Function at 0x18002db70
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb00
mov rax, qword [0x1800a2de8]
xor rax, rsp
mov qword [rsp + 0xaf0], rax
mov rdi, r8
mov rbx, rdx
mov qword [rsp + 0x78], rdx
mov r13, qword [0x1800a6d10]
xor esi, esi
mov word [rsp + 0xe0], si
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0xe2]
call fcn.180056c20
or eax, 0xffffffff
mov dword [rsp + 0x80], eax
xor ecx, ecx
call fcn.180055ff8
mov qword [rsp + 0x98], rax
mov r14d, dword [r13 + 0x4248]
lea edx, [rsi + 0x5c]
lea rcx, [rbx + 0x14]
call fcn.1800540e8
mov r15, rax
test rax, rax
jne 0x18002dc0b
lea r15, [rsp + 0xe0]
jmp 0x18002dc0f
add r15, 2
lea rdx, str.java.exe
mov rcx, r15
call fcn.180052ca8
test eax, eax
je 0x18002dc54
lea rdx, str.javaw.exe
mov rcx, r15
call fcn.180052ca8
test eax, eax
je 0x18002dc54
lea rdx, str.javaws.exe
mov rcx, r15
call fcn.180052ca8
test eax, eax
je 0x18002dc54
lea r12, [0x180000000]
jmp 0x18002dd76
mov r8d, esi
mov dword [rsp + 0x60], esi
nop dword [rax + rax]
cmp r8d, r14d
jge 0x18002dcca
movsxd rax, r8d
imul rdx, rax, 0x62c
mov rcx, qword [r13 + 0x4250]
mov eax, dword [rdi + 0x620]
cmp dword [rdx + rcx + 0x414], eax
je 0x18002dc8f
inc r8d
mov dword [rsp + 0x60], r8d
jmp 0x18002dc60
cmp r8d, r14d
jge 0x18002dcca
movsxd rax, r8d
imul rcx, rax, 0x62c
mov rax, qword [r13 + 0x4250]
mov edx, dword [rcx + rax + 0x628]
cmp edx, 1
je 0x18002dcb9
cmp edx, 0x200
jne 0x18002dcca
mov dword [rdi + 0x628], 0x1000
xor eax, eax
jmp 0x18002f595
mov ebx, esi
lea r8, str.MicrosoftEdge.exe
mov dword [rsp + 0x64], ebx
cmp ebx, 4
jge 0x18002dd2f
movsxd rax, ebx
imul rdx, rax, 0x20c
add rdx, r8
lea rcx, [rdi + 0x418]
call fcn.180052ca8
test eax, eax
je 0x18002dcfd
inc ebx
jmp 0x18002dccc
lea r8, str.MicrosoftEdge.exe
cmp ebx, 4
jge 0x18002dd2f
movsxd rax, ebx
imul rcx, rax, 0x20c
cmp dword [rcx + r8 + 0x208], 0
je 0x18002dd2f
mov dword [rdi + 0x628], 0x1000
xor eax, eax
jmp 0x18002f595
mov ebx, esi
lea r12, [0x180000000]
mov dword [rsp + 0x70], ebx
cmp ebx, 0x15
jge 0x18002dd76
movsxd rdx, ebx
lea rcx, [rdi + 0x418]
mov rdx, qword [r12 + rdx*8 + 0x884c0]
call fcn.180052ca8
test eax, eax
je 0x18002dd60
inc ebx
jmp 0x18002dd38
cmp ebx, 0x15
jge 0x18002dd76
mov dword [rdi + 0x628], 0x1000
xor eax, eax
jmp 0x18002f595
cmp dword [rdi + 0x628], 0x400
jne 0x18002e0aa
lea r15, [rdi + 0x418]
mov qword [rsp + 0xa0], r15
test r14d, r14d
jle 0x18002ded4
mov edx, dword [rdi + 0x620]
mov ebx, esi
mov dword [rsp + 0x60], ebx
cmp ebx, r14d
jge 0x18002de05
movsxd rax, ebx
imul rcx, rax, 0x62c
mov rax, qword [r13 + 0x4250]
cmp dword [rcx + rax + 0x414], edx
je 0x18002ddcd
inc ebx
jmp 0x18002dda6
cmp ebx, r14d
jge 0x18002de05
movsxd rax, ebx
imul rcx, rax, 0x62c
mov rax, qword [r13 + 0x4250]
mov edx, dword [rcx + rax + 0x620]
mov dword [rsp + 0x80], ebx
mov dword [rsp + 0xc8], ebx
cmp dword [rcx + rax + 0x628], 0x400
je 0x18002dda4
movsxd rax, ebx
imul r12, rax, 0x62c
mov rax, qword [r13 + 0x4250]
add rax, r12
mov qword [rsp + 0x68], rax
mov ecx, dword [rax + 0x628]
lea eax, [rcx - 1]
cmp eax, 1
jbe 0x18002de3c
cmp ecx, 0x200
je 0x18002de3c
cmp ecx, 0x2000
jne 0x18002de90
mov word [rsp + 0x2f0], si
xor edx, edx
mov r8d, 0x3fe
lea rcx, [rsp + 0x2f2]
call fcn.180056c20
mov rcx, qword [rsp + 0x68]
add rcx, 0x20c
je 0x18002de74
lea rdx, [rsp + 0x2f0]
call fcn.180008a60
lea rcx, [rdi + 0x418]
lea rdx, [rsp + 0x2f0]
call fcn.180052ca8
test eax, eax
je 0x18002f595
cmp ebx, r14d
jl 0x18002debb
movsxd rax, dword [rsp + 0x80]
