Function at 0x18000f250
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x870
mov rax, qword [0x180025450]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov edi, edx
lea rcx, [rsp + 0x42]
xor esi, esi
xor edx, edx
mov r8d, 0x40e
mov word [rsp + 0x40], si
call fcn.180015840
lea rcx, [rsp + 0x452]
xor edx, edx
mov r8d, 0x40e
mov word [rsp + 0x450], si
call fcn.180015840
mov ecx, 0x104
call fcn.180011fa0
mov rbx, rax
test edi, edi
je 0x18000f4e4
dec edi
jne 0x18000f532
lea rdx, [rsp + 0x40]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp dword [section..ipc], esi
jne 0x18000f38e
lea edx, [rsi + 0x5c]
lea rcx, [rsp + 0x40]
call fcn.180011fc4
mov r8, rax
test rax, rax
je 0x18000f532
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x180055120]
repne scasw ax, word [rdi]
add r8, 2
xor edx, edx
movzx eax, word [r8 + rdx]
add rdx, 2
mov word [rdi + rdx - 4], ax
test ax, ax
jne 0x18000f322
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x180055010]
repne scasb al, byte [rdi]
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rbx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x18000f370
mov dword [section..ipc], 1
jmp 0x18000f532
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtQuerySystemInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180052bf8], rax
test rax, rax
je 0x18000f3ca
lea rdx, [0x18000f560]
lea rcx, [0x180052bf8]
call fcn.18000ec10
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.Process32First
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180052c00], rax
test rax, rax
je 0x18000f406
lea rdx, [0x18000f680]
lea rcx, [0x180052c00]
call fcn.18000ec10
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.Process32Next
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180052c08], rax
test rax, rax
je 0x18000f442
lea rdx, [0x18000f790]
lea rcx, [0x180052c08]
call fcn.18000ec10
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.Process32FirstW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180052c10], rax
test rax, rax
je 0x18000f47e
lea rdx, [0x18000f8a0]
lea rcx, [0x180052c10]
call fcn.18000ec10
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.Process32NextW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x180052c08], rsi
mov qword [0x180052c18], rax
je 0x18000f4be
lea rdx, [0x18000f9b0]
lea rcx, [0x180052c18]
call fcn.18000ec10
lea rdx, [rsp + 0x450]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x450]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x18000f532
lea rcx, [0x180052bf8]
call fcn.18000f080
lea rcx, [0x180052c00]
call fcn.18000f080
lea rcx, [0x180052c08]
call fcn.18000f080
lea rcx, [0x180052c10]
call fcn.18000f080
lea rcx, [0x180052c18]
call fcn.18000f080
mov rcx, qword [0x180052c20]
test rcx, rcx
je 0x18000f532
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.180010a70
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret