Function at 0x1800cdd30
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3f0
mov rax, qword [0x1801724e0]
xor rax, rsp
mov qword [rsp + 0x3e0], rax
mov rdi, rdx
mov qword [rsp + 0xf8], rdx
mov qword [rsp + 0x108], rcx
mov dword [rsp + 0x150], 0x160014
lea rax, [0x1801183b0]
mov qword [rsp + 0x158], rax
xor ecx, ecx
call sym.ntdll.dll_RtlEncodePointer
mov qword [0x18015c2f0], rax
mov r13, qword gs:[0x30]
mov qword [rsp + 0x138], r13
mov r14, qword [r13 + 0x60]
mov dword [0x18015c360], 0x58
mov esi, 1
mov byte [0x18015c364], sil
lea rax, [0x18015c370]
mov qword [0x18015c378], rax
mov qword [0x18015c370], rax
lea rax, [0x18015c380]
mov qword [0x18015c388], rax
mov qword [0x18015c380], rax
lea rax, [0x18015c390]
mov qword [0x18015c398], rax
mov qword [0x18015c390], rax
xor r12d, r12d
mov byte [0x18015c3a8], r12b
mov qword [0x18015c3b0], r12
lea rax, [0x18015c360]
mov qword [r14 + 0x18], rax
mov rcx, r14
call fcn.1800cdcf8
mov eax, r12d
mov edx, 0x400
cmp dword [r14 + 0xb8], esi
cmova eax, edx
mov dword [0x18015ada0], eax
mov eax, r12d
cmova eax, edx
mov dword [0x18015aa5c], eax
mov eax, dword [0x1801596d8]
cmove eax, r12d
mov dword [0x1801596d8], eax
call fcn.1800f0efc
mov rcx, qword [r14 + 0x20]
mov rax, qword [rcx + 0x68]
test byte [rcx + 8], sil
lea rdx, [rax + rcx]
cmovne rdx, rax
mov qword [rsp + 0xa8], rdx
movzx r8d, word [rcx + 0x60]
mov word [rsp + 0xa0], r8w
lea eax, [rsi + 1]
add eax, r8d
mov word [rsp + 0xa2], ax
lea r9d, [rsi + 7]
cmp r8w, r9w
jb 0x1800cdef7
cmp word [rdx], 0x5c
jne 0x1800cdef7
lea ebx, [rsi + 0x3e]
cmp word [rdx + 2], bx
jne 0x1800cdef7
cmp word [rdx + 4], bx
jne 0x1800cdef7
cmp word [rdx + 6], 0x5c
jne 0x1800cdef7
movzx eax, r8w
sub ax, r9w
mov word [rsp + 0xa0], ax
sub r8w, 6
mov word [rsp + 0xa2], r8w
lea rax, [rdx + 8]
mov qword [rsp + 0xa8], rax
mov eax, 0xfff8
add word [rcx + 0x60], ax
add word [rcx + 0x62], ax
add qword [rcx + 0x68], r9
mov dword [rsp + 0x78], esi
mov byte [0x18015c308], r12b
mov byte [rsp + 0x54], r12b
mov dword [rsp + 0x74], r12d
lea r9, [rsp + 0xb0]
xor r8d, r8d
mov rdx, qword [r14 + 0x10]
lea ebx, [r8 + 3]
mov ecx, ebx
call sym.ntdll.dll_RtlImageNtHeaderEx
mov r15, qword [rsp + 0xb0]
mov qword [0x18015c2a8], r15
cmp byte [0x18015c298], r12b
je 0x1800cdf91
test byte [r15 + 0x16], 0x20
jne 0x1800cdf91
mov eax, dword [0x180156a70]
test bl, al
je 0x1800cdf7c
lea rax, str.Secure_processes_must_be_large_address_aware_n
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, str.LdrpInitializeProcess
mov edx, 0xe05
lea rcx, [0x180118390]
call fcn.1800ca394
mov eax, dword [0x180156a70]
mov esi, 0x10
test sil, al
je 0x1800cdf87
int3
mov eax, 0xc00000bb
jmp 0x1800cfd33
lea rax, [0x18015bfc0]
mov ecx, 0x20
lea esi, [rcx - 0x10]
lea r9d, [rcx - 0x1f]
mov qword [rax + 8], rax
mov qword [rax], rax
add rax, rsi
sub rcx, r9
jne 0x1800cdfa4
lea r9, [rsp + 0x168]
xor r8d, r8d
mov rdx, rdi
mov ecx, ebx
call sym.ntdll.dll_RtlImageNtHeaderEx
mov rax, qword [rsp + 0x168]
mov ebx, dword [rax + 0x50]
mov edx, ebx
mov rcx, rdi
call fcn.18002ae58
mov edx, ebx
mov rcx, rdi
call fcn.1800dade0
call fcn.1800d05cc
mov ecx, 1
call fcn.1800259b4
call fcn.18001f704
mov edx, 1
cmp eax, edx
jne 0x1800ce012
lea rax, sym.ntdll.dll_RtlMapSecurityErrorToNtStatus
mov qword [0x18015c300], rax
movaps xmm1, xmmword [0x18016f370]
movdqu xmmword [rsp + 0x2d0], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rcx, xmm0
shr rcx, 4
mov ebx, 3
and rcx, rbx
cmp cl, dl
sete al
mov byte [0x18015c2b0], al
test al, al
jne 0x1800ce05b
movdqu xmmword [rsp + 0x2e0], xmm1
cmp cl, bl
mov al, r12b
jne 0x1800ce05d
mov al, dl
mov byte [0x18015c2f8], al
lea rax, [rsp + 0x178]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xc0]
mov r8, rdi
mov rdx, r14
lea rcx, [rsp + 0xa0]
call fcn.1800ccf18
mov dword [rsp + 0x50], eax
xor edx, edx
test eax, eax
jns 0x1800ce0f8
mov ecx, dword [0x180156a70]
test bl, cl
je 0x1800ce0e9
mov dword [rsp + 0x30], eax
mov eax, dword [r13 + 0x40]
mov dword [rsp + 0x28], eax
lea rax, str.Initializing_the_execution_options_for_the_process__lx_failed_with_status_0x_08lx_n
lea r8, str.LdrpInitializeProcess
mov edx, 0xe97
lea rcx, [0x180118390]
xor r9d, r9d
mov qword [rsp + 0x20], rax
call fcn.1800ca394
mov eax, dword [rsp + 0x50]
mov ecx, dword [0x180156a70]
test sil, cl
je 0x1800cfd33
int3
mov ecx, 2
test byte [r14 + 0xbc], cl
je 0x1800ce10f
lea eax, [rcx - 1]
or dword [0x180156a70], eax
lea rbx, str.LdrpInitializeProcess
lea rdi, [0x180118390]
test byte [0x180156a70], 5
je 0x1800ce150
mov rax, qword [r13 + 0x40]
mov qword [rsp + 0x28], rax
lea rax, str.Initializing_process_0x_p_n
mov qword [rsp + 0x20], rax
mov r9d, ecx
mov r8, rbx
mov edx, 0xec6
mov rcx, rdi
call fcn.1800ca394
xor edx, edx
mov qword [rsp + 0x148], rdx
mov ecx, dword [r13 + 0x180c]
mov eax, edx
test ecx, ecx
setg al
mov dword [0x18015c290], eax