test eax, eax
js 0x18002ded4
imul rcx, rax, 0x62c
mov r15, qword [r13 + 0x4250]
add r15, 0x20c
add r15, rcx
jmp 0x18002decc
mov r15, qword [r13 + 0x4250]
add r15, 0x20c
add r15, r12
mov qword [rsp + 0xa0], r15
mov ebx, esi
lea r14, str.MicrosoftEdge.exe
mov dword [rsp + 0x64], ebx
cmp ebx, 4
jge 0x18002df24
movsxd rax, ebx
imul rdx, rax, 0x20c
add rdx, r14
mov rcx, r15
call fcn.180052ca8
test eax, eax
je 0x18002df03
inc ebx
jmp 0x18002dedd
cmp ebx, 4
jge 0x18002df24
movsxd rax, ebx
imul rcx, rax, 0x20c
cmp dword [rcx + r14 + 0x208], 0
je 0x18002df24
xor eax, eax
jmp 0x18002f595
mov ebx, esi
lea r14, [0x180000000]
mov dword [rsp + 0x60], ebx
cmp ebx, 0x15
jge 0x18002df5d
movsxd rdx, ebx
mov rdx, qword [r14 + rdx*8 + 0x884c0]
mov rcx, r15
call fcn.180052ca8
test eax, eax
je 0x18002df51
inc ebx
jmp 0x18002df2d
cmp ebx, 0x15
jge 0x18002df5d
xor eax, eax
jmp 0x18002f595
mov qword [rsp + 0x68], rsi
mov ecx, 0x1000a
call fcn.180053ad4
mov r14, rax
mov ecx, 0x2000a
call fcn.180053ad4
mov rbx, rax
test r14, r14
je 0x18002e06d
test rax, rax
je 0x18002e06d
lea rdx, [rdi + 0x418]
mov r8, qword [rsp + 0x78]
lea r9, [r8 + 0x14]
mov ecx, dword [rdi + 0x620]
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], rdx
mov ecx, dword [r8 + 0x10]
mov dword [rsp + 0x20], ecx
lea r8, str.Uninjecting_Conditional_Shield_process:__s____d____s____d
mov edx, 0xffff
mov rcx, rax
call fcn.180053a4c
test eax, eax
jle 0x18002e053
mov word [rbx + 0x1fffe], si
mov rdx, 0xfffffffffffffffe
mov rcx, rbx
call fcn.180053398
lea r8, [rax + 1]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
mov rdx, r14
lea rcx, [rsp + 0x68]
call fcn.180054798
test eax, eax
je 0x18002e026
mov r8d, 0x14
mov rdx, rbx
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.180053f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x28], 0x14
mov qword [rsp + 0x20], r14
lea r9, str.CheckConditionalShieldProceses
mov edx, 0x8d8
mov r8d, 3
lea rcx, str...ServerIpcNA.cpp
call fcn.180001b40
jmp 0x18002e086
mov edx, 0x14
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x18002e080
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test r14, r14
je 0x18002e093
mov rcx, r14
call fcn.180053a94
test rbx, rbx
je 0x18002e0a0
mov rcx, rbx
call fcn.180053a94
mov eax, 0x14
jmp 0x18002f595
lea rdx, str.cmd.exe
mov rcx, r15
call fcn.180052ca8
test eax, eax
jne 0x18002e76c
mov ebx, esi
mov dword [rsp + 0x60], ebx
cmp ebx, r14d
jge 0x18002e0f0
movsxd rax, ebx
imul rdx, rax, 0x62c
mov rcx, qword [r13 + 0x4250]
mov eax, dword [rdi + 0x620]
cmp dword [rdx + rcx + 0x414], eax
je 0x18002e0f0
inc ebx
jmp 0x18002e0c3
mov r15d, esi
mov dword [rsp + 0x64], esi
lea r12, str.MicrosoftEdge.exe
nop
cmp r15d, 4
jge 0x18002e12d
movsxd rax, r15d
imul rdx, rax, 0x20c
add rdx, r12
lea rcx, [rdi + 0x418]
call fcn.180052ca8
test eax, eax
je 0x18002e12d
inc r15d
mov dword [rsp + 0x64], r15d
jmp 0x18002e100
mov r12d, esi
mov dword [rsp + 0x70], esi
cmp r12d, 0x15
jge 0x18002e166
movsxd rdx, r12d
lea rcx, [rdi + 0x418]
lea rax, [0x180000000]
mov rdx, qword [rax + rdx*8 + 0x884c0]
call fcn.180052ca8
test eax, eax
je 0x18002e166
inc r12d
mov dword [rsp + 0x70], r12d
jmp 0x18002e134
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0x1e
mov dword [rsp + 0x80], eax
mov qword [rsp + 0x90], rsi
mov ecx, 0x1000a
call fcn.180053ad4
mov qword [rsp + 0x68], rax
mov ecx, 0x2000a
call fcn.180053ad4
mov r10, rax
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0x68], 0
je 0x18002e2f7
test rax, rax
je 0x18002e2f7
cmp ebx, r14d
jl 0x18002e1c1
or edx, 0xffffffff
jmp 0x18002e1d9
movsxd rax, ebx
imul rcx, rax, 0x62c
mov rax, qword [r13 + 0x4250]
mov edx, dword [rcx + rax + 0x628]
lea rcx, [rdi + 0x418]
mov r8, qword [rsp + 0x78]
lea r9, [r8 + 0x14]
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x48], edx
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x38], ebx
mov eax, dword [rdi + 0x620]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rcx
mov eax, dword [r8 + 0x10]
mov dword [rsp + 0x20], eax
lea r8, str.CmdExclusionProcessNames_checking:__s____d____s____d____d____d____d____d____d
mov edx, 0xffff
mov rcx, r10
call fcn.180053a4c
test eax, eax
jle 0x18002e2db
mov rax, qword [rsp + 0x88]
mov word [rax + 0x1fffe], si
mov rdx, 0xfffffffffffffffe
mov rcx, rax
call fcn.180053398
lea r8, [rax + 1]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x90]
call fcn.180054798
test eax, eax
je 0x18002e2a6
mov r8d, dword [rsp + 0x80]
mov rdx, qword [rsp + 0x88]
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.180053f50
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, str.CheckConditionalShieldProceses
mov edx, 0x8f9
mov r8d, 3
lea rcx, str...ServerIpcNA.cpp
call fcn.180001b40
jmp 0x18002e310
mov edx, dword [rsp + 0x80]
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x18002e30a
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x18002e322
mov rcx, rax
call fcn.180053a94
mov rax, qword [rsp + 0x88]
test rax, rax
je 0x18002e337
mov rcx, rax
call fcn.180053a94
cmp r15d, 4
jge 0x18002e35f
movsxd rax, r15d
imul rcx, rax, 0x20c
lea rax, str.MicrosoftEdge.exe
cmp dword [rcx + rax + 0x208], 0
je 0x18002e35f
xor eax, eax
jmp 0x18002f595
cmp r12d, 0x15
jge 0x18002e36c
xor eax, eax
jmp 0x18002f595
cmp ebx, r14d
jge 0x18002e6c3
movsxd rax, ebx
imul r12, rax, 0x62c
mov qword [rsp + 0x90], r12
mov rax, qword [r13 + 0x4250]
mov ecx, dword [r12 + rax + 0x628]
lea eax, [rcx - 1]
cmp eax, 1
jbe 0x18002e3af
cmp ecx, 8
je 0x18002e3af
cmp ecx, 0x200
jne 0x18002e6c3
mov word [rsp + 0x6f0], si
xor edx, edx
mov r8d, 0x3fe
lea rcx, [rsp + 0x6f2]
call fcn.180056c20
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r15d, [rax + 0x1e]
mov qword [rsp + 0x88], rsi
mov ecx, 0x1000a
call fcn.180053ad4
mov r14, rax
mov ecx, 0x2000a
call fcn.180053ad4
mov rbx, rax
test r14, r14
je 0x18002e4f8
test rax, rax
je 0x18002e4f8
mov rdx, qword [r13 + 0x4250]
lea rcx, [rdx + 0x20c]
add rcx, r12
lea r8, [rdi + 0x418]
mov qword [rsp + 0x38], rcx
mov ecx, dword [rdx + r12 + 0x628]
mov dword [rsp + 0x30], ecx
mov ecx, dword [rdi + 0x620]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r8
mov r9d, dword [rdi + 0x414]
lea r8, str.Keeping_cmd.exe__d_._Parent__s__d__in_injected_as_Family_0x_X._Registered_parent_name:__s
mov edx, 0xffff
mov rcx, rax
call fcn.180053a4c
test eax, eax
jle 0x18002e4e0
mov word [rbx + 0x1fffe], si
mov rdx, 0xfffffffffffffffe
mov rcx, rbx
call fcn.180053398
lea r8, [rax + 1]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
mov rdx, r14
lea rcx, [rsp + 0x88]
call fcn.180054798
test eax, eax
je 0x18002e4b6
mov r8d, r15d
mov rdx, rbx
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.180053f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r14
lea r9, str.CheckConditionalShieldProceses
mov edx, 0x910
mov r8d, 3
lea rcx, str...ServerIpcNA.cpp
call fcn.180001b40
jmp 0x18002e511
mov edx, r15d
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x18002e50b
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test r14, r14
je 0x18002e51e
mov rcx, r14
call fcn.180053a94
test rbx, rbx
je 0x18002e52b
mov rcx, rbx
call fcn.180053a94
mov rcx, qword [r13 + 0x4250]
add rcx, 0x20c
add rcx, r12
je 0x18002e54b
lea rdx, [rsp + 0x6f0]
call fcn.180008a60
lea r12, [rdi + 0x418]
lea rdx, [rsp + 0x6f0]
mov rcx, r12
call fcn.180052ca8
test eax, eax
je 0x18002f595
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r15d, [rax + 0x1e]
mov qword [rsp + 0x78], rsi
mov ecx, 0x1000a
call fcn.180053ad4
mov r14, rax
mov ecx, 0x2000a
call fcn.180053ad4
mov rbx, rax
test r14, r14
je 0x18002e690
test rax, rax
je 0x18002e690
mov rcx, qword [r13 + 0x4250]
mov rax, qword [rsp + 0x90]
lea rdx, [rax + 0x20c]
add rdx, rcx
mov ecx, dword [rax + rcx + 0x414]
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x30], rdx
mov ecx, dword [rdi + 0x620]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r12
mov r9d, dword [rdi + 0x414]
lea r8, str.Keeping_cmd.exe__d_._Discordance_detected_between_process_parent__s__d__and_stored_injected_parent__s__d_._Uninjecting...
mov edx, 0xffff
mov rcx, rbx
call fcn.180053a4c
test eax, eax
jle 0x18002e678
mov word [rbx + 0x1fffe], si
mov rdx, 0xfffffffffffffffe
mov rcx, rbx
call fcn.180053398
lea r8, [rax + 1]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
mov rdx, r14
lea rcx, [rsp + 0x78]
call fcn.180054798
test eax, eax
je 0x18002e64e
mov r8d, r15d
mov rdx, rbx
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.180053f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r14
lea r9, str.CheckConditionalShieldProceses
mov edx, 0x91b
mov r8d, 3
lea rcx, str...ServerIpcNA.cpp
call fcn.180001b40
jmp 0x18002e6a9
mov edx, r15d
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x18002e6a3
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test r14, r14
je 0x18002e6b6
mov rcx, r14
call fcn.180053a94
test rbx, rbx
je 0x18002e6c3
mov rcx, rbx
call fcn.180053a94
mov ecx, 0x1000a
call fcn.180053ad4
mov rbx, rax
test rax, rax
jne 0x18002e6f0
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x18002e762
lea r8, [0x180088a64]
mov edx, 0xffff
mov rcx, rax
call fcn.180053a70
test eax, eax
jle 0x18002e73c
mov byte [rbx + 0xffff], 0
mov dword [rsp + 0x28], 0x14
mov qword [rsp + 0x20], rbx
lea r9, str.CheckConditionalShieldProceses
mov edx, 0x921
mov r8d, 1
lea rcx, str...ServerIpcNA.cpp
call fcn.180001b40
jmp 0x18002e75a
mov edx, 0x14
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rbx
call fcn.180053a94
mov eax, 0x14
jmp 0x18002f595
lea rdx, str.mshta.exe
mov rcx, r15
call fcn.180052ca8
test eax, eax
jne 0x18002e7b3
lea rcx, [rdi + 0x418]
lea rdx, str.svchost.exe
call fcn.180052ca8
test eax, eax
jne 0x18002e7ad
mov rax, qword [0x1800a6d10]
cmp dword [rax + 0xb4], 0
je 0x18002e7ad
xor eax, eax
jmp 0x18002f595
mov dword [rdi + 0x628], esi
lea rdx, str.jp2launcher.exe
mov rcx, r15
call fcn.180052ca8
test eax, eax
jne 0x18002e8d3
cmp dword [r13 + 0xfc], eax
je 0x18002e82a
lea rcx, [rdi + 0x418]
lea rdx, str.iexplore.exe
call fcn.180052ca8
test eax, eax
je 0x18002f595
mov dword [rsp + 0x60], esi
cmp esi, r14d
jge 0x18002e82a
movsxd rax, esi
imul rdx, rax, 0x62c
add rdx, qword [r13 + 0x4250]
mov eax, dword [rdi + 0x620]
cmp dword [rdx + 0x414], eax
jne 0x18002e826
cmp dword [rdx + 0x628], 0x20
jne 0x18002e82a
xor eax, eax
jmp 0x18002f595
inc esi
jmp 0x18002e7ee
mov ecx, 0x1000a
call fcn.180053ad4
mov rbx, rax
test rax, rax
jne 0x18002e857
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x18002e8c9
lea r8, [0x180088a64]
mov edx, 0xffff
mov rcx, rax
call fcn.180053a70
test eax, eax
jle 0x18002e8a3
mov byte [rbx + 0xffff], 0
mov dword [rsp + 0x28], 0x14
mov qword [rsp + 0x20], rbx
lea r9, str.CheckConditionalShieldProceses
mov edx, 0x947
mov r8d, 1
lea rcx, str...ServerIpcNA.cpp
call fcn.180001b40
jmp 0x18002e8c1
mov edx, 0x14
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rbx
call fcn.180053a94
mov eax, 0x14
jmp 0x18002f595
mov ebx, esi
mov dword [rsp + 0x60], ebx
cmp ebx, 1
jge 0x18002eb03
movsxd rdx, ebx
mov rdx, qword [r12 + rdx*8 + 0x88570]
mov rcx, r15
call fcn.180052ca8
test eax, eax
je 0x18002e8fd
inc ebx
jmp 0x18002e8d5
cmp ebx, 1
jge 0x18002eb03
mov ebx, esi
mov dword [rsp + 0x64], ebx
cmp ebx, 0x15
jge 0x18002e946
movsxd rdx, ebx
lea rcx, [rdi + 0x418]
mov rdx, qword [r12 + rdx*8 + 0x884c0]
call fcn.180052ca8
test eax, eax
je 0x18002e930
inc ebx
jmp 0x18002e908
cmp ebx, 0x15
jge 0x18002e946
mov dword [rdi + 0x628], 0x800
xor eax, eax
jmp 0x18002f595
mov r8d, esi
mov dword [rsp + 0x70], esi
nop dword [rax]
cmp r8d, r14d
jge 0x18002e9b0
movsxd rax, r8d
imul rdx, rax, 0x62c
mov rcx, qword [r13 + 0x4250]
mov eax, dword [rdi + 0x620]
cmp dword [rdx + rcx + 0x414], eax
je 0x18002e97f
inc r8d
mov dword [rsp + 0x70], r8d
jmp 0x18002e950
cmp r8d, r14d
jge 0x18002e9b0
movsxd rax, r8d
imul rcx, rax, 0x62c
mov rax, qword [r13 + 0x4250]
cmp dword [rcx + rax + 0x628], 2
jne 0x18002e9b0
mov dword [rdi + 0x628], 0x800
xor eax, eax
jmp 0x18002f595
mov qword [rsp + 0x80], rsi
mov ecx, 0x1000a
call fcn.180053ad4
mov r14, rax
mov ecx, 0x2000a
call fcn.180053ad4
mov rbx, rax
test r14, r14
je 0x18002eac6
test rax, rax
je 0x18002eac6
lea rdx, [rdi + 0x418]
mov r8, qword [rsp + 0x78]
lea r9, [r8 + 0x14]
mov ecx, dword [rdi + 0x620]
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], rdx
mov ecx, dword [r8 + 0x10]
mov dword [rsp + 0x20], ecx
lea r8, str.Uninjecting_Conditional_Shield_process:__s____d____s____d
mov edx, 0xffff
mov rcx, rax
call fcn.180053a4c
test eax, eax
jle 0x18002eaac
mov word [rbx + 0x1fffe], si
mov rdx, 0xfffffffffffffffe
mov rcx, rbx
call fcn.180053398
lea r8, [rax + 1]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
mov rdx, r14
lea rcx, [rsp + 0x80]
call fcn.180054798
test eax, eax
je 0x18002ea7f
mov r8d, 0x14
mov rdx, rbx
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.180053f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x28], 0x14
mov qword [rsp + 0x20], r14
lea r9, str.CheckConditionalShieldProceses
mov edx, 0x976
mov r8d, 3
lea rcx, str...ServerIpcNA.cpp
call fcn.180001b40
jmp 0x18002eadf
mov edx, 0x14
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x18002ead9
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test r14, r14
je 0x18002eaec
mov rcx, r14
call fcn.180053a94
test rbx, rbx
je 0x18002eaf9
mov rcx, rbx
call fcn.180053a94
mov eax, 0x14
jmp 0x18002f595
mov ebx, esi
mov dword [rsp + 0x60], ebx
cmp ebx, 8
jge 0x18002ed13
movsxd rdx, ebx
mov rdx, qword [r12 + rdx*8 + 0x88580]
mov rcx, r15
call fcn.180052ca8
test eax, eax
je 0x18002eb2d
inc ebx
jmp 0x18002eb05
cmp ebx, 8
jge 0x18002ed13
mov ebx, esi
lea r12, str.MicrosoftEdge.exe
mov dword [rsp + 0x60], ebx
cmp ebx, 4
jge 0x18002eb94
movsxd rax, ebx
imul rdx, rax, 0x20c
add rdx, r12
lea rcx, [rdi + 0x418]
call fcn.180052ca8
test eax, eax
je 0x18002eb69
inc ebx
jmp 0x18002eb3f
cmp ebx, 4
jge 0x18002eb94
movsxd rax, ebx
imul rcx, rax, 0x20c
cmp dword [rcx + r12 + 0x208], 0
je 0x18002eb94
mov dword [rdi + 0x628], 0x800
xor eax, eax
jmp 0x18002f595
cmp dword [rdi + 0x628], 0x800
jne 0x18002ebad
mov dword [rdi + 0x628], esi
xor eax, eax
jmp 0x18002f595
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r12d, [rax + 0x1e]
mov qword [rsp + 0xd0], rsi
mov ecx, 0x1000a
call fcn.180053ad4
mov qword [rsp + 0x68], rax
mov ecx, 0x2000a
call fcn.180053ad4
mov rbx, rax
cmp qword [rsp + 0x68], 0
je 0x18002ecdb
test rax, rax
je 0x18002ecdb
lea rdx, [rdi + 0x418]
mov r8, qword [rsp + 0x78]
lea r9, [r8 + 0x14]
mov ecx, dword [rdi + 0x628]
mov dword [rsp + 0x38], ecx
mov ecx, dword [rdi + 0x620]
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], rdx
mov ecx, dword [r8 + 0x10]
mov dword [rsp + 0x20], ecx
lea r8, str.ConditionalShieldProcessNames___KillableProcessNamesBrowsers:__s____d____s____d____d
mov edx, 0xffff
mov rcx, rax
call fcn.180053a4c
test eax, eax
jle 0x18002ecc3
mov word [rbx + 0x1fffe], si
mov rdx, 0xfffffffffffffffe
mov rcx, rbx
call fcn.180053398
lea r8, [rax + 1]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0xd0]
call fcn.180054798
test eax, eax
je 0x18002ec94
mov r8d, r12d
mov rdx, rbx
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.180053f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x28], r12d
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, str.CheckConditionalShieldProceses
mov edx, 0x99a
mov r8d, 3
lea rcx, str...ServerIpcNA.cpp
call fcn.180001b40
jmp 0x18002ecf4
mov edx, r12d
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x18002ecee
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x18002ed06
mov rcx, rax
call fcn.180053a94
test rbx, rbx
je 0x18002ed13
mov rcx, rbx
call fcn.180053a94
mov ebx, esi
mov dword [rsp + 0x60], ebx
cmp ebx, 2
jge 0x18002edb0
movsxd rdx, ebx
lea rax, [0x180000000]
mov rdx, qword [rax + rdx*8 + 0x885c0]
mov rcx, r15
call fcn.180052ca8
test eax, eax
je 0x18002ed44
inc ebx
jmp 0x18002ed15
cmp ebx, 2
jge 0x18002edb0
mov r8d, esi
mov dword [rsp + 0x64], esi
cmp r8d, r14d
jge 0x18002edb0
movsxd rax, r8d
imul rdx, rax, 0x62c
mov rcx, qword [r13 + 0x4250]
mov eax, dword [rdi + 0x620]
cmp dword [rdx + rcx + 0x414], eax
je 0x18002ed7f
inc r8d
mov dword [rsp + 0x64], r8d
jmp 0x18002ed50
cmp r8d, r14d
jge 0x18002edb0
movsxd rax, r8d
imul rcx, rax, 0x62c
mov rax, qword [r13 + 0x4250]
cmp dword [rcx + rax + 0x628], 2
jne 0x18002edb0
mov dword [rdi + 0x628], 0x800
xor eax, eax
jmp 0x18002f595
mov ebx, esi
lea r14, [0x180000000]
mov dword [rsp + 0x60], ebx
cmp ebx, 6
jge 0x18002ede6
movsxd rdx, ebx
mov rdx, qword [r14 + rdx*8 + 0x88490]
mov rcx, r15
call fcn.180052ca8
test eax, eax
je 0x18002eddd
inc ebx
jmp 0x18002edb9
cmp ebx, 6
jl 0x18002ef33
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r15d, [rax + 0x1e]
mov qword [rsp + 0x98], rsi
mov ecx, 0x1000a
call fcn.180053ad4
mov r14, rax
mov ecx, 0x2000a
call fcn.180053ad4
mov rbx, rax
test r14, r14
je 0x18002eef9
test rax, rax
je 0x18002eef9
lea rdx, [rdi + 0x418]
mov rax, qword [rsp + 0x78]
lea r9, [rax + 0x14]
mov ecx, dword [rdi + 0x620]
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], rdx
mov ecx, dword [rax + 0x10]
mov dword [rsp + 0x20], ecx
lea r8, str.ConditionalShieldProcessNames___Not_Found:__s____d____s____d
mov edx, 0xffff
mov rcx, rbx
call fcn.180053a4c
test eax, eax
jle 0x18002eee1
mov word [rbx + 0x1fffe], si
mov rdx, 0xfffffffffffffffe
mov rcx, rbx
call fcn.180053398
lea r8, [rax + 1]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
mov rdx, r14
lea rcx, [rsp + 0x98]
call fcn.180054798
test eax, eax
je 0x18002eeb7
mov r8d, r15d
mov rdx, rbx
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.180053f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r14
lea r9, str.CheckConditionalShieldProceses
mov edx, 0x9c6
mov r8d, 3
lea rcx, str...ServerIpcNA.cpp
call fcn.180001b40
jmp 0x18002ef12
mov edx, r15d
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x18002ef0c
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test r14, r14
je 0x18002ef1f
mov rcx, r14
call fcn.180053a94
test rbx, rbx
je 0x18002ef2c
mov rcx, rbx
call fcn.180053a94
xor eax, eax
jmp 0x18002f595
mov rax, qword [0x1800a7a08]
add rax, 5
mov r13, qword [rsp + 0x98]
cmp r13, rax
jge 0x18002ef59
mov qword [0x1800a7a08], r13
xor eax, eax
jmp 0x18002f595
mov r15d, dword [rdi + 0x620]
test r15d, r15d
je 0x18002f3a4
lea r12, [rdi + 0x418]
cmp word [r12], 0
je 0x18002f3a4
mov ecx, r15d
call fcn.18000c930
test eax, eax
je 0x18002f0d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r15d, [rax + 0x1e]
mov qword [rsp + 0xc0], rsi
mov ecx, 0x1000a
call fcn.180053ad4
mov r14, rax
mov ecx, 0x2000a
call fcn.180053ad4
mov rbx, rax
test r14, r14
je 0x18002f098
test rax, rax
je 0x18002f098
mov rax, qword [rsp + 0x78]
lea r9, [rax + 0x14]
mov ecx, dword [rdi + 0x620]
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], r12
mov ecx, dword [rax + 0x10]
mov dword [rsp + 0x20], ecx
lea r8, str.Parent_process_injected:__s____d____s____d
mov edx, 0xffff
mov rcx, rbx
call fcn.180053a4c
test eax, eax
jle 0x18002f080
mov word [rbx + 0x1fffe], si
mov rdx, 0xfffffffffffffffe
mov rcx, rbx
call fcn.180053398
lea r8, [rax + 1]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
mov rdx, r14
lea rcx, [rsp + 0xc0]
call fcn.180054798
test eax, eax
je 0x18002f056
mov r8d, r15d
mov rdx, rbx
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.180053f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r14
lea r9, str.CheckConditionalShieldProceses
mov edx, 0x9e1
mov r8d, 3
lea rcx, str...ServerIpcNA.cpp
call fcn.180001b40
jmp 0x18002f0b1
mov edx, r15d
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x18002f0ab
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test r14, r14
je 0x18002f0be
mov rcx, r14
call fcn.180053a94
test rbx, rbx
je 0x18002f0cb
mov rcx, rbx
call fcn.180053a94
mov qword [0x1800a7a08], r13
xor eax, eax
jmp 0x18002f595
mov ebx, esi
mov dword [rsp + 0x60], ebx
cmp ebx, 0x15
jge 0x18002f259
movsxd rdx, ebx
mov rdx, qword [r14 + rdx*8 + 0x884c0]
mov rcx, r12
call fcn.180052ca8
test eax, eax
je 0x18002f103
inc ebx
jmp 0x18002f0db
cmp ebx, 0x15
jge 0x18002f259
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r15d, [rax + 0x1e]
mov qword [rsp + 0xa8], rsi
mov ecx, 0x1000a
call fcn.180053ad4
mov r14, rax
mov ecx, 0x2000a
call fcn.180053ad4
mov rbx, rax
test r14, r14
je 0x18002f218
test rax, rax
je 0x18002f218
mov rax, qword [rsp + 0x78]
lea r9, [rax + 0x14]
mov ecx, dword [rdi + 0x620]
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], r12
mov ecx, dword [rax + 0x10]
mov dword [rsp + 0x20], ecx
lea r8, str.Parent_process_ExploitableProcessNames:__s____d____s____d
mov edx, 0xffff
mov rcx, rbx
call fcn.180053a4c
test eax, eax
jle 0x18002f200
mov word [rbx + 0x1fffe], si
mov rdx, 0xfffffffffffffffe
mov rcx, rbx
call fcn.180053398
lea r8, [rax + 1]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
mov rdx, r14
lea rcx, [rsp + 0xa8]
call fcn.180054798
test eax, eax
je 0x18002f1d6
mov r8d, r15d
mov rdx, rbx
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.180053f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r14
lea r9, str.CheckConditionalShieldProceses
mov edx, 0x9f3
mov r8d, 3
lea rcx, str...ServerIpcNA.cpp
call fcn.180001b40
jmp 0x18002f231
mov edx, r15d
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x18002f22b
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test r14, r14
je 0x18002f23e
mov rcx, r14
call fcn.180053a94
test rbx, rbx
je 0x18002f24b
mov rcx, rbx
call fcn.180053a94
mov qword [0x1800a7a08], r13
xor eax, eax
jmp 0x18002f595
mov qword [rsp + 0xb0], rsi
mov ecx, 0x1000a
call fcn.180053ad4
mov r14, rax
mov ecx, 0x2000a
call fcn.180053ad4
mov rbx, rax
test r14, r14
je 0x18002f367
test rax, rax
je 0x18002f367
mov rax, qword [rsp + 0x78]
lea r9, [rax + 0x14]
mov ecx, dword [rdi + 0x620]
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], r12
mov ecx, dword [rax + 0x10]
mov dword [rsp + 0x20], ecx
lea r8, str.Uninjecting_Conditional_Shield_process:__s____d____s____d
mov edx, 0xffff
mov rcx, rbx
call fcn.180053a4c
test eax, eax
jle 0x18002f34d
mov word [rbx + 0x1fffe], si
mov rdx, 0xfffffffffffffffe
mov rcx, rbx
call fcn.180053398
lea r8, [rax + 1]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
mov rdx, r14
lea rcx, [rsp + 0xb0]
call fcn.180054798
test eax, eax
je 0x18002f320
mov r8d, 0x14
mov rdx, rbx
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.180053f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x28], 0x14
mov qword [rsp + 0x20], r14
lea r9, str.CheckConditionalShieldProceses
mov edx, 0x9fd
mov r8d, 3
lea rcx, str...ServerIpcNA.cpp
call fcn.180001b40
jmp 0x18002f380
mov edx, 0x14
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x18002f37a
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test r14, r14
je 0x18002f38d
mov rcx, r14
call fcn.180053a94
test rbx, rbx
je 0x18002f39a
mov rcx, rbx
call fcn.180053a94
mov eax, 0x14
jmp 0x18002f595
mov qword [rsp + 0xb8], rsi
mov ecx, 0x1000a
call fcn.180053ad4
mov r14, rax
mov ecx, 0x2000a
call fcn.180053ad4
mov rbx, rax
test r14, r14
je 0x18002f4b4
test rax, rax
je 0x18002f4b4
lea rcx, [rdi + 0x418]
mov rax, qword [rsp + 0x78]
lea r9, [rax + 0x14]
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], rcx
mov ecx, dword [rax + 0x10]
mov dword [rsp + 0x20], ecx
lea r8, str.GetParentProcessInfo:__s____d____s____d
mov edx, 0xffff
mov rcx, rbx
call fcn.180053a4c
test eax, eax
jle 0x18002f49a
mov word [rbx + 0x1fffe], si
mov rdx, 0xfffffffffffffffe
mov rcx, rbx
call fcn.180053398
lea r8, [rax + 1]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
mov rdx, r14
lea rcx, [rsp + 0xb8]
call fcn.180054798
test eax, eax
je 0x18002f46d
mov r8d, 0x14
mov rdx, rbx
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.180053f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x28], 0x14
mov qword [rsp + 0x20], r14
lea r9, str.CheckConditionalShieldProceses
mov edx, 0x9da
mov r8d, 1
lea rcx, str...ServerIpcNA.cpp
call fcn.180001b40
jmp 0x18002f4cd
mov edx, 0x14
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x18002f4c7
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test r14, r14
je 0x18002f4da
mov rcx, r14
call fcn.180053a94
test rbx, rbx
je 0x18002f4e7
mov rcx, rbx
call fcn.180053a94
mov eax, 0x14
jmp 0x18002f595
mov rcx, qword [rsp + 0xaf0]
xor rcx, rsp
call fcn.180052be0
lea r11, [rsp + 0xb00]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret