Function at 0x180013240
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
sub rsp, 0x8b0
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x880], rbx
mov qword [rbp + 0x888], rsi
mov qword [rbp + 0x890], rdi
mov qword [rbp + 0x898], r12
mov rax, qword [0x1800964f0]
xor rax, rbp
mov qword [rbp + 0x860], rax
lea rcx, [0x1800809b0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x1800134cc
lea rdx, str.RtlInitUnicodeString
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlEqualUnicodeString
mov rcx, rbx
mov qword [0x18009f650], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwOpenDirectoryObject
mov rcx, rbx
mov qword [0x18009f648], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwQueryDirectoryObject
mov rcx, rbx
mov qword [0x18009f638], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwOpenSymbolicLinkObject
mov rcx, rbx
mov qword [0x18009f628], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwQuerySymbolicLinkObject
mov rcx, rbx
mov qword [0x18009f640], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180081148]
mov rcx, rbx
mov qword [0x18009f658], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.global__
lea rcx, [rbp + 0x40]
mov qword [0x18009f630], rax
call qword [0x18009f650]
xor esi, esi
lea rax, [rbp + 0x40]
lea r8, [rbp + 0x10]
lea rcx, [rbp]
lea edx, [rsi + 1]
mov dword [rbp + 0x10], gethostbyname
mov qword [rbp + 0x18], rsi
mov dword [rbp + 0x28], 0x40
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x38], rsi
call qword [0x18009f638]
test eax, eax
jne 0x1800134cc
lea rcx, [rbp + 0x61]
xor edx, edx
mov r8d, 0x7ff
mov byte [rbp + 0x60], sil
call fcn.180055310
lea rdx, str.SymbolicLink
lea rcx, [rbp + 0x50]
mov dword [rbp + 8], esi
mov dword [rbp + 0xc], esi
call qword [0x18009f650]
lea ecx, [rsi + 2]
mov edx, 0x400
call fcn.180052404
test rax, rax
je 0x1800134c2
movabs r12, 0xffffffffffffff0
nop
mov rcx, qword [rbp]
lea rax, [rbp + 0xc]
lea rdx, [rbp + 0x60]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 8]
mov r9b, 1
mov qword [rsp + 0x28], rax
mov r8d, 0x800
mov byte [rsp + 0x20], sil
call qword [0x18009f628]
test eax, eax
jne 0x1800134c2
mov rdi, qword [rbp + 0x68]
test rdi, rdi
je 0x180013484
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9d, [rax + 1]
cmp r9d, 0x3fffffff
jg 0x180013484
movsxd rax, r9d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x180013437
mov rcx, r12
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.18006ba40
sub rsp, rcx
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x180013484
lea eax, [r9 + r9]
mov qword [rsp + 0x38], rsi
xor edx, edx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], eax
lea ecx, [rdx + 3]
or r9d, 0xffffffff
mov r8, rdi
mov byte [rbx], sil
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rbx, rsi
jmp 0x180013487
mov rbx, rsi
lea rdx, str.Symbol_Link_Name_Is__s
mov r8, rbx
xor ecx, ecx
call fcn.180028980
mov rcx, qword [rbp + 0x68]
lea rdx, str.AdHunterCDO
call fcn.180052448
test rax, rax
je 0x1800133d0
mov rcx, qword [rbp]
call qword [0x18009f630]
mov eax, 1
jmp 0x1800134ce
mov rcx, qword [rbp]
call qword [0x18009f630]
xor eax, eax
mov rcx, qword [rbp + 0x860]
xor rcx, rbp
call fcn.180050540
mov rbx, qword [rbp + 0x880]
mov rsi, qword [rbp + 0x888]
mov rdi, qword [rbp + 0x890]
mov r12, qword [rbp + 0x898]
lea rsp, [rbp + 0x870]
pop rbp
ret