mov r13d, 0x10b
test r15, r15
je 0x1800ce1b0
cmp word [r15 + 0x18], r13w
jne 0x1800ce1b0
test ecx, ecx
jg 0x1800ce1b0
mov eax, 1
mov byte [0x18015c308], al
mov r15b, al
mov dword [rsp + 0x54], r15d
mov r12d, eax
mov rcx, qword [r14 + 0x10]
call fcn.1800cade8
mov dword [rsp + 0x50], eax
xor edx, edx
test eax, eax
jns 0x1800ce1b5
jmp 0x1800cfd33
mov r15d, dword [rsp + 0x54]
cmp dword [0x18015c290], edx
jne 0x1800ce223
cmp byte [0x18015c308], dl
jne 0x1800ce223
mov r8d, 0xe
lea rax, [rsp + 0x128]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x160]
lea edx, [r8 - 0xd]
mov rcx, qword [r14 + 0x10]
call fcn.18001014c
mov rcx, qword [rsp + 0x128]
xor edx, edx
test eax, eax
cmovs rcx, rdx
mov qword [rsp + 0x128], rcx
test rcx, rcx
je 0x1800ce223
lea eax, [rdx + 1]
mov byte [0x18015c308], al
test byte [rcx + 0x10], al
movzx r15d, r15b
cmovne r15d, eax
mov dword [rsp + 0x54], r15d
mov rax, qword [rsp + 0xf8]
mov qword [0x18015c350], rax
cmp dword [0x18015c290], edx
jne 0x1800ce249
mov rax, qword [r14 + 0x2d8]
mov qword [rsp + 0x148], rax
mov rax, qword [r14 + 0xc0]
mov qword [0x18015bec0], rax
mov rcx, qword [r14 + 0x20]
call sym.ntdll.dll_RtlNormalizeProcessParams
movups xmm0, xmmword [rax + 0x60]
movdqu xmmword [rsp + 0xd8], xmm0
xor eax, eax
cmp dword [0x18015c290], eax
jne 0x1800ce28d
cmp byte [0x18015c308], al
je 0x1800ce284
test r12d, r12d
jne 0x1800ce28d
mov rcx, qword [r14 + 0x10]
call fcn.18002b3ec
mov r15, rax
xor edx, edx
lea r8d, [rdx + 0x60]
lea rcx, [rsp + 0x300]
call sym.ntdll.dll_memset
mov r8d, 2
mov r12d, r8d
mov dword [rsp + 0x300], 0x60
xor edx, edx
test r15, r15
je 0x1800ce395
mov eax, dword [r15]
cmp eax, esi
jb 0x1800ce2d9
mov eax, dword [r15 + 0xc]
not eax
and dword [r14 + 0xbc], eax
mov eax, dword [r15]
mov ecx, dword [r14 + 0xbc]
cmp eax, 0x14
jb 0x1800ce2f5
mov eax, dword [r15 + 0x10]
or eax, ecx
mov dword [r14 + 0xbc], eax
mov eax, dword [r15]
cmp eax, 0x18
jb 0x1800ce315
cmp dword [r15 + 0x14], edx
je 0x1800ce315
movsxd rax, dword [r15 + 0x14]
imul rcx, rax, 0xffffffffffffd8f0
mov qword [0x18015bec0], rcx
mov eax, dword [r15]
cmp eax, 0x4c
jb 0x1800ce32c
mov ecx, dword [r15 + 0x48]
test ecx, ecx
je 0x1800ce32c
and ecx, 0xffff0fff
cmovne r12d, ecx
cmp eax, 0x20
jb 0x1800ce345
mov rcx, qword [r15 + 0x18]
test rcx, rcx
je 0x1800ce345
mov qword [rsp + 0x318], rcx
mov eax, dword [r15]
cmp eax, 0x28
jb 0x1800ce35e
mov rcx, qword [r15 + 0x20]
test rcx, rcx
je 0x1800ce35e
mov qword [rsp + 0x320], rcx
mov eax, dword [r15]
cmp eax, 0x38
jb 0x1800ce377
mov rcx, qword [r15 + 0x30]
test rcx, rcx
je 0x1800ce377
mov qword [rsp + 0x328], rcx
mov eax, dword [r15]
cmp eax, 0x40
jb 0x1800ce395
mov rax, qword [rsp + 0x330]
cmp qword [r15 + 0x38], rdx
cmovne rax, qword [r15 + 0x38]
mov qword [rsp + 0x330], rax
mov r15d, 0x40
test byte [r14 + 0xbc], r8b
je 0x1800ce3ae
lea eax, [r15 - 0x3f]
or dword [0x180156a70], eax
movzx eax, byte [0x18015beb8]
movabs rcx, 0xfffffff79e3b9800
cmp qword [0x18015bec0], rcx
mov r9d, 1
cmovl eax, r9d
mov byte [0x18015beb8], al
mov dword [0x18015bea8], edx
lea rcx, [0x18015d0e0]
call sym.ntdll.dll_RtlInitializeSListHead
lea rdx, [0x18015ac20]
mov rcx, rdx
lea rax, [rcx + 0x30]
mov qword [rcx], rax
mov rcx, rax
lea rax, [0x18015ad40]
cmp rcx, rax
jbe 0x1800ce3f2
xor eax, eax
mov qword [rcx], rax
lea r9d, [rax + 8]
lea r8, [0x18015ad70]
lea rcx, [0x18015d0e0]
call sym.ntdll.dll_RtlInterlockedPushListSList
xor eax, eax
mov dword [rsp + 0x50], eax
lea rax, [0x18015c330]
mov qword [r14 + 0x338], rax
lea rax, [0x18015c2e0]
mov qword [r14 + 0x78], rax
lea rax, [0x18015c2c0]
mov qword [r14 + 0x238], rax
mov dword [0x18015c330], 0x80
lea rax, [r14 + 0x340]
mov qword [0x18015c338], rax
bts dword [rax], 0
lea rax, [r14 + 0x328]
mov qword [rax + 8], rax
mov qword [rax], rax
mov dword [0x18015c2e0], r15d
lea rax, [r14 + 0x80]
mov qword [0x18015c2e8], rax
bts dword [rax], 0
mov eax, 0x400
mov dword [0x18015c2c0], eax
lea rax, [r14 + 0x240]
mov qword [0x18015c2c8], rax
bts dword [rax], 0
xor r15d, r15d
cmp dword [0x18015c290], r15d
je 0x1800ce4cc
xor edx, edx
lea r8d, [r15 + 0x13]
mov rcx, qword [r14 + 0x78]
call sym.ntdll.dll_RtlSetBits
mov edx, 4
lea r8d, [rdx - 3]
mov rcx, qword [r14 + 0x78]
call sym.ntdll.dll_RtlSetBits
mov eax, 1
mov r8d, eax
mov edx, esi
mov rcx, qword [r14 + 0x78]
call sym.ntdll.dll_RtlSetBits
mov ecx, dword [r14 + 0xbc]
bt ecx, 0xc
jb 0x1800ce50c
mov al, byte [0x18015d404]
test al, al
je 0x1800ce5db
mov eax, 0x18
mov dword [rsp + 0x70], eax
cmp byte [0x18015c298], r15b
jne 0x1800ce555
mov byte [rsp + 0x30], r15b
mov qword [rsp + 0x28], r15
mov eax, 4
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x70]
mov r8d, eax
lea rdx, str.StackTraceDatabaseSizeInMb
lea rcx, [rsp + 0xa0]
call sym.ntdll.dll_LdrQueryImageFileExecutionOptionsEx
mov ecx, eax
mov eax, dword [rsp + 0x70]
jmp 0x1800ce55a
mov ecx, 0xc0000034
mov dword [rsp + 0x50], ecx
test ecx, ecx
js 0x1800ce567
cmp eax, 0x18
jae 0x1800ce56f
mov r15d, 0x1800000
jmp 0x1800ce584
cmp eax, 0x80
jbe 0x1800ce57e
mov r15d, 0x8000000
jmp 0x1800ce584
shl eax, 0x14
mov r15d, eax
test byte [0x180156a70], 5
je 0x1800ce5bb
mov rax, r15
shr rax, 0x14
mov qword [rsp + 0x28], rax
lea rax, str.Stack_trace_database_size_is__Id_Mb_n
mov qword [rsp + 0x20], rax
mov r9d, 2
mov r8, rbx
mov edx, 0xfe7
mov rcx, rdi
call fcn.1800ca394
mov r8, r15
xor edx, edx
xor ecx, ecx
call fcn.1800f6a48
mov dword [rsp + 0x50], eax
mov ecx, dword [r14 + 0xbc]
mov al, byte [0x18015d404]
xor r15d, r15d
bt ecx, 0xc
jb 0x1800ce5e5
test al, al
je 0x1800ce5f2
mov edx, 1
mov byte [0x18015ac08], dl
jmp 0x1800ce5f7
mov edx, 1
mov rax, qword gs:[0x60]
mov ecx, dword [rax + 0x2c8]
bt rcx, 0x16
jae 0x1800ce619
mov byte [0x18015ac08], dl
mov byte [0x18015ac09], dl
xor r8d, r8d
xor edx, edx
lea rcx, [0x18015be80]
call sym.ntdll.dll_RtlInitializeCriticalSectionEx
mov dword [rsp + 0x50], eax
test eax, eax
js 0x1800cfd33
lea rax, [0x18015be80]
mov qword [r14 + 0x38], rax
lea rcx, [rsp + 0xa0]
call fcn.1800eaf90
mov dword [rsp + 0x50], eax
test eax, eax
js 0x1800cfd33
movaps xmm0, xmmword [0x18016f370]
movdqu xmmword [rsp + 0x2f0], xmm0
movq rax, xmm0
shr rax, 0xc
mov ecx, 3
and rax, rcx
lea edx, [rcx - 2]
cmp al, dl
jne 0x1800ce694
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call sym.ntdll.dll_RtlSetHeapInformation
mov ecx, 3
cmp dword [0x18015c290], r15d
jne 0x1800ce6c8
mov rax, qword [rsp + 0xb0]
cmp word [rax + 0x18], r13w
je 0x1800ce6c8
cmp word [rax + 0x48], cx
ja 0x1800ce6be
cmp word [rax + 0x4a], 0x33
jae 0x1800ce6be
bts r12d, 0x10
mov r8, qword [rax + 0x70]
mov r9, qword [rax + 0x78]
jmp 0x1800ce6ce
mov r8, r15
mov r9, r15
lea rax, [rsp + 0x300]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor edx, edx
mov ecx, r12d
call sym.ntdll.dll_RtlCreateHeap
mov r12, rax
test rax, rax
jne 0x1800ce731
mov eax, dword [0x180156a70]
test al, 3
je 0x1800ce721
lea rax, str.Creating_the_process_heap_failed_n
mov edx, 0x104d
mov r8, rbx
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov rcx, rdi
call fcn.1800ca394
mov eax, dword [0x180156a70]
test sil, al
je 0x1800ce727
int3
mov eax, 0xc0000017
jmp 0x1800cfd33
mov qword [r14 + 0x30], r12
lea rcx, [0x18015ca80]
call sym.ntdll.dll_RtlInitializeCriticalSection
lea rax, [0x18015ca70]
mov qword [0x18015ca78], rax
mov qword [0x18015ca70], rax
test dword [r14 + 0xbc], 0x800000
je 0x1800ce799
mov rcx, qword gs:[0x60]
mov r13d, 0x11620
mov r8d, r13d
xor edx, edx
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlAllocateHeap
mov qword [0x18015d448], rax
test rax, rax
je 0x1800ce799
mov r8d, r13d
xor edx, edx
mov rcx, rax
call sym.ntdll.dll_memset
mov rcx, qword [rsp + 0x138]
call fcn.180072ad0
mov qword [0x18015c288], r12
lea rax, [0x18015d0f0]
test al, 0xf
jne 0x1800cfd60
xor eax, eax
mov qword [0x18015d0f0], rax
mov qword [0x18015d0f8], rax
mov qword [0x18015a418], r15
mov dword [rsp + 0x50], r15d
xor r9d, r9d
lea r13d, [rax + 8]
mov r8d, r13d
lea rdx, [rsp + 0x170]
mov ecx, 0xc5
call sym.ntdll.dll_NtQuerySystemInformation
mov dword [rsp + 0x50], eax
mov rcx, qword [0x18015ada8]
test eax, eax
cmovns rcx, qword [rsp + 0x170]
mov qword [0x18015ada8], rcx
lea r9, str._Process
lea r8, str.NTDLL_
xor edx, edx
mov rcx, r12
call sym.ntdll.dll_RtlCreateTagHeap
mov dword [0x18015c294], eax
call fcn.18007d0e0
mov dword [rsp + 0x50], eax
test eax, eax
js 0x1800cfd33
lea r9, [0x18015a410]
xor r8d, r8d
xor edx, edx
lea rcx, [0x180114528]
call sym.ntdll.dll_EtwEventRegister
lea r9, [0x18015aa68]
xor r8d, r8d
lea rdx, [0x1800f23e0]
lea rcx, [0x180118380]
call sym.ntdll.dll_EtwEventRegister
lea r9, [0x18015d2d8]
xor r8d, r8d
lea rdx, [0x1800fd140]
lea rcx, [0x180115dd8]
call sym.ntdll.dll_EtwEventRegister
test byte [0x18015d028], r13b
je 0x1800ce8a7
lea rcx, [0x180156650]
call fcn.1800726b8
call fcn.18004b9a4
mov dword [rsp + 0x50], eax
test eax, eax
js 0x1800cfd33
call fcn.18007d454
mov dword [rsp + 0x50], eax
test eax, eax
js 0x1800cfd33
mov r13, qword [r14 + 0x20]
mov qword [rsp + 0x100], r13
movups xmm0, xmmword [r13 + 0x60]
movups xmmword [rsp + 0xd8], xmm0
psrldq xmm0, 8
movq qword [rsp + 0xa8], xmm0
mov rdx, qword [rsp + 0xc0]
test rdx, rdx
jne 0x1800ce907
cmp qword [rsp + 0x80], r15
je 0x1800ce95f
mov qword [rsp + 0x38], r15
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rax, [rsp + 0x74]
mov qword [rsp + 0x20], rax
lea r8, str.DebugProcessHeapOnly
mov rcx, qword [rsp + 0x80]
call fcn.18004aee4
mov dword [rsp + 0x50], eax
test eax, eax
js 0x1800ce95f
cmp dword [0x1801563e8], r15d
je 0x1800ce95f
cmp dword [rsp + 0x74], r15d
je 0x1800ce95f
mov dword [0x1801563e8], r15d
mov rax, qword [0x1801563e0]
btr dword [rax], 0xa
call sym.ntdll.dll_RtlGetNtSystemRoot
mov rdx, rax
lea rcx, [rsp + 0x110]
call sym.ntdll.dll_RtlInitUnicodeStringEx
movzx r15d, word [rsp + 0x110]
add r15d, 0x26
add r15, 2
mov r8, r15
xor edx, edx
mov rcx, r12
call sym.ntdll.dll_RtlAllocateHeap
xor ecx, ecx
test rax, rax
je 0x1800ce727
mov word [rsp + 0xc8], cx
mov word [rsp + 0xca], r15w
mov qword [rsp + 0xd0], rax
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0xc8]
call sym.ntdll.dll_RtlAppendUnicodeStringToString
lea rdx, [0x180110350]
lea rcx, [rsp + 0xc8]
call sym.ntdll.dll_RtlAppendUnicodeStringToString
mov al, byte [r14 + 3]
and al, 0x42
mov ecx, 2
cmp al, cl
je 0x1800cebf6
lea r15d, [rcx + 0x2e]
mov dword [rsp + 0x190], r15d
xor eax, eax
mov qword [rsp + 0x198], rax
mov dword [rsp + 0x1a8], 0x40
lea rax, [rsp + 0x150]
mov qword [rsp + 0x1a0], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x1b0], xmm0
lea r8, [rsp + 0x190]
lea edx, [rcx + 1]
lea rcx, [0x18015bef0]
call sym.ntdll.dll_NtOpenDirectoryObject
mov dword [rsp + 0x50], eax
cmp eax, 0xc0000034
jne 0x1800cea8c
test byte [r14 + 3], 0x40
je 0x1800cea8c
test byte [0x180156a70], 5
je 0x1800cea81
lea rax, str.KnownDLL_directory_does_not_yet_exist.__SMSS_will_create_it._n
mov qword [rsp + 0x20], rax
lea r9d, [r15 - 0x2e]
mov r8, rbx
mov edx, 0x1146
mov rcx, rdi
call fcn.1800ca394
xor ecx, ecx
mov dword [rsp + 0x50], ecx
jmp 0x1800cebf8
test eax, eax
jns 0x1800ceac7
mov ecx, dword [0x180156a70]
test cl, 3
je 0x1800ce0e9
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x150]
mov edx, 0x1150
mov qword [rsp + 0x28], rax
lea rax, str.Failed_to_open__wZ_with_status_0x_08lx_n
mov r8, rbx
mov rcx, rdi
jmp 0x1800ce0d2
mov dword [rsp + 0x190], r15d
mov rax, qword [0x18015bef0]
mov qword [rsp + 0x198], rax
mov dword [rsp + 0x1a8], 0x40
lea rax, [0x180110b08]
mov qword [rsp + 0x1a0], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x1b0], xmm0
lea r8, [rsp + 0x190]
mov edx, 1
lea rcx, [rsp + 0x130]
call sym.ntdll.dll_NtOpenSymbolicLinkObject
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x1800ceb4a
mov ecx, dword [0x180156a70]
test cl, 3
je 0x1800ce0e9
mov dword [rsp + 0x30], eax
lea rax, [0x180110b08]
mov edx, 0x1167
jmp 0x1800ceab0
mov r8, r15
xor edx, edx
mov rcx, r12
call sym.ntdll.dll_RtlAllocateHeap
mov r13, rax
xor eax, eax
test r13, r13
je 0x1800ce727
mov word [0x18015bed0], ax
mov word [0x18015bed2], r15w
mov qword [0x18015bed8], r13
lea r8, [rsp + 0xe8]
lea rdx, [0x18015bed0]
mov rcx, qword [rsp + 0x130]
call sym.ntdll.dll_NtQuerySymbolicLinkObject
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x1800cebe1
cmp eax, 0xc0000023
jne 0x1800cebbd
mov r8, r13
xor edx, edx
mov rcx, r12
call sym.ntdll.dll_RtlFreeHeap
mov r15d, dword [rsp + 0xe8]
jmp 0x1800ceb4a
mov ecx, dword [0x180156a70]
test cl, 3
je 0x1800ce0e9
mov dword [rsp + 0x28], eax
lea rax, str.Querying_the_known_DLL_directory_link_object_failed_with_status_0x_08lx_n
mov edx, 0x118a
jmp 0x1800cf00a
mov rcx, qword [rsp + 0x130]
call sym.ntdll.dll_NtClose
mov r13, qword [rsp + 0x100]
xor ecx, ecx
cmp dword [0x18015c290], ecx
jne 0x1800cecb9
cmp byte [0x18015c298], cl
jne 0x1800cecb9
movups xmm0, xmmword [r13 + 0x38]
movaps xmmword [rsp + 0x90], xmm0
psrldq xmm0, 8
movq rax, xmm0
mov qword [rsp + 0x98], rax
test rax, rax
je 0x1800cec47
cmp word [rsp + 0x90], cx
je 0x1800cec47
cmp word [rax], cx
jne 0x1800cecca
xor edx, edx
lea r8d, [rdx + 8]
mov rcx, r12
call sym.ntdll.dll_RtlAllocateHeap
mov r15, rax
mov qword [rsp + 0x98], rax
xor r12d, r12d
test rax, rax
jne 0x1800cec87
mov eax, dword [0x180156a70]
test al, 3
je 0x1800ce721
lea rax, str.Allocating_a_buffer_to_hold_the_current_working_directory_failed_n
mov edx, 0x11ba
jmp 0x1800ce708
mov dword [rsp + 0x78], r12d
call sym.ntdll.dll_RtlGetNtSystemRoot
mov ecx, dword [rax]
mov dword [r15], ecx
movzx eax, word [rax + 4]
mov word [r15 + 4], ax
mov rax, qword [rsp + 0x98]
mov word [rax + 6], r12w
mov dword [rsp + 0x90], 0x80006
jmp 0x1800cecca
movaps xmm0, xmmword [rsp + 0x110]
movdqa xmmword [rsp + 0x90], xmm0
call fcn.18007f518
movzx r15d, word [rsp + 0xc8]
mov rax, qword [r14 + 0x20]
test dword [rax + 8], 0x20000000
je 0x1800ceced
lea r15, [r15*2 + 0x16]
mov r12, r15
mov eax, 1
test byte [0x1801596d4], al
jne 0x1800ced1f
movzx eax, word [rsp + 0x110]
add rax, 9
lea r12, [r15 + rax*2]
mov eax, 2
test byte [r14 + 3], al
je 0x1800ced1f
xor eax, eax
mov word [r13 + 0x50], ax
mov rcx, qword gs:[0x60]
mov r8, r12
xor edx, edx
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlAllocateHeap
mov qword [rsp + 0x68], rax
xor r13d, r13d
test rax, rax
jne 0x1800ced62
mov eax, dword [0x180156a70]
test al, 3
je 0x1800ce721
lea rax, str.Failed_to_allocate_the_system_dirs_string__n
mov edx, 0x120d
jmp 0x1800ce708
mov word [rsp + 0x60], r13w
mov word [rsp + 0x62], r12w
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x60]
call sym.ntdll.dll_RtlAppendUnicodeStringToString
movzx edx, word [rsp + 0x60]
mov ecx, edx
shr rcx, 1
mov r8d, 0x3b
mov rax, qword [rsp + 0x68]
mov word [rax + rcx*2 - 2], r8w
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [0x18015cfc0], xmm0
movups xmmword [0x18015c2d0], xmm0
sub dx, 2
mov word [0x18015c2d0], dx
mov rax, qword [r14 + 0x20]
test dword [rax + 8], 0x20000000
je 0x1800cede9
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x60]
call sym.ntdll.dll_RtlAppendUnicodeStringToString
lea rdx, str.forwarders_
lea rcx, [rsp + 0x60]
call sym.ntdll.dll_RtlAppendUnicodeToString
cmp r12, r15
jbe 0x1800cee41
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x60]
call sym.ntdll.dll_RtlAppendUnicodeStringToString
lea rdx, str._system_
lea rcx, [rsp + 0x60]
call sym.ntdll.dll_RtlAppendUnicodeToString
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x60]
call sym.ntdll.dll_RtlAppendUnicodeStringToString
lea rdx, [0x1801183ac]
lea rcx, [rsp + 0x60]
call sym.ntdll.dll_RtlAppendUnicodeToString
movups xmm0, xmmword [rsp + 0x60]
movdqu xmmword [0x18015cfd0], xmm0
mov eax, dword [0x18015d400]
dec eax
cmp eax, 0xfffffffd
ja 0x1800cee5b
lea rcx, [rsp + 0xd8]
call fcn.1800cc678
lea r9, [rsp + 0xf0]
xor r8d, r8d
mov r12, qword [rsp + 0xf8]
mov rdx, r12
lea ecx, [r8 + 3]
call sym.ntdll.dll_RtlImageNtHeaderEx
xor ecx, ecx
call fcn.180040f58
mov r15, rax
test rax, rax
jne 0x1800ceea8
mov eax, dword [0x180156a70]
test al, 3
je 0x1800ce721
lea rax, str.Allocating_a_data_table_entry_for_the_system_DLL_failed_n
mov edx, 0x1278
jmp 0x1800ce708
mov qword [0x18015c348], r15
mov rax, qword [rax + 0x98]
or dword [rax + 0x18], 0xffffffff
mov rax, qword [0x18015c348]
mov rcx, qword [rax + 0x98]
mov rax, qword [rcx]
mov ecx, 0xffff
mov word [rax - 0x34], cx
mov rcx, qword [0x18015c348]
or dword [rcx + 0x68], 0x204
mov rax, qword [0x18016f2e0]
sub qword [rcx + 0xf8], rax
add rcx, 0x48
movups xmm0, xmmword [rsp + 0xc8]
movdqu xmmword [rcx], xmm0
lea rdx, [0x180110b38]
call sym.ntdll.dll_RtlAppendUnicodeStringToString
movups xmm0, xmmword [0x180110b38]
mov rcx, qword [0x18015c348]
movdqu xmmword [rcx + 0x58], xmm0
mov qword [rcx + 0x30], r12
call fcn.18002c268
mov r8d, 0x14a5
mov rcx, qword [0x18015c348]
lea rdx, [rcx + 0x48]
mov rcx, qword [rcx + 0x30]
call fcn.18003bc9c
mov rdx, qword [rsp + 0xf0]
mov rcx, qword [0x18015c348]
call fcn.18007f380
mov r12d, 1
mov r8d, r12d
xor edx, edx
mov rcx, qword [0x18015c348]
call fcn.18002afbc
mov dword [rsp + 0x50], eax
test eax, eax
js 0x1800cfd33
mov r8d, 0x14ae
mov rcx, qword [0x18015c348]
lea rdx, [rcx + 0x48]
mov rcx, qword [rcx + 0x30]
call fcn.18003bc9c
mov rax, qword [0x18015c348]
mov rcx, qword [rax + 0x98]
mov dword [rcx + 0x38], 9
call fcn.18007a78c
lea rax, [r15 + 0x20]
mov rcx, qword [0x18015c390]
lea rdx, [0x18015c390]
cmp qword [rcx + 8], rdx
je 0x1800cefcc
lea ecx, [r12 + 2]
int 0x29
mov qword [rax], rcx
mov qword [rax + 8], rdx
mov qword [rcx + 8], rax
mov qword [0x18015c390], rax
call fcn.180059d2c
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x1800cf022
mov ecx, dword [0x180156a70]
test cl, 3
je 0x1800ce0e9
mov dword [rsp + 0x28], eax
lea rax, str.Failed_to_initialize_Parallel_loader__st__0x_x_n
mov edx, 0x12c7
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, rbx
mov rcx, rdi
call fcn.1800ca394
jmp 0x1800ce0df
xor ecx, ecx
call fcn.1800435b4
lea r8, [rsp + 0x360]
xor edx, edx
xor ecx, ecx
call fcn.180042054
xor edx, edx
mov r8d, 0xc0
lea rcx, [rsp + 0x210]
call sym.ntdll.dll_memset
lea rax, [rsp + 0x360]
mov qword [rsp + 0x220], rax
mov dword [rsp + 0x230], 0x200
movups xmm0, xmmword [rsp + 0xd8]
movdqu xmmword [rsp + 0x210], xmm0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x238], rax
lea rcx, [rsp + 0x210]
call fcn.180040f58
mov r11, rax
test rax, rax
jne 0x1800cf0bc
mov eax, dword [0x180156a70]
test al, 3
je 0x1800ce721
lea rax, str.Allocating_a_data_table_entry_for_the_executable_failed_n
mov edx, 0x12dc
jmp 0x1800ce708
mov qword [0x18015bf88], r11
mov r15d, 2
mov edx, r15d
mov rax, qword [0x18015bf88]
mov rcx, qword [rax + 0x98]
or dword [rcx + 0x18], 0xffffffff
sub rdx, r12
jne 0x1800cf0cc
mov rax, qword [0x18015bf88]
mov rcx, qword [rax + 0x98]
mov rax, qword [rcx]
mov ecx, 0xffff
mov word [rax - 0x34], cx
movups xmm0, xmmword [rsp + 0xd8]
mov rdx, qword [0x18015bf88]
movdqu xmmword [rdx + 0x48], xmm0
mov eax, dword [rdx + 0x68]
or eax, 4
mov dword [rdx + 0x68], eax
mov r12d, dword [rsp + 0x54]
cmp byte [0x18015c308], r13b
je 0x1800cf13b
bts eax, 0x16
mov dword [rdx + 0x68], eax
test r12b, r12b
je 0x1800cf13b
bts eax, 0x18
mov dword [rdx + 0x68], eax
test byte [r14 + 3], 4
je 0x1800cf149
mov qword [rdx + 0xf8], r13
mov r9, r13
movzx r8d, word [rsp + 0xd8]
mov rcx, qword [rsp + 0xe0]
add r8, rcx
mov rax, r8
je 0x1800cf180
cmp r8, rcx
jbe 0x1800cf180
mov r10, rax
sub rax, r15
cmp word [rax], 0x5c
je 0x1800cf17d
cmp rax, rcx
ja 0x1800cf16a
jmp 0x1800cf180
mov r9, r10
test r9, r9
je 0x1800cf1b4
sub r8w, r9w
mov word [rdx + 0x58], r8w
movzx ecx, word [rsp + 0xda]
movzx eax, word [rsp + 0xd8]
sub ecx, eax
cmp ecx, r15d
jb 0x1800cf1a9
add r8w, r15w
mov word [rdx + 0x5a], r8w
mov qword [rdx + 0x60], r9
jmp 0x1800cf1be
movups xmm0, xmmword [r11 + 0x48]
movdqu xmmword [rdx + 0x58], xmm0
mov rcx, qword [r14 + 0x10]
mov rax, rcx
mov r15, qword [rsp + 0xb0]
cmp qword [r15 + 0x30], rcx
je 0x1800cf1fd
test r12b, r12b
jne 0x1800cf1fd
cmp dword [0x18015c290], r13d
jne 0x1800cf1fd
call fcn.1800828d0
mov dword [rsp + 0x50], eax
test eax, eax
js 0x1800cfd33
mov rax, qword [r14 + 0x10]
mov rdx, qword [0x18015bf88]
mov qword [rdx + 0x30], rax
mov rcx, rdx
call fcn.18002c268
test byte [0x180156a70], 5
je 0x1800cf266
mov rax, qword [0x18015bf88]
lea rcx, [rax + 0x48]
add rax, 0x58
lea rdx, [0x18015b2f0]
mov qword [rsp + 0x40], rdx
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
lea rax, str.Beginning_execution_of__wZ___wZ__n_tCurrent_directory:__wZ_n_tPackage_directories:__wZ_n
mov qword [rsp + 0x20], rax
mov r9d, 2
mov r8, rbx
mov edx, 0x1354
mov rcx, rdi
call fcn.1800ca394
mov r8d, 0x14a5
mov rcx, qword [0x18015bf88]
lea rdx, [rcx + 0x48]
mov rcx, qword [rcx + 0x30]
call fcn.18003bc9c
mov rdx, r15
mov rcx, qword [0x18015bf88]
call fcn.18007f380
mov r8d, r13d
cmp dword [0x18015c290], r13d
sete r8b
xor edx, edx
mov rcx, qword [0x18015bf88]
call fcn.18002afbc
mov dword [rsp + 0x50], eax
test eax, eax
js 0x1800cfd33
mov rax, qword [0x18015bf88]
mov rcx, qword [rax + 0x98]
mov dword [rcx + 0x38], 9
lea rcx, [rsp + 0x90]
call fcn.180076b24
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x1800cf328
mov ecx, dword [0x180156a70]
test cl, 3
je 0x1800cf322
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
lea rax, str.Initializing_the_current_directory_to___wZ__failed_with_status_0x_08lx_n
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, rbx
mov edx, 0x1379
mov rcx, rdi
call fcn.1800ca394
mov ecx, dword [0x180156a70]
test sil, cl
je 0x1800cf328
int3
cmp dword [rsp + 0x78], r13d
jne 0x1800cf33c
lea rcx, [rsp + 0x90]
call sym.ntdll.dll_RtlFreeAnsiString
cmp dword [0x18016f29c], r13d
je 0x1800cf513
xor ecx, ecx
call fcn.180040f58
mov r15, rax
test rax, rax
jne 0x1800cf377
mov eax, dword [0x180156a70]
test al, 3
je 0x1800ce721
lea rax, str.Allocating_a_data_table_entry_for_the_application_verifier_DLL_failed_n
mov edx, 0x1390
jmp 0x1800ce708
mov rax, qword [rax + 0x98]
or dword [rax + 0x18], 0xffffffff
mov rax, qword [r15 + 0x98]
mov rcx, qword [rax]
mov eax, 0xffff
mov word [rcx - 0x34], ax
mov r13, qword [rsp + 0x178]
mov eax, dword [r13 + 0x68]
or dword [r15 + 0x68], eax
mov rax, qword [r13 + 0xf8]
mov qword [r15 + 0xf8], rax
xor eax, eax
mov word [r15 + 0x6e], ax
lea r12, [r15 + 0x48]
movups xmm0, xmmword [r13 + 0x48]
movdqu xmmword [r12], xmm0
movups xmm1, xmmword [r13 + 0x58]
movdqu xmmword [r15 + 0x58], xmm1
mov eax, dword [r13 + 0x80]
mov dword [r15 + 0x80], eax
mov rax, qword [r13 + 0x30]
mov qword [r15 + 0x30], rax
mov rcx, r15
call fcn.18002c268
mov r8d, 0x14a5
mov rdx, r12
mov rcx, qword [r15 + 0x30]
call fcn.18003bc9c
lea r9, [rsp + 0xf0]
xor r8d, r8d
mov rdx, qword [r15 + 0x30]
lea ecx, [r8 + 3]
call sym.ntdll.dll_RtlImageNtHeaderEx
mov dword [rsp + 0x50], eax
test eax, eax
js 0x1800cfd33
mov rdx, qword [rsp + 0xf0]
mov rcx, r15
call fcn.18007f380
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, r15
call fcn.18002afbc
mov dword [rsp + 0x50], eax
test eax, eax
js 0x1800cfd33
mov rax, qword [r13 + 0x38]
mov qword [r15 + 0x38], rax
mov r8d, 0x14ad
mov rdx, r12
mov rcx, qword [r15 + 0x30]
call fcn.18003bc9c
mov rax, qword [r15 + 0x98]
mov dword [rax + 0x38], 7
mov r12d, 2
test dword [r14 + 0xbc], 0x100
jne 0x1800cf4b7
test byte [0x18016f29c], r12b
jne 0x1800cf4b7
xor r13d, r13d
mov byte [rsp + 0x58], r13b
lea r8, [rsp + 0x58]
xor edx, edx
mov rcx, qword [r15 + 0x98]
call fcn.180054d18
mov dword [rsp + 0x50], eax
jmp 0x1800cf503
xor r13d, r13d
mov qword [rsp + 0x28], r13
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x20], rax
lea r9d, [r13 + 1]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1800d3be8
mov dword [rsp + 0x50], eax
test eax, eax
js 0x1800cfd33
test byte [0x18016f29c], r12b
je 0x1800cf503
mov rax, qword [r15 + 0x98]
mov dword [rax + 0x38], 9
mov eax, dword [rsp + 0x50]
test eax, eax
js 0x1800cfd33
mov r15, qword [rsp + 0xb0]
call fcn.180047b2c
cmp dword [0x18015c290], r13d
je 0x1800cf5bc
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x1800cf557
call sym.ntdll.dll_NtClose
mov qword [rsp + 0xc0], r13
mov rcx, qword [0x18015bee0]
test rcx, rcx
je 0x1800cf557
call sym.ntdll.dll_NtClose
mov qword [0x18015bee0], r13
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x1800cf571
call sym.ntdll.dll_NtClose
mov qword [rsp + 0x80], r13
lea rcx, [rsp + 0xc8]
call fcn.180081a7c
mov dword [rsp + 0x50], eax
test eax, eax
js 0x1800cfd33
cmp byte [r14 + 2], r13b
je 0x1800cf595
call fcn.1800cc88c
mov dword [0x18015cfb8], 3
lock btr dword [r14 + 0x50], 1
mov rcx, qword [rsp + 0x108]
mov rax, qword [0x18016f220]
call rax
jmp 0x1800cfd0d
mov qword [rsp + 0x140], r13
cmp byte [0x18015c308], r13b
je 0x1800cf65b
lea rcx, [rsp + 0x140]
call fcn.180081034
mov dword [rsp + 0x50], eax
test eax, eax
js 0x1800cfd33
mov r13d, dword [rsp + 0x54]
test r13b, r13b
je 0x1800cf609
mov rcx, qword [r14 + 0x10]
call fcn.18008324c
mov dword [rsp + 0x50], eax
test eax, eax
js 0x1800cfd33
mov rax, qword [rsp + 0x138]
mov ecx, 0x400
mov r12d, 0x40
test word [rax + 0x17ee], cx
je 0x1800cf666
mov r8d, dword [0x7ffe0330]
mov ecx, r8d
and ecx, 0x3f
mov eax, r12d
sub eax, ecx
mov cl, al
mov rdx, qword [0x18015c3c0]
ror rdx, cl
mov eax, r8d
xor rax, rdx
mov rcx, qword [rsp + 0x108]
mov qword [rcx + 0x80], rax
jmp 0x1800cf666
mov r12d, 0x40
mov r13d, dword [rsp + 0x54]
call fcn.18004f9f4
mov dword [rsp + 0x50], eax
xor edx, edx
test eax, eax
jns 0x1800cf699
mov ecx, dword [0x180156a70]
test cl, 3
je 0x1800ce0e9
mov dword [rsp + 0x28], eax
lea rax, str.Initializing_TLS_slots_failed_with_status_0x_08lx_n
mov edx, 0x1473
jmp 0x1800cf00a
mov rcx, qword [rsp + 0x140]
test rcx, rcx
je 0x1800cf6e9
mov byte [rsp + 0x59], dl
lea r8, [rsp + 0x59]
mov rcx, qword [rcx + 0x98]
call fcn.180054d18
mov dword [rsp + 0x50], eax
xor edx, edx
test eax, eax
jns 0x1800cf6e9
mov ecx, dword [0x180156a70]
test cl, 3
je 0x1800ce0e9
mov dword [rsp + 0x28], eax
lea rax, str.DllMain_of_MSCOREE__or_its_dependents__failed_with_status_0x_08lx_n
mov edx, 0x1486
jmp 0x1800cf00a
mov qword [rsp + 0x120], rdx
movzx eax, word [r15 + 0x5c]
sub ax, 2
mov r9d, 1
cmp ax, r9w
ja 0x1800cf9ad
lea r9, [rsp + 0xb8]
lea r8, [0x1801101b0]
xor edx, edx
mov ecx, 0x4001
call sym.ntdll.dll_LdrLoadDll
mov dword [rsp + 0x50], eax
xor r15d, r15d
test eax, eax
js 0x1800cf86c
mov rax, qword [rsp + 0x418]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
lea r9, [0x18015beb0]
xor r8d, r8d
lea rdx, [0x180110b18]
mov rcx, qword [rsp + 0xb8]
call sym.ntdll.dll_LdrGetProcedureAddressForCaller
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x1800cf7bb
mov ecx, dword [0x180156a70]
test cl, 3
je 0x1800ce0e9
mov dword [rsp + 0x38], eax
lea rax, [0x1801101b0]
mov qword [rsp + 0x30], rax
lea rax, [0x180110b18]
mov qword [rsp + 0x28], rax
lea rax, str.Locating_procedure___Z__in_Windows_subsystem_DLL___wZ__failed_with_status_0x_08lx_n
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, rbx
mov edx, 0x14b4
mov rcx, rdi
call fcn.1800ca394
jmp 0x1800ce0df
mov rax, qword [rsp + 0x418]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
lea r9, [rsp + 0x120]
xor r8d, r8d
lea rdx, [0x180110b28]
mov rcx, qword [rsp + 0xb8]
call sym.ntdll.dll_LdrGetProcedureAddressForCaller
call fcn.18003f7f8
mov dword [rsp + 0x50], eax
test eax, eax
js 0x1800cfd33
call fcn.18007bd78
mov dword [rsp + 0x50], eax
test eax, eax
js 0x1800cfd33
lea r8, [rsp + 0x180]
xor edx, edx
lea r15, [0x180110020]
mov rcx, r15
call fcn.180041e34
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x1800cf858
mov ecx, dword [0x180156a70]
test cl, 3
je 0x1800ce0e9
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r15
lea rax, str.Finding___wZ__failed_with_status_0x_08lx_n
mov edx, 0x14f8
jmp 0x1800ceabc
mov rax, qword [rsp + 0x180]
mov rcx, qword [rax + 0x30]
xor r15d, r15d
jmp 0x1800cf916
cmp eax, 0xc0000135
jne 0x1800cfa30
lea r9, [rsp + 0xb8]
lea r15, [0x180110020]
mov r8, r15
xor edx, edx
mov ecx, 0x4001
call sym.ntdll.dll_LdrLoadDll
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x1800cf8c6
mov ecx, dword [0x180156a70]
test cl, 3
je 0x1800ce0e9
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r15
lea rax, str.Loading_Windows_subsystem_DLL___wZ__failed_with_status_0x_08lx_n
mov edx, 0x150a
jmp 0x1800ceabc
call fcn.18007bd78
mov dword [rsp + 0x50], eax
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x1800cf906
cmp eax, 0xc0000135
je 0x1800cf906
mov ecx, dword [0x180156a70]
test cl, 3
je 0x1800ce0e9
mov dword [rsp + 0x28], eax
lea rax, str.LdrpCodeAuthzInitialize_failed_with_status_0x_08lx_n
mov edx, 0x151a
jmp 0x1800cf00a
xor r15d, r15d
mov dword [rsp + 0x50], r15d
mov rcx, qword [rsp + 0xb8]
mov rax, qword [rsp + 0x418]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
lea r9, [rsp + 0x188]
xor r8d, r8d
lea rdx, [0x180110b48]
call sym.ntdll.dll_LdrGetProcedureAddressForCaller
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x1800cf96b
mov ecx, dword [0x180156a70]
test cl, 3
je 0x1800ce0e9
mov dword [rsp + 0x28], eax
lea rax, str.Finding_KernelbasePostInit_failed_with_status_0x_08lx_n
mov edx, 0x1537
jmp 0x1800cf00a
mov rax, qword [rsp + 0x188]
mov rcx, qword [section..00cfg]
call rcx
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x1800cf9a8
mov ecx, dword [0x180156a70]
test cl, 3
je 0x1800ce0e9
mov dword [rsp + 0x28], eax
lea rax, str.Calling_KernelbasePostInit_failed_with_status_0x_08lx_n
mov edx, 0x153f
jmp 0x1800cf00a
mov dword [rsp + 0x50], r15d
xor ecx, ecx
call fcn.1800435b4
xor ecx, ecx
call fcn.18007eda4
mov r15, qword [rsp + 0x148]
xor eax, eax
test r15, r15
je 0x1800cf9df
cmp dword [r15 + 8], eax
je 0x1800cf9df
mov qword [r14 + 0x2e0], rax
mov rcx, r15
call fcn.180055808
mov rax, qword gs:[0x60]
mov ecx, dword [rax + 0x2c8]
bt rcx, 0x16
movzx eax, byte [0x18015ac08]
mov edx, 1
cmovb eax, edx
mov byte [0x18015ac08], al
mov rax, qword gs:[0x60]
mov ecx, dword [rax + 0x2c8]
mov rax, qword [rsp + 0x100]
bt rcx, 0x1c
jae 0x1800cfa60
mov dword [rax + 0x40c], edx
mov ecx, edx
jmp 0x1800cfa66
mov ecx, dword [0x180156a70]
test cl, 3
je 0x1800ce0e9
mov dword [rsp + 0x30], eax
lea rax, [0x1801101b0]
mov qword [rsp + 0x28], rax
lea rax, str.Loading_Windows_subsystem_DLL___wZ__failed_with_status_0x_08lx_n
mov edx, 0x1525
jmp 0x1800ceabc
mov ecx, dword [rax + 0x40c]
call fcn.180056e90
mov edx, 1
mov dword [0x18015cfb8], edx
mov rax, qword [0x18015bf88]
mov rcx, qword [rax + 0x98]
lea eax, [rdx + 1]
mov dword [rcx + 0x38], eax
mov rax, qword [rsp + 0x238]
xor ecx, ecx
mov dword [rax], ecx
test r13b, r13b
je 0x1800cfaac
mov rcx, qword [0x18015bf88]
call fcn.180082ecc
xor r13d, r13d
jmp 0x1800cfae9
or dword [rsp + 0x230], edx
lea rcx, [rsp + 0x210]
call fcn.180039100
mov ecx, 1
call fcn.1800435b4
mov eax, dword [rsp + 0x50]
xor r13d, r13d
test eax, eax
js 0x1800cfaf1
mov rdx, qword [rsp + 0x238]
mov rcx, qword [0x18015bf88]
call fcn.18002df14
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x1800cfb15
mov ecx, dword [0x180156a70]
test cl, 3
je 0x1800ce0e9
mov dword [rsp + 0x28], eax
lea rax, str.Walking_the_import_tables_of_the_executable_and_its_static_imports_failed_with_status_0x_08lx_n
mov edx, 0x1613
jmp 0x1800cf00a
mov eax, 2
mov dword [0x18015cfb8], eax
cmp byte [r14 + 2], r13b
je 0x1800cfb2b
call fcn.1800cc88c
call fcn.180047b2c
mov rax, qword [0x18015beb0]
test rax, rax
je 0x1800cfb73
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 1]
mov r9, qword [section..00cfg]
call r9
mov dword [rsp + 0x50], eax
test eax, eax
js 0x1800cfd33
mov rcx, qword [rsp + 0x120]
call fcn.180080b60
mov dword [rsp + 0x50], eax
test eax, eax
js 0x1800cfd33
mov rax, qword [rsp + 0x108]
mov qword [0x18015c320], rax
xor ecx, ecx
call fcn.1800435b4
call fcn.180046fbc
mov rax, qword [0x18015bf88]
mov byte [rsp + 0x5a], r13b
lea r8, [rsp + 0x5a]
mov rdx, qword [rsp + 0x238]
mov rcx, qword [rax + 0x98]
call fcn.180054d18
mov dword [rsp + 0x50], eax
mov r8d, eax
mov edx, 9
call fcn.180046f60
mov rdx, qword [rsp + 0x238]
mov rcx, qword [0x18015bf88]
mov rcx, qword [rcx + 0x98]
call fcn.18006b490
call fcn.180047b2c
mov qword [0x18015c320], r13
cmp byte [rsp + 0x3dc], r13b
je 0x1800cfc02
mov rcx, qword [rsp + 0x360]
call sym.ntdll.dll_RtlReleasePath
mov eax, dword [rsp + 0x50]
test eax, eax
jns 0x1800cfc2e
mov ecx, dword [0x180156a70]
test cl, 3
je 0x1800ce0e9
mov dword [rsp + 0x28], eax
lea rax, str.Running_the_init_routines_of_the_executables_static_imports_failed_with_status_0x_08lx_n
mov edx, 0x169a
jmp 0x1800cf00a
mov rbx, qword [0x18015bf88]
cmp word [rbx + 0x6e], r13w
je 0x1800cfc98
mov qword [rsp + 0x1c0], 0x48
mov edi, 1
mov dword [rsp + 0x1c8], edi
xor edx, edx
lea r8d, [rdi + 0x37]
lea rcx, [rsp + 0x1d0]
call sym.ntdll.dll_memset
mov rdx, qword [rbx + 0x88]
lea rcx, [rsp + 0x1c0]
call sym.ntdll.dll_RtlActivateActivationContextUnsafeFast
nop
mov rdx, qword [0x18015bf88]
mov ecx, edi
call fcn.18003b5f8
nop
lea rcx, [rsp + 0x1c0]
call sym.ntdll.dll_RtlDeactivateActivationContextUnsafeFast
cmp byte [0x18015cfb4], r13b
je 0x1800cfcf8
mov r9d, dword [0x7ffe0330]
mov eax, r9d
and eax, 0x3f
sub r12d, eax
mov cl, r12b
mov r8, qword [0x18016f218]
ror r8, cl
mov eax, r9d
xor rax, r8
mov rdx, r15
lea rcx, [rsp + 0xa0]
mov r8, qword [section..00cfg]
call r8
test al, al
jne 0x1800cfcf8
mov byte [0x18015cfb4], r13b
mov rcx, qword [0x18015c340]
call sym.ntdll.dll_LdrUnloadDll
mov qword [0x18015c340], r13
mov rax, qword [r14 + 0x230]
test rax, rax
je 0x1800cfd0d
mov rcx, qword [section..00cfg]
call rcx
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x1800cfd1f
call sym.ntdll.dll_NtClose
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x1800cfd31
call sym.ntdll.dll_NtClose
xor eax, eax
mov rcx, qword [rsp + 0x3e0]
xor rcx, rsp
call fcn.18008b0e0
lea r11, [rsp + 0x3f0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x80000002
call sym.ntdll.dll_RtlRaiseStatus
nop
push rbp
sub rsp, 0x50
mov rbp, rdx
lea rcx, [rbp + 0x1c0]
call sym.ntdll.dll_RtlDeactivateActivationContextUnsafeFast
nop
add rsp, 0x50
pop rbp
ret