa8]
xor edx, edx
lea rcx, [rdi - 2]
call fcn.180066340
test eax, eax
jne 0x1800c978b
mov eax, 0xc0000022
jmp 0x1800c9ffe
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0x90], rbx
cmp dword [0x1801e68d0], 0
je 0x1800c99f5
call fcn.1800629a0
test eax, eax
je 0x1800c99f5
lea rdx, str._explorer.exe_
lea rcx, [0x18025c000]
call fcn.18010b680
test eax, eax
je 0x1800c99f5
mov ecx, 0x410
call fcn.1800f3cdc
mov rsi, rax
mov qword [rsp + 0x98], rax
mov ecx, 0x410
call fcn.1800f3cdc
mov r13, rax
mov qword [rsp + 0xa0], rax
mov ecx, 0x208
call fcn.1800f3cdc
mov r12, rax
mov qword [rsp + 0x90], rax
test rsi, rsi
je 0x1800c998b
test r13, r13
je 0x1800c998b
test rax, rax
je 0x1800c998b
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call fcn.1800f4fb0
xor edx, edx
mov r8d, 0x410
mov rcx, r13
call fcn.1800f4fb0
xor edx, edx
mov r8d, 0x410
mov rcx, rsi
call fcn.1800f4fb0
mov rdx, qword [r15 + 0x10]
test rdx, rdx
je 0x1800c9888
cmp qword [rdx + 8], 0
je 0x1800c9888
cmp word [rdx], 0
jbe 0x1800c9888
movzx r8d, word [rdx]
mov rdx, qword [rdx + 8]
mov rcx, rsi
call fcn.1800f6e10
mov rdx, r12
mov rcx, rsi
call fcn.1800417c0
mov rcx, r12
call fcn.1800fd3f0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x1800c9959
lea rdx, [0x180165c78]
mov rcx, rsi
call fcn.1800fe0a4
test eax, eax
je 0x1800c9959
mov r8d, 5
lea rdx, [0x180165c68]
mov rcx, rsi
call fcn.1800fcd4c
test eax, eax
je 0x1800c9959
mov edx, 0x5c
mov rcx, rsi
call fcn.1800fb920
test rax, rax
je 0x1800c9959
lea rdx, [0x1801602bc]
mov rcx, r12
call fcn.1800f4d08
test rax, rax
jne 0x1800c9959
mov dword [rsp + 0xa8], ebx
lea r8, [rsp + 0xa8]
mov edx, r14d
mov rcx, r12
call fcn.1800a2ed0
mov rcx, r12
call fcn.1800f8c70
mov rcx, r13
call fcn.1800f8c70
mov rcx, rsi
call fcn.1800f8c70
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0x98], rbx
jmp 0x1800c99f5
mov rcx, r12
call fcn.1800f8c70
mov rcx, r13
call fcn.1800f8c70
mov rcx, rsi
call fcn.1800f8c70
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0x98], rbx
jmp 0x1800c99f5
mov eax, dword [rsp + 0x990]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x980]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x978]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x970]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x968]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x88]
mov r8, r15
mov edx, r14d
mov rcx, qword [rsp + 0x68]
call qword [rsp + 0xb8]
jmp 0x1800c9ffe
mov qword [rsp + 0x180], 0xf
mov qword [rsp + 0x178], rbx
mov byte [rsp + 0x168], 0
xor r8d, r8d
lea rdx, [0x180152644]
lea rcx, [rsp + 0x160]
call fcn.180003700
nop
cmp dword [0x180221ea4], 0
je 0x1800c9be8
lea rdx, str.EXPLORER.EXE
lea rcx, [0x180259780]
call fcn.18010b680
test eax, eax
je 0x1800c9be8
test r14b, 2
jne 0x1800c9a75
test r14b, 0x10
jne 0x1800c9a75
test r14b, 4
jne 0x1800c9a75
bt r14d, 0x1e
jb 0x1800c9a75
bt r14d, 0x1c
jae 0x1800c9be8
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1a0]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x1800c9be1
lea rdx, str.VrvProtect
lea rcx, [rsp + 0x1a0]
call fcn.18010b680
test eax, eax
je 0x1800c9bda
mov r8d, 5
lea rdx, [0x18016790c]
lea rcx, [rsp + 0x1a0]
call fcn.18010c858
test eax, eax
je 0x1800c9bd3
mov edx, 0x5c
lea rcx, [rsp + 0x1a0]
call fcn.1800f7e94
test rax, rax
je 0x1800c9bd3
lea rdx, str.Pipe_
lea rcx, [rsp + 0x1a0]
call fcn.1800f4d08
test rax, rax
jne 0x1800c9bef
lea rax, [rsp + 0x100]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0x120], 0xf
mov qword [rsp + 0x118], rbx
mov byte [rsp + 0x108], 0
xor r8d, r8d
lea rdx, [0x180152644]
lea rcx, [rsp + 0x100]
call fcn.180003700
nop
lea rax, [rsp + 0x100]
mov qword [rsp + 0x28], rax
mov r12, qword [rsp + 0x68]
mov rax, qword [r12]
mov qword [rsp + 0x20], rax
mov r9d, r14d
lea r8, [rsp + 0x1a0]
mov edx, 1
lea rcx, [rsp + 0x130]
call fcn.1800b20b0
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x160]
call fcn.1800035e0
nop
cmp qword [rsp + 0x150], 0x10
jb 0x1800c9bb5
mov rcx, qword [rsp + 0x138]
call fcn.1800f4b9c
mov qword [rsp + 0x150], 0xf
mov qword [rsp + 0x148], rbx
mov byte [rsp + 0x138], 0
jmp 0x1800c9bf4
mov r12, qword [rsp + 0x68]
jmp 0x1800c9bf4
mov r12, qword [rsp + 0x68]
jmp 0x1800c9bf4
mov r12, qword [rsp + 0x68]
jmp 0x1800c9bf4
mov r12, qword [rsp + 0x68]
jmp 0x1800c9bf4
mov r12, qword [rsp + 0x68]
mov eax, dword [rsp + 0x990]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x980]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x978]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x970]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x968]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x88]
mov r8, r15
mov edx, r14d
mov rcx, r12
call qword [rsp + 0xb8]
mov esi, eax
cmp dword [0x180221ea4], 0
je 0x1800c9dca
lea rdx, str.EXPLORER.EXE
lea rcx, [0x180259780]
call fcn.18010b680
test eax, eax
je 0x1800c9dca
test r14b, 2
jne 0x1800c9ca5
test r14b, 0x10
jne 0x1800c9ca5
test r14b, 4
jne 0x1800c9ca5
bt r14d, 0x1e
jb 0x1800c9ca5
bt r14d, 0x1c
jae 0x1800c9dca
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1a0]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x1800c9dca
lea rdx, str.VrvProtect
lea rcx, [rsp + 0x1a0]
call fcn.18010b680
test eax, eax
je 0x1800c9dca
mov r8d, 5
lea rdx, [0x18016790c]
lea rcx, [rsp + 0x1a0]
call fcn.18010c858
test eax, eax
je 0x1800c9dca
mov edx, 0x5c
lea rcx, [rsp + 0x1a0]
call fcn.1800f7e94
test rax, rax
je 0x1800c9dca
lea rdx, str.Pipe_
lea rcx, [rsp + 0x1a0]
call fcn.1800f4d08
test rax, rax
jne 0x1800c9dca
lea rax, [rsp + 0x130]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0x150], 0xf
mov qword [rsp + 0x148], rbx
mov byte [rsp + 0x138], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x130]
call fcn.1800035e0
nop
lea rax, [rsp + 0x130]
mov qword [rsp + 0x28], rax
mov rax, qword [r12]
mov qword [rsp + 0x20], rax
mov r9d, r14d
lea r8, [rsp + 0x1a0]
xor edx, edx
lea rcx, [rsp + 0x100]
call fcn.1800b20b0
cmp qword [rsp + 0x120], 0x10
jb 0x1800c9dca
mov rcx, qword [rsp + 0x108]
call fcn.1800f4b9c
nop
cmp qword [rsp + 0x180], 0x10
jb 0x1800c9de2
mov rcx, qword [rsp + 0x168]
call fcn.1800f4b9c
mov qword [rsp + 0x180], 0xf
mov qword [rsp + 0x178], rbx
mov byte [rsp + 0x168], 0
mov eax, esi
jmp 0x1800c9ffe
mov eax, dword [rsp + 0x990]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x980]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x978]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x970]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x968]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9, rsi
mov r8, r15
mov edx, r14d
mov rcx, r13
call r12
jmp 0x1800c9ffe
mov r8d, 8
lea rdx, str.Device_
lea rcx, [rsp + 0x3c0]
call fcn.1800fcd4c
test eax, eax
jne 0x1800c9eed
mov eax, dword [rsp + 0x990]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x980]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x978]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x970]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x968]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9, rsi
mov r8, r15
mov edx, r14d
mov rcx, r13
call r12
jmp 0x1800c9ffe
mov eax, dword [rsp + 0x990]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x980]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x978]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x970]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x968]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9, rsi
mov r8, r15
mov edx, r14d
mov rcx, r13
call r12
jmp 0x1800c9ffe
mov eax, dword [rsp + 0x990]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x980]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x978]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x970]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x968]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9, rsi
mov r8, r15
mov edx, r14d
mov rcx, r13
call r12
jmp 0x1800c9ffe
mov eax, dword [rsp + 0x990]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x980]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x978]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x970]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x968]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9, rsi
mov r8, r15
mov edx, r14d
mov rcx, r13
call r12
nop
mov rcx, qword [rsp + 0x8f0]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0x900
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret