Function at 0x180003ed0
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov rdi, rcx
lea rcx, [0x1800821f8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rcx, str.kernel32.dll
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r13, rax
call fcn.18001b220
test eax, 0xfffffffc
jne 0x1800045c4
cmp eax, 2
je 0x1800045c4
mov qword [rsp + 0x398], rbx
lea rcx, [0x1800821f8]
mov qword [rsp + 0x3a0], rsi
mov qword [rsp + 0x3a8], r15
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, ntohs
lea r14, [0x180083ca8]
test rax, rax
jne 0x180003f5e
mov eax, esi
jmp 0x180003f9e
lea rdx, str.NtOpenFile
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x180003f7a
mov eax, ntohs
jmp 0x180003f9e
lea r8, [0x180094780]
mov rcx, rax
lea rdx, [0x1800033f0]
call fcn.18001b2b0
test eax, eax
je 0x180003fdd
cmp eax, 1
je 0x180003fdd
cmp eax, 3
je 0x180003fdd
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x20]
lea rax, [rsp + 0x20]
mov qword [rsp + 0x20], r14
mov rdx, rdi
mov qword [rsp + 0x58], rax
call fcn.180008fa0
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x180003fd9
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor bl, bl
jmp 0x180003fdf
mov bl, 1
lea rcx, [0x1800821f8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x180003ff5
mov eax, esi
jmp 0x180004035
lea rdx, str.NtClose
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x180004011
mov eax, ntohs
jmp 0x180004035
lea r8, [0x180094790]
mov rcx, rax
lea rdx, [0x1800039f0]
call fcn.18001b2b0
test eax, eax
je 0x180004073
cmp eax, 1
je 0x180004073
cmp eax, 3
je 0x180004073
mov dword [rsp + 0x68], eax
lea rcx, [rsp + 0x60]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], r14
mov rdx, rdi
mov qword [rbp - 0x68], rax
call fcn.180008fa0
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x18000406e
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor r15b, r15b
jmp 0x180004076
mov r15b, 1
lea rcx, [0x1800821f8]
and r15b, bl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x18000408f
mov eax, esi
jmp 0x1800040cf
lea rdx, str.NtCreateSection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1800040ab
mov eax, ntohs
jmp 0x1800040cf
lea r8, [0x180094798]
mov rcx, rax
lea rdx, [0x1800038b0]
call fcn.18001b2b0
test eax, eax
je 0x180004106
cmp eax, 1
je 0x180004106
cmp eax, 3
je 0x180004106
mov dword [rbp - 0x58], eax
lea rcx, [rbp - 0x60]
lea rax, [rbp - 0x60]
mov qword [rbp - 0x60], r14
mov rdx, rdi
mov qword [rbp - 0x28], rax
call fcn.180008fa0
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x180004103
mov rax, qword [rcx]
lea rdx, [rbp - 0x60]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor r15b, r15b
lea rcx, [0x1800821f8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x18000411c
mov eax, esi
jmp 0x18000415c
lea rdx, str.NtQueryAttributesFile
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x180004138
mov eax, ntohs
jmp 0x18000415c
lea r8, [0x180094778]
mov rcx, rax
lea rdx, [0x180003960]
call fcn.18001b2b0
test eax, eax
je 0x180004194
cmp eax, 1
je 0x180004194
cmp eax, 3
je 0x180004194
mov dword [rbp - 0x18], eax
lea rcx, [rbp - 0x20]
lea rax, [rbp - 0x20]
mov qword [rbp - 0x20], r14
mov rdx, rdi
mov qword [rbp + 0x18], rax
call fcn.180008fa0
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x180004190
mov rax, qword [rcx]
lea rdx, [rbp - 0x20]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor bl, bl
jmp 0x180004196
mov bl, 1
lea rcx, str.kernel32.dll
and bl, r15b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r15, qword [rsp + 0x3a8]
test rax, rax
jne 0x1800041b7
mov eax, esi
jmp 0x1800041f7
lea rdx, [0x180082250]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1800041d3
mov eax, ntohs
jmp 0x1800041f7
lea r8, [0x180094788]
mov rcx, rax
lea rdx, [0x180003460]
call fcn.18001b2b0
test eax, eax
je 0x18000422d
cmp eax, 1
je 0x18000422d
cmp eax, 3
je 0x18000422d
mov dword [rbp + 0x28], eax
lea rcx, [rbp + 0x20]
lea rax, [rbp + 0x20]
mov qword [rbp + 0x20], r14
mov rdx, rdi
mov qword [rbp + 0x58], rax
call fcn.180008fa0
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x18000422b
mov rax, qword [rcx]
lea rdx, [rbp + 0x20]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor bl, bl
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18000427f
lea rdx, [0x180082260]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x180004259
lea esi, [rax + 0xc]
jmp 0x18000427f
lea r8, [0x180094770]
mov rcx, rax
lea rdx, [0x180003690]
call fcn.18001b2b0
mov esi, eax
test eax, eax
je 0x1800042bd
cmp eax, 1
je 0x1800042bd
cmp eax, 3
je 0x1800042bd
lea rax, [rbp + 0x60]
mov qword [rbp + 0x60], r14
mov rdx, rdi
mov qword [rbp + 0x98], rax
lea rcx, [rbp + 0x60]
mov dword [rbp + 0x68], esi
call fcn.180008fa0
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x1800042b9
mov rax, qword [rcx]
lea rdx, [rbp + 0x60]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor al, al
jmp 0x1800042bf
mov al, 1
mov rsi, qword [rsp + 0x3a0]
and bl, al
je 0x1800045a9
lea rdx, str.NtOpenFile
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov edx, 1
call fcn.18001b5a0
test eax, 0xfffffffc
jne 0x1800042f8
cmp eax, 2
jne 0x180004343
mov dword [rbp + 0xa8], eax
lea rcx, [rbp + 0xa0]
lea rax, [rbp + 0xa0]
mov qword [rbp + 0xa0], r14
mov rdx, rdi
mov qword [rbp + 0xd8], rax
call fcn.180008fa0
mov rcx, qword [rbp + 0xd8]
test rcx, rcx
je 0x180004341
mov rax, qword [rcx]
lea r8, [rbp + 0xa0]
cmp rcx, r8
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor bl, bl
lea rdx, str.NtClose
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov edx, 1
call fcn.18001b5a0
test eax, 0xfffffffc
jne 0x180004370
cmp eax, 2
je 0x180004370
mov al, 1
jmp 0x1800043bb
mov dword [rbp + 0xe8], eax
lea rcx, [rbp + 0xe0]
lea rax, [rbp + 0xe0]
mov qword [rbp + 0xe0], r14
mov rdx, rdi
mov qword [rbp + 0x118], rax
call fcn.180008fa0
mov rcx, qword [rbp + 0x118]
test rcx, rcx
je 0x1800043b9
mov rax, qword [rcx]
lea r8, [rbp + 0xe0]
cmp rcx, r8
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor al, al
lea rdx, str.NtCreateSection
mov rcx, r12
and bl, al
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov edx, 1
call fcn.18001b5a0
test eax, 0xfffffffc
jne 0x1800043e6
cmp eax, 2
jne 0x180004431
mov dword [rbp + 0x128], eax
lea rcx, [rbp + 0x120]
lea rax, [rbp + 0x120]
mov qword [rbp + 0x120], r14
mov rdx, rdi
mov qword [rbp + 0x158], rax
call fcn.180008fa0
mov rcx, qword [rbp + 0x158]
test rcx, rcx
je 0x18000442f
mov rax, qword [rcx]
lea r8, [rbp + 0x120]
cmp rcx, r8
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor bl, bl
lea rdx, str.NtQueryAttributesFile
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov edx, 1
call fcn.18001b5a0
test eax, 0xfffffffc
jne 0x18000445e
cmp eax, 2
je 0x18000445e
mov al, 1
jmp 0x1800044a9
mov dword [rbp + 0x168], eax
lea rcx, [rbp + 0x160]
lea rax, [rbp + 0x160]
mov qword [rbp + 0x160], r14
mov rdx, rdi
mov qword [rbp + 0x198], rax
call fcn.180008fa0
mov rcx, qword [rbp + 0x198]
test rcx, rcx
je 0x1800044a7
mov rax, qword [rcx]
lea r8, [rbp + 0x160]
cmp rcx, r8
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor al, al
lea rdx, [0x180082250]
mov rcx, r13
and bl, al
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov edx, 1
call fcn.18001b5a0
test eax, 0xfffffffc
jne 0x1800044d4
cmp eax, 2
jne 0x18000451f
mov dword [rbp + 0x1a8], eax
lea rcx, [rbp + 0x1a0]
lea rax, [rbp + 0x1a0]
mov qword [rbp + 0x1a0], r14
mov rdx, rdi
mov qword [rbp + 0x1d8], rax
call fcn.180008fa0
mov rcx, qword [rbp + 0x1d8]
test rcx, rcx
je 0x18000451d
mov rax, qword [rcx]
lea r8, [rbp + 0x1a0]
cmp rcx, r8
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor bl, bl
lea rdx, [0x180082260]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov edx, 1
call fcn.18001b5a0
test eax, 0xfffffffc
jne 0x18000454c
cmp eax, 2
je 0x18000454c
mov al, 1
jmp 0x180004597
mov dword [rbp + 0x1e8], eax
lea rcx, [rbp + 0x1e0]
lea rax, [rbp + 0x1e0]
mov qword [rbp + 0x1e0], r14
mov rdx, rdi
mov qword [rbp + 0x218], rax
call fcn.180008fa0
mov rcx, qword [rbp + 0x218]
test rcx, rcx
je 0x180004595
mov rax, qword [rcx]
lea rdx, [rbp + 0x1e0]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor al, al
and bl, al
mov byte [rdi + 0x80], bl
jne 0x1800045a9
mov rcx, rdi
call sym.anonymous.dll_public:_void___cdecl_DllManager::DisableDllRedirection_void____ptr64
movzx eax, bl
mov rbx, qword [rsp + 0x398]
add rsp, 0x360
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
mov dword [rbp + 0x228], eax
lea r14, [0x180083ca8]
lea rax, [rbp + 0x220]
mov qword [rbp + 0x220], r14
mov rdx, rdi
mov qword [rbp + 0x258], rax
lea rcx, [rbp + 0x220]
call fcn.180008fa0
mov rcx, qword [rbp + 0x258]
test rcx, rcx
je 0x180004614
mov rax, qword [rcx]
lea rdx, [rbp + 0x220]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xor al, al
add rsp, 0x360
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret