Function at 0x1800caf40
Capabilities:
Link many functions at runtime

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov rbx, rcx
test edx, edx
je 0x1800cb50e
cmp edx, 1
jne 0x1800cb75d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x1801e1b14], eax
mov qword [0x1801e1b68], rbx
mov r9d, 0x12c
lea r8, [0x180259780]
mov edx, r9d
lea rcx, [0x180259650]
call fcn.18005f2a0
lea r8, [0x180259780]
lea rdx, [0x180153844]
lea rcx, [0x18025c000]
call fcn.1800f509c
lea rdx, str.VRVRF_C.EXE
lea rcx, [0x180259780]
call fcn.18010b680
test eax, eax
je 0x1800cb4f7
lea rdx, str.VRVRF_C64.EXE
lea rcx, [0x180259780]
call fcn.18010b680
test eax, eax
je 0x1800cb4f7
call fcn.180060d80
test eax, eax
je 0x1800caffa
mov eax, 1
jmp 0x1800cb762
lea rcx, [0x1801e0080]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rdx, [0x18006bca0]
lea rcx, str.VrvPrtMem0920
call fcn.1800df1b0
mov qword [0x1802665b0], rax
test rax, rax
je 0x1800cb02e
mov rcx, rax
call fcn.18006bcc0
lea rcx, [0x18025c000]
call fcn.18005ed20
test eax, eax
je 0x1800cb062
mov rcx, qword [0x1802665b0]
test rcx, rcx
je 0x1800cb058
call fcn.1800df260
xor edi, edi
mov qword [0x1802665b0], rdi
mov eax, 1
jmp 0x1800cb762
lea rcx, [0x180259780]
call fcn.18005ec90
test eax, eax
je 0x1800cb096
mov rcx, qword [0x1802665b0]
test rcx, rcx
je 0x1800cb08c
call fcn.1800df260
xor edi, edi
mov qword [0x1802665b0], rdi
mov eax, 1
jmp 0x1800cb762
call fcn.18005bad0
call fcn.18006ba60
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov dword [0x1801b0424], eax
mov dword [0x1801b1254], eax
mov ecx, 0xa0
call fcn.1800f6bd4
mov qword [rsp + 0x78], rax
xor edi, edi
test rax, rax
je 0x1800cb0d2
mov rcx, rax
call fcn.18000c5b0
jmp 0x1800cb0d5
mov rax, rdi
mov qword [0x1801e1bb0], rax
lea rcx, [0x180259780]
call fcn.1800cabb0
lea rdx, [0x180259650]
lea rcx, [0x180259780]
call fcn.18005caf0
call fcn.1800ca7f0
lea rcx, [0x1801def58]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x1801e01a8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x1801dff80]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x1801e0108]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x1801e00e0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x1801e0180]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x1801e0158]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x1801e0130]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x18028d3d8]
call fcn.18007f430
lea rcx, str.TianjinGA.dat
call fcn.180060960
test eax, eax
je 0x1800cb201
mov dword [0x18025c99c], 1
mov r8d, 1
lea rdx, str.edpscr.dll
lea rcx, [rsp + 0x28]
call fcn.18001f690
nop
cmp qword [rax + 0x20], 0x10
jb 0x1800cb1b3
mov rcx, qword [rax + 8]
jmp 0x1800cb1b7
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
cmp qword [rsp + 0x48], 0x10
jb 0x1800cb1d2
mov rcx, qword [rsp + 0x30]
call fcn.1800f4b9c
mov qword [rsp + 0x48], 0xf
mov qword [rsp + 0x40], rdi
mov byte [rsp + 0x30], 0
test rbx, rbx
je 0x1800cb201
lea rdx, str.EDPCaptureBackFile
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1801e1ba8], rax
