Function at 0x1800035d0
Capabilities:
Create thread
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x630
mov rax, qword [0x180030040]
xor rax, rsp
mov qword [rsp + 0x620], rax
call section..text
mov r8d, 0x104
mov qword [0x180031e18], rax
lea rdx, [0x180031e30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [0x180031e30]
call fcn.180003d90
mov rdi, qword [0x180031e18]
xor esi, esi
mov rbx, rax
mov r9d, esi
mov r11d, dword [rdi + 8]
test r11d, r11d
jle 0x18000367f
mov rdi, qword [rdi]
nop dword [rax]
movsxd rcx, r9d
mov r8, rbx
lea r10, [rcx + rcx*4]
shl r10, 4
add r10, rdi
mov rax, r10
sub r8, r10
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180003673
inc rax
test ecx, ecx
jne 0x180003660
test edx, edx
je 0x1800036ba
inc r9d
cmp r9d, r11d
jl 0x180003640
mov qword [0x180031e10], rsi
mov rdx, rbx
lea rcx, str.Unsupported_app_version:__s_n
call fcn.1800028c0
mov rcx, qword [rsp + 0x620]
xor rcx, rsp
call fcn.180008070
lea r11, [rsp + 0x630]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov rax, qword [r10 + 0x48]
mov qword [0x180031e10], rax
test rax, rax
je 0x180003686
xor r8d, r8d
mov dword [0x180031db4], esi
xor edx, edx
mov qword [0x180031dc0], rsi
xor ecx, ecx
mov qword [0x180031db8], rsi
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [0x180031dc8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
lea r8, [0x180002a80]
mov qword [0x180031da0], rax
xor edx, edx
mov dword [rsp + 0x20], esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov qword [0x180031da8], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, rax
lea rcx, str.Hooked__base:__llX_n
mov rbx, rax
call fcn.1800028c0
lea rcx, str.Correct_client_version__hooking_n
call fcn.1800028c0
mov rdx, qword [0x180031e10]
mov ecx, dword [rdx + 0x48]
add rcx, rbx
mov qword [0x180031e08], rcx
mov ecx, dword [rdx + 0x4c]
lea rdx, [rsp + 0x30]
add rcx, rbx
mov qword [0x180031e00], rcx
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r9, [rsp + 0x30]
mov edx, 0x3e8
lea r8, str._s888logs.txt
lea rcx, [rsp + 0x230]
call fcn.180003b80
lea rdx, [rsp + 0x230]
lea rcx, str.Opening_log_file_at__s_n
call fcn.1800028c0
lea rdx, [0x18002c768]
lea rcx, [rsp + 0x230]
call fcn.180011ef0
mov qword [0x180031df8], rax
test rax, rax
jne 0x1800037e2
lea rcx, str.Error_opening_log_file_for_writing_n
call fcn.1800028c0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, qword [0x180031e10]
mov edx, dword [rcx + 0x50]
xor ecx, ecx
add rax, rdx
mov qword [0x180031d98], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, qword [0x180031e10]
mov edx, dword [rcx + 0x54]
xor ecx, ecx
add rax, rdx
mov qword [0x180031d90], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, qword [0x180031e10]
mov edx, dword [rcx + 0x58]
add rax, rdx
mov qword [0x180031d88], rax
call fcn.180003bf0
mov rdi, rax
call fcn.180006600
mov edx, eax
lea rcx, str.DetourTransactionBegin:__08X_n
call fcn.1800028c0
mov rbx, rdi
test rdi, rdi
je 0x180003886
nop dword [rax]
mov rcx, qword [rbx]
call fcn.180006b20
mov r8, qword [rbx]
lea rcx, str.DetourUpdateThread:__d__08X__08X_n
mov edx, dword [rbx + 8]
mov r9d, eax
call fcn.1800028c0
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x180003860
lea rdx, [0x1800030c0]
lea rcx, [0x180031d98]
call fcn.180005bb0
mov edx, eax
lea rcx, str.ProcessNetworkManager_attach:__08X_n
call fcn.1800028c0
lea rdx, [0x180003190]
lea rcx, [0x180031d90]
call fcn.180005bb0
mov edx, eax
lea rcx, str.LoadTableArea_attach:__08X_n
call fcn.1800028c0
lea rdx, [0x180003230]
lea rcx, [0x180031d88]
call fcn.180005bb0
mov edx, eax
lea rcx, str.UpdateAmountsFormatInfo_attach:__08X_n
call fcn.1800028c0
call fcn.180006670
mov edx, eax
lea rcx, str.DetourTransactionCommit:__08X_n
call fcn.1800028c0
test rdi, rdi
je 0x180003913
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rdi + 0x10]
test rdi, rdi
jne 0x180003901
lea rcx, str.Hook_complete_n
call fcn.1800028c0
mov dword [0x180031db0], 1
jmp 0x180003695