Function at 0x18000a3a0
Capabilities:
Create shortcut via ishelllink

Disassembly:
push rbp
push r14
push r15
lea rbp, [rsp - 0x1020]
mov eax, 0x1120
call fcn.1800e3a10
sub rsp, rax
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x1148], rbx
mov qword [rsp + 0x1150], rsi
mov qword [rsp + 0x1158], rdi
mov rax, qword [0x1801a8080]
xor rax, rsp
mov qword [rbp + 0x1010], rax
mov rbx, rcx
lea rcx, [rsp + 0x40]
call fcn.180093600
nop
xor r14b, r14b
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r15
test rbx, rbx
jne 0x18000a4ef
lea edx, [rbx + 2]
lea rcx, [0x1801b0198]
call fcn.1800c6560
mov edi, eax
test eax, eax
je 0x18000ace1
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rsp + 0x60], xmm1
mov word [rsp + 0x50], r15w
lea r8d, [r15 + 9]
lea rdx, [0x1801573d8]
lea rcx, [rsp + 0x50]
call fcn.18000c0b0
mov dword [rsp + 0x28], 0x5a1
lea rax, str.RC::RCApiHookNewFuns::OnLoadHookArrived
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rsp + 0x50]
lea edx, [rbx + 2]
lea rcx, [0x1801b0198]
call fcn.1800c65b0
cmp edi, 1
jbe 0x18000a4a5
lea rdx, [rsp + 0x50]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000accd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000acc8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ad4b
jmp 0x18000acc8
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [0x18013f960]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x18013f990]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test eax, eax
js 0x18000abd8
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x18000abd8
mov rax, qword [rcx]
lea r8, [rsp + 0x38]
lea rdx, [0x18013f980]
call qword [rax]
mov esi, eax
test eax, eax
js 0x18000aad7
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x18000aad7
mov rax, qword [0x1801ad838]
xor r8d, r8d
mov rdx, rbx
test rax, rax
je 0x18000a56a
call rax
jmp 0x18000a575
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov edi, eax
test eax, eax
jns 0x18000a65d
mov edx, 2
lea rcx, [0x1801b0198]
call fcn.1800c6560
mov ebx, eax
test eax, eax
je 0x18000ace1
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rsp + 0x60], xmm1
mov word [rsp + 0x50], r15w
mov r8d, edi
lea rdx, [0x1801574b0]
lea rcx, [rsp + 0x50]
call fcn.1800c6a80
mov dword [rsp + 0x28], 0x5bd
lea rax, str.RC::RCApiHookNewFuns::OnLoadHookArrived
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rsp + 0x50]
mov edx, 2
lea rcx, [0x1801b0198]
call fcn.1800c65b0
cmp ebx, 1
jbe 0x18000a613
lea rdx, [rsp + 0x50]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000accd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000acc8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ad51
jmp 0x18000acc8
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
xor edx, edx
mov r8d, 0x3e80001
call qword [rax + 0x98]
mov esi, eax
test eax, eax
jns 0x18000a75b
mov edx, 2
lea rcx, [0x1801b0198]
call fcn.1800c6560
mov edi, eax
test eax, eax
je 0x18000ace1
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rsp + 0x60], xmm1
mov word [rsp + 0x50], r15w
mov r8d, esi
lea rdx, [0x1801574e8]
lea rcx, [rsp + 0x50]
call fcn.1800c6a80
mov dword [rsp + 0x28], 0x5c5
lea rax, str.RC::RCApiHookNewFuns::OnLoadHookArrived
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rsp + 0x50]
mov edx, 2
lea rcx, [0x1801b0198]
call fcn.1800c65b0
cmp edi, 1
jbe 0x18000a711
lea rdx, [rsp + 0x50]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000accd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000acc8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ad57
jmp 0x18000acc8
xor edx, edx
mov r8d, 0x250
lea rcx, [rbp + 0x1a0]
call fcn.1801023f0
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x600]
call fcn.1801023f0
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
mov dword [rsp + 0x20], 2
lea r9, [rbp + 0x1a0]
mov r8d, 0x104
lea rdx, [rbp + 0x600]
call qword [rax + 0x18]
mov esi, eax
test eax, eax
jns 0x18000a892
mov edx, 2
lea rcx, [0x1801b0198]
call fcn.1800c6560
mov edi, eax
test eax, eax
je 0x18000ace1
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rsp + 0x60], xmm1
mov word [rsp + 0x50], r15w
mov r8d, esi
lea rdx, [0x180157520]
lea rcx, [rsp + 0x50]
call fcn.1800c6a80
mov dword [rsp + 0x28], 0x5ce
lea rax, str.RC::RCApiHookNewFuns::OnLoadHookArrived
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rsp + 0x50]
mov edx, 2
lea rcx, [0x1801b0198]
call fcn.1800c65b0
cmp edi, 1
jbe 0x18000a848
lea rdx, [rsp + 0x50]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000accd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000acc8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ad5d
jmp 0x18000acc8
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x3f0]
call fcn.1801023f0
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
mov r8d, 0x104
lea rdx, [rbp + 0x3f0]
call qword [rax + 0x50]
mov esi, eax
test eax, eax
jns 0x18000a9a6
mov edx, 2
lea rcx, [0x1801b0198]
call fcn.1800c6560
mov edi, eax
test eax, eax
je 0x18000ace1
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rsp + 0x60], xmm1
mov word [rsp + 0x50], r15w
mov r8d, esi
lea rdx, [0x180157558]
lea rcx, [rsp + 0x50]
call fcn.1800c6a80
mov dword [rsp + 0x28], 0x5d6
lea rax, str.RC::RCApiHookNewFuns::OnLoadHookArrived
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rsp + 0x50]
mov edx, 2
lea rcx, [0x1801b0198]
call fcn.1800c65b0
cmp edi, 1
jbe 0x18000a95c
lea rdx, [rsp + 0x50]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000accd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000acc8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ad63
jmp 0x18000acc8
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x810]
call fcn.1801023f0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
lea rax, [rbp + 0x3f0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x600]
mov qword [rsp + 0x20], rax
lea r8, str._ld__s__s
mov edx, 0x3ff
lea rcx, [rbp + 0x810]
call fcn.180003e40
mov qword [rbp - 0x70], r15
movzx eax, r15w
lea rdi, [rbp - 0x68]
mov ecx, 0x104
rep stosw word [rdi], ax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbp - 0x6c], eax
mov r8d, 0x104
mov rdx, rbx
lea rcx, [rbp - 0x68]
call fcn.180104de0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp - 0x80], xmm1
mov word [rsp + 0x70], r15w
lea rax, [rbp + 0x810]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], r15w
jne 0x18000aa50
lea rdx, [rbp + 0x810]
lea rcx, [rsp + 0x70]
call fcn.18000c0b0
nop
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x70]
call fcn.18000ad80
movzx r14d, al
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x18000aabf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000aaba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ad6f
call fcn.1800e2d24
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rbp - 0x80], xmm0
mov word [rsp + 0x70], r15w
jmp 0x18000ace1
cmp qword [0x1801b0198], r15
je 0x18000ace1
lea rcx, [0x1801b0198]
call fcn.1800c5900
mov rax, qword [0x1801b0198]
cmp byte [rax + 0x78], r15b
je 0x18000ace1
cmp dword [rax + 0x80], 2
jb 0x18000ace1
movzx edi, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rsp + 0x60], xmm1
mov word [rsp + 0x50], r15w
mov r8d, esi
lea rdx, [0x180157478]
lea rcx, [rsp + 0x50]
call fcn.1800c6a80
mov dword [rsp + 0x28], 0x5af
lea rax, str.RC::RCApiHookNewFuns::OnLoadHookArrived
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rsp + 0x50]
mov edx, 2
lea rcx, [0x1801b0198]
call fcn.1800c65b0
test dil, dil
je 0x18000ab8e
lea rdx, [rsp + 0x50]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000accd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000acc8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ad69
jmp 0x18000acc8
cmp qword [0x1801b0198], r15
je 0x18000ace1
lea rcx, [0x1801b0198]
call fcn.1800c5900
mov rax, qword [0x1801b0198]
cmp byte [rax + 0x78], r15b
je 0x18000ace1
cmp dword [rax + 0x80], 2
jb 0x18000ace1
movzx edi, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rsp + 0x60], xmm1
mov word [rsp + 0x50], r15w
mov r8d, esi
lea rdx, [0x180157440]
lea rcx, [rsp + 0x50]
call fcn.1800c6a80
mov dword [rsp + 0x28], 0x5a8
lea rax, str.RC::RCApiHookNewFuns::OnLoadHookArrived
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rsp + 0x50]
mov edx, 2
lea rcx, [0x1801b0198]
call fcn.1800c65b0
test dil, dil
je 0x18000ac8f
lea rdx, [rsp + 0x50]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000accd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000acc8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ad45
call fcn.1800e2d24
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r15w
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x18000acf6
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x38], r15
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x18000ad0b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x30], r15
lea rcx, [rsp + 0x40]
call fcn.180093720
movzx eax, r14b
mov rcx, qword [rbp + 0x1010]
xor rcx, rsp
call fcn.1800e2d00
lea r11, [rsp + 0x1120]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.180107ee8
nop
call fcn.180107ee8
int3
call fcn.180107ee8
int3
call fcn.180107ee8
int3
call fcn.180107ee8
int3
call fcn.180107ee8
int3
call fcn.180107ee8
int3
call fcn.180107ee8
int3