lea rcx, [0x180152d90]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x1800cb289
lea rdx, str.NtQueryInformationThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1801e1b78], rax
lea rdx, str.NtQueryInformationProcess
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1801e1b70], rax
lea rdx, str.NtQueryObject
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1801e1b80], rax
lea rdx, str.RtlCreateUserThread
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1801e1b98], rax
lea rdx, str.NtResumeThread
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1801e1ba0], rax
lea rcx, str.Psapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x1800cb2b2
lea rdx, str.GetMappedFileNameA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1801e1b88], rax
cmp dword [0x180217624], 0
je 0x1800cb2c6
call fcn.1800690f0
mov dword [0x18025c77c], eax
cmp dword [0x180220be4], 0
je 0x1800cb2e8
call fcn.180060250
mov dword [0x18025b318], eax
cmp dword [0x180220be4], 0
je 0x1800cb2e8
call fcn.1800601c0
lea r8, [0x1801e1bd8]
lea rdx, [0x1801e1bdc]
lea rcx, [0x180259780]
call fcn.18008df40
cmp dword [0x18021adec], 0
je 0x1800cb340
lea rcx, [0x18028d540]
call fcn.180026870
mov edx, dword [0x1801e1bd8]
lea rcx, [0x18028d540]
call fcn.1800253d0
mov edx, dword [0x18021adf4]
lea rcx, [0x18028d540]
call fcn.1800253e0
call fcn.18006fc70
cmp dword [0x1801e3950], 0
je 0x1800cb360
cmp dword [0x1801e4960], 0
jne 0x1800cb35b
cmp dword [0x1801e59cc], 0
je 0x1800cb360
call fcn.18005fbd0
mov ecx, 0xf0
call fcn.1800f6bd4
mov qword [rsp + 0x78], rax
test rax, rax
je 0x1800cb37e
mov rcx, rax
call fcn.18003e7a0
jmp 0x1800cb381
mov rax, rdi
mov qword [0x1801e0238], rax
mov ecx, 0x68
call fcn.1800f6bd4
mov qword [rsp + 0x78], rax
test rax, rax
je 0x1800cb3a6
mov rcx, rax
call fcn.180036460
jmp 0x1800cb3a9
mov rax, rdi
mov qword [0x1801e1af0], rax
mov ecx, 0x68
call fcn.1800f6bd4
mov qword [rsp + 0x78], rax
test rax, rax
je 0x1800cb3ce
mov rcx, rax
call fcn.180034680
jmp 0x1800cb3d1
mov rax, rdi
mov qword [0x1801e1af8], rax
mov ecx, 0x68
call fcn.1800f6bd4
mov qword [rsp + 0x78], rax
test rax, rax
je 0x1800cb3f6
mov rcx, rax
call fcn.1800363f0
jmp 0x1800cb3f9
mov rax, rdi
mov qword [0x1801e1b00], rax
mov ecx, 0x60
call fcn.1800f6bd4
mov qword [rsp + 0x78], rax
test rax, rax
je 0x1800cb41f
mov rcx, rax
call fcn.18003aaf0
mov rdi, rax
mov qword [0x1801e1b08], rdi
cmp dword [0x1802548cc], 0
je 0x1800cb479
lea rdx, str.FOXMAIL.EXE
lea rcx, [0x180259780]
call fcn.18010b680
test eax, eax
je 0x1800cb474
lea rdx, str.OUTLOOK.EXE
lea rcx, [0x180259780]
call fcn.18010b680
test eax, eax
je 0x1800cb474
lea rdx, str.wlmail.EXE
lea rcx, [0x180259780]
call fcn.18010b680
test eax, eax
jne 0x1800cb479
call fcn.180025010
mov rcx, qword [0x1801e1bb0]
call fcn.18000c330
cmp eax, 1
jne 0x1800cb4ed
cmp dword [0x1801fb4b0], 0
je 0x1800cb4aa
mov edx, 0x12c
mov r9d, eax
mov r8d, edx
lea rcx, [0x1802666e0]
call fcn.1800dc950
lea rdx, str._DllMain_
lea rcx, [0x180153a08]
call fcn.18005cd20
xor edx, edx
lea rcx, [0x18028d500]
call fcn.18000c960
lea rdx, [0x180167b50]
lea rcx, [0x180153a08]
call fcn.18005cd20
mov dword [0x18025caa4], 1
jmp 0x1800cb75d
mov eax, 1
jmp 0x1800cb762
lea rcx, str.prthook64.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, 1
jmp 0x1800cb762
cmp dword [0x18025caa4], 0
je 0x1800cb669
xor edi, edi
mov dword [0x18025caa4], edi
mov rcx, qword [0x1802665b0]
test rcx, rcx
je 0x1800cb53b
call fcn.1800df260
mov qword [0x1802665b0], rdi
lea rcx, [0x18028d500]
call fcn.18000c9f0
lea rcx, [0x1802666e0]
call fcn.1800dad80
cmp qword [0x1801de338], rdi
je 0x1800cb59a
mov rdx, qword [0x1801de330]
mov rdx, qword [rdx + 8]
lea rcx, [0x1801de300]
call fcn.1800098f0
mov r11, qword [0x1801de330]
mov qword [r11 + 8], r11
mov qword [0x1801de338], rdi
mov rax, qword [0x1801de330]
mov qword [rax], rax
mov rax, qword [0x1801de330]
mov qword [rax + 0x10], rax
cmp qword [0x1801de2f0], rdi
je 0x1800cb5e4
mov rax, qword [0x1801de2e8]
mov rcx, qword [rax]
mov qword [rax], rax
mov rax, qword [0x1801de2e8]
mov qword [rax + 8], rax
mov qword [0x1801de2f0], rdi
cmp rcx, qword [0x1801de2e8]
je 0x1800cb5e4
nop dword [rax + rax]
mov rbx, qword [rcx]
call fcn.1800f4b9c
mov rcx, rbx
cmp rbx, qword [0x1801de2e8]
jne 0x1800cb5d0
mov rcx, qword [0x1801e0078]
test rcx, rcx
je 0x1800cb5fd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1801e0078], rdi
cmp dword [0x1801f6418], 1
jne 0x1800cb617
mov rcx, qword [0x1801e1bc8]
test rcx, rcx
je 0x1800cb617
call fcn.1800f8c70
cmp dword [0x1802548cc], edi
je 0x1800cb669
lea rdx, str.FOXMAIL.EXE
lea rcx, [0x180259780]
call fcn.18010b680
test eax, eax
je 0x1800cb664
lea rdx, str.OUTLOOK.EXE
lea rcx, [0x180259780]
call fcn.18010b680
test eax, eax
je 0x1800cb664
lea rdx, str.WLMAIL.EXE
lea rcx, [0x180259780]
call fcn.18010b680
test eax, eax
jne 0x1800cb669
call fcn.180017930
mov rbx, qword [0x1801e0238]
test rbx, rbx
je 0x1800cb685
mov rcx, rbx
call fcn.18003ce50
mov rcx, rbx
call fcn.1800f4b9c
mov rbx, qword [0x1801e1af0]
test rbx, rbx
je 0x1800cb6a1
mov rcx, rbx
call fcn.1800364e0
mov rcx, rbx
call fcn.1800f4b9c
mov rbx, qword [0x1801e1af8]
test rbx, rbx
je 0x1800cb6bd
mov rcx, rbx
call fcn.180034700
mov rcx, rbx
call fcn.1800f4b9c
mov rbx, qword [0x1801e1b00]
test rbx, rbx
je 0x1800cb6d9
mov rcx, rbx
call fcn.1800361c0
mov rcx, rbx
call fcn.1800f4b9c
mov rbx, qword [0x1801e1b08]
test rbx, rbx
je 0x1800cb6f5
mov rcx, rbx
call fcn.18003a190
mov rcx, rbx
call fcn.1800f4b9c
lea rcx, [0x1801e01a8]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x1801def58]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x1801dff80]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x1801e0108]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x1801e00e0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x1801e0180]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x1801e0158]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x1801e0130]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, 1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret