Function at 0x180003f00
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov rdi, rcx
lea rcx, [0x180083238]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rcx, str.kernel32.dll
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r13, rax
call fcn.18001bb90
test eax, 0xfffffffc
jne 0x1800045f4
cmp eax, 2
je 0x1800045f4
mov qword [rsp + 0x398], rbx
lea rcx, [0x180083238]
mov qword [rsp + 0x3a0], rsi
mov qword [rsp + 0x3a8], r15
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, listen
lea r14, [0x180084ce8]
test rax, rax
jne 0x180003f8e
mov eax, esi
jmp 0x180003fce
lea rdx, str.NtOpenFile
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x180003faa
mov eax, listen
jmp 0x180003fce
lea r8, [0x180095870]
mov rcx, rax
lea rdx, [0x180003420]
call fcn.18001bc20
test eax, eax
je 0x18000400d
cmp eax, 1
je 0x18000400d
cmp eax, 3
je 0x18000400d
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x20]
lea rax, [rsp + 0x20]
mov qword [rsp + 0x20], r14
mov rdx, rdi
mov qword [rsp + 0x58], rax
call fcn.180008f00
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x180004009
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor bl, bl
jmp 0x18000400f
mov bl, 1
lea rcx, [0x180083238]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x180004025
mov eax, esi
jmp 0x180004065
lea rdx, str.NtClose
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x180004041
mov eax, listen
jmp 0x180004065
lea r8, [0x180095880]
mov rcx, rax
lea rdx, [0x180003a20]
call fcn.18001bc20
test eax, eax
je 0x1800040a3
cmp eax, 1
je 0x1800040a3
cmp eax, 3
je 0x1800040a3
mov dword [rsp + 0x68], eax
lea rcx, [rsp + 0x60]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], r14
mov rdx, rdi
mov qword [rbp - 0x68], rax
call fcn.180008f00
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x18000409e
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor r15b, r15b
jmp 0x1800040a6
mov r15b, 1
lea rcx, [0x180083238]
and r15b, bl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x1800040bf
mov eax, esi
jmp 0x1800040ff
lea rdx, str.NtCreateSection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1800040db
mov eax, listen
jmp 0x1800040ff
lea r8, [0x180095888]
mov rcx, rax
lea rdx, [0x1800038e0]
call fcn.18001bc20
test eax, eax
je 0x180004136
cmp eax, 1
je 0x180004136
cmp eax, 3
je 0x180004136
mov dword [rbp - 0x58], eax
lea rcx, [rbp - 0x60]
lea rax, [rbp - 0x60]
mov qword [rbp - 0x60], r14
mov rdx, rdi
mov qword [rbp - 0x28], rax
call fcn.180008f00
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x180004133
mov rax, qword [rcx]
lea rdx, [rbp - 0x60]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor r15b, r15b
lea rcx, [0x180083238]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x18000414c
mov eax, esi
jmp 0x18000418c
lea rdx, str.NtQueryAttributesFile
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x180004168
mov eax, listen
jmp 0x18000418c
lea r8, [0x180095868]
mov rcx, rax
lea rdx, [0x180003990]
call fcn.18001bc20
test eax, eax
je 0x1800041c4
cmp eax, 1
je 0x1800041c4
cmp eax, 3
je 0x1800041c4
mov dword [rbp - 0x18], eax
lea rcx, [rbp - 0x20]
lea rax, [rbp - 0x20]
mov qword [rbp - 0x20], r14
mov rdx, rdi
mov qword [rbp + 0x18], rax
call fcn.180008f00
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x1800041c0
mov rax, qword [rcx]
lea rdx, [rbp - 0x20]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor bl, bl
jmp 0x1800041c6
mov bl, 1
lea rcx, str.kernel32.dll
and bl, r15b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r15, qword [rsp + 0x3a8]
test rax, rax
jne 0x1800041e7
mov eax, esi
jmp 0x180004227
lea rdx, [0x180083290]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x180004203
mov eax, listen
jmp 0x180004227
lea r8, [0x180095878]
mov rcx, rax
lea rdx, [0x180003490]
call fcn.18001bc20
test eax, eax
je 0x18000425d
cmp eax, 1
je 0x18000425d
cmp eax, 3
je 0x18000425d
mov dword [rbp + 0x28], eax
lea rcx, [rbp + 0x20]
lea rax, [rbp + 0x20]
mov qword [rbp + 0x20], r14
mov rdx, rdi
mov qword [rbp + 0x58], rax
call fcn.180008f00
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x18000425b
mov rax, qword [rcx]
lea rdx, [rbp + 0x20]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor bl, bl
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800042af
lea rdx, [0x1800832a0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x180004289
lea esi, [rax + 0xc]
jmp 0x1800042af
lea r8, [0x180095860]
mov rcx, rax
lea rdx, [0x1800036c0]
call fcn.18001bc20
mov esi, eax
test eax, eax
je 0x1800042ed
cmp eax, 1
je 0x1800042ed
cmp eax, 3
je 0x1800042ed
lea rax, [rbp + 0x60]
mov qword [rbp + 0x60], r14
mov rdx, rdi
mov qword [rbp + 0x98], rax
lea rcx, [rbp + 0x60]
mov dword [rbp + 0x68], esi
call fcn.180008f00
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x1800042e9
mov rax, qword [rcx]
lea rdx, [rbp + 0x60]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor al, al
jmp 0x1800042ef
mov al, 1
mov rsi, qword [rsp + 0x3a0]
and bl, al
je 0x1800045d9
lea rdx, str.NtOpenFile
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov edx, 1
call fcn.18001bf10
test eax, 0xfffffffc
jne 0x180004328
cmp eax, 2
jne 0x180004373
mov dword [rbp + 0xa8], eax
lea rcx, [rbp + 0xa0]
lea rax, [rbp + 0xa0]
mov qword [rbp + 0xa0], r14
mov rdx, rdi
mov qword [rbp + 0xd8], rax
call fcn.180008f00
mov rcx, qword [rbp + 0xd8]
test rcx, rcx
je 0x180004371
mov rax, qword [rcx]
lea r8, [rbp + 0xa0]
cmp rcx, r8
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor bl, bl
lea rdx, str.NtClose
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov edx, 1
call fcn.18001bf10
test eax, 0xfffffffc
jne 0x1800043a0
cmp eax, 2
je 0x1800043a0
mov al, 1
jmp 0x1800043eb
mov dword [rbp + 0xe8], eax
lea rcx, [rbp + 0xe0]
lea rax, [rbp + 0xe0]
mov qword [rbp + 0xe0], r14
mov rdx, rdi
mov qword [rbp + 0x118], rax
call fcn.180008f00
mov rcx, qword [rbp + 0x118]
test rcx, rcx
je 0x1800043e9
mov rax, qword [rcx]
lea r8, [rbp + 0xe0]
cmp rcx, r8
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor al, al
lea rdx, str.NtCreateSection
mov rcx, r12
and bl, al
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov edx, 1
call fcn.18001bf10
test eax, 0xfffffffc
jne 0x180004416
cmp eax, 2
jne 0x180004461
mov dword [rbp + 0x128], eax
lea rcx, [rbp + 0x120]
lea rax, [rbp + 0x120]
mov qword [rbp + 0x120], r14
mov rdx, rdi
mov qword [rbp + 0x158], rax
call fcn.180008f00
mov rcx, qword [rbp + 0x158]
test rcx, rcx
je 0x18000445f
mov rax, qword [rcx]
lea r8, [rbp + 0x120]
cmp rcx, r8
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor bl, bl
lea rdx, str.NtQueryAttributesFile
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov edx, 1
call fcn.18001bf10
test eax, 0xfffffffc
jne 0x18000448e
cmp eax, 2
je 0x18000448e
mov al, 1
jmp 0x1800044d9
mov dword [rbp + 0x168], eax
lea rcx, [rbp + 0x160]
lea rax, [rbp + 0x160]
mov qword [rbp + 0x160], r14
mov rdx, rdi
mov qword [rbp + 0x198], rax
call fcn.180008f00
mov rcx, qword [rbp + 0x198]
test rcx, rcx
je 0x1800044d7
mov rax, qword [rcx]
lea r8, [rbp + 0x160]
cmp rcx, r8
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor al, al
lea rdx, [0x180083290]
mov rcx, r13
and bl, al
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov edx, 1
call fcn.18001bf10
test eax, 0xfffffffc
jne 0x180004504
cmp eax, 2
jne 0x18000454f
mov dword [rbp + 0x1a8], eax
lea rcx, [rbp + 0x1a0]
lea rax, [rbp + 0x1a0]
mov qword [rbp + 0x1a0], r14
mov rdx, rdi
mov qword [rbp + 0x1d8], rax
call fcn.180008f00
mov rcx, qword [rbp + 0x1d8]
test rcx, rcx
je 0x18000454d
mov rax, qword [rcx]
lea r8, [rbp + 0x1a0]
cmp rcx, r8
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor bl, bl
lea rdx, [0x1800832a0]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov edx, 1
call fcn.18001bf10
test eax, 0xfffffffc
jne 0x18000457c
cmp eax, 2
je 0x18000457c
mov al, 1
jmp 0x1800045c7
mov dword [rbp + 0x1e8], eax
lea rcx, [rbp + 0x1e0]
lea rax, [rbp + 0x1e0]
mov qword [rbp + 0x1e0], r14
mov rdx, rdi
mov qword [rbp + 0x218], rax
call fcn.180008f00
mov rcx, qword [rbp + 0x218]
test rcx, rcx
je 0x1800045c5
mov rax, qword [rcx]
lea rdx, [rbp + 0x1e0]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor al, al
and bl, al
mov byte [rdi + 0x80], bl
jne 0x1800045d9
mov rcx, rdi
call sym.anonymous.dll_public:_void___cdecl_DllManager::DisableDllRedirection_void____ptr64
movzx eax, bl
mov rbx, qword [rsp + 0x398]
add rsp, 0x360
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
mov dword [rbp + 0x228], eax
lea r14, [0x180084ce8]
lea rax, [rbp + 0x220]
mov qword [rbp + 0x220], r14
mov rdx, rdi
mov qword [rbp + 0x258], rax
lea rcx, [rbp + 0x220]
call fcn.180008f00
mov rcx, qword [rbp + 0x258]
test rcx, rcx
je 0x180004644
mov rax, qword [rcx]
lea rdx, [rbp + 0x220]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor al, al
add rsp, 0x360
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret