Function at 0x12884570
Capabilities:
Create thread
Enumerate gui resources
Query environment variable
Terminate thread

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1e0
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x228], rbx
mov rax, qword [0x12a52ee0]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov r14, r8
mov r12, rcx
test edx, edx
je 0x1288503e
sub edx, 1
je 0x1288461b
sub edx, 1
je 0x128845e7
cmp edx, 1
jne 0x12885221
call fcn.12821110
test eax, eax
jne 0x128845dd
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call fcn.1285af90
call fcn.128854e0
jmp 0x12885221
call fcn.12885480
call fcn.12821110
test eax, eax
jne 0x12885221
call fcn.12837420
test eax, eax
je 0x12885221
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
mov rcx, r12
call fcn.1285ae90
jmp 0x12885221
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r15d, eax
lea rcx, [0x129abd30]
call fcn.12820f30
test eax, eax
je 0x1288463e
mov eax, 9
jmp 0x12885223
lea rdx, [0x129adcc8]
lea rcx, [0x129adcf0]
call fcn.12820fe0
mov dword [0x129adcc4], eax
xor r9d, r9d
xor r8d, r8d
mov ebp, 1
mov edx, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x129abbc0], rax
mov rcx, r12
call fcn.12820c00
xor esi, esi
mov dword [0x129abaec], esi
cmp qword [0x129abae0], rsi
sete r13b
mov qword [0x129abae0], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
mov qword [0x129ade20], rdx
mov rcx, qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
call fcn.12836c30
cmp qword [rax + 0x20], 8
jb 0x128846bd
mov rcx, qword [rax + 8]
jmp 0x128846c1
lea rcx, [rax + 8]
lea rdx, str.drwtsn32.exe
call fcn.1295a6e4
test eax, eax
jne 0x128846db
mov eax, 0xa
jmp 0x12885223
mov rcx, qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
call fcn.12836c30
cmp qword [rax + 0x20], 8
jb 0x128846f4
mov rcx, qword [rax + 8]
jmp 0x128846f8
lea rcx, [rax + 8]
call fcn.12827600
test eax, eax
je 0x12884719
mov edx, eax
lea rcx, str.pmrpc_fen_lstatus:_0x_x
call fcn.12805270
mov eax, 8
jmp 0x12885223
call fcn.12885b70
call fcn.12885440
call fcn.12885480
call fcn.1280d120
call fcn.12885f40
call fcn.12819370
mov dword [0x129abaf4], eax
call fcn.12895110
mov rcx, r12
call fcn.1281edd0
call fcn.128868f0
mov dword [0x129abb88], ebp
movzx eax, byte [0x129ac469]
mov dword [0x129ae3e4], eax
call fcn.128734b0
call fcn.128539b0
mov byte [0x129ad260], sil
lea rax, [0x129acf20]
mov qword [0x129acf58], rax
mov byte [0x129ad261], sil
call fcn.128257f0
lea rdx, [0x12a22f00]
lea rcx, str.USERNAME
call fcn.1280d4d0
lea rdx, [0x12a22f28]
lea rcx, str.USERDOMAIN
call fcn.1280d4d0
lea rdx, [0x12a22f50]
lea rcx, str.SYS_USERNAME
call fcn.1280d4d0
lea rdx, [0x12a22f78]
lea rcx, str.SYS_USERDOMAIN
call fcn.1280d4d0
mov qword [rsp + 0xc0], 7
mov qword [rsp + 0xb8], rsi
mov word [rsp + 0xa8], si
lea r8, [rsp + 0xa0]
xor edx, edx
mov rcx, qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.12836b20
lea rdi, [rsp + 0xa8]
cmp qword [rsp + 0xc0], 8
cmovae rdi, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
mov dword [rsp + 0x44], esi
lea rdx, [rsp + 0x44]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r14
lea r14, [0x129b25a8]
mov qword [rsp + 0x20], r14
mov r9d, dword [rsp + 0x44]
mov r8d, ebx
mov edx, ebx
lea rcx, str._PID:0x_x__PID:_u___SessionId__u___Loadding_voshook.dll___s_lpReserved0x_p___s
call fcn.12805270
mov ebx, dword [0x129adec8]
test ebx, ebx
je 0x128848b0
call fcn.128864e0
lea rcx, str.__SxSi
mov rdi, r14
test eax, eax
cmovne rdi, rcx
call fcn.128864d0
lea rcx, [0x129d1228]
test eax, eax
cmovne r14, rcx
mov r9, rdi
mov r8, r14
mov edx, ebx
lea rcx, str.appmode_0x_x_s_s
call fcn.12805270
nop
cmp qword [rsp + 0xc0], 8
jb 0x128848c8
mov rcx, qword [rsp + 0xa8]
call fcn.12958250
mov qword [rsp + 0xc0], 7
mov qword [rsp + 0xb8], rsi
mov word [rsp + 0xa8], si
call fcn.128500b0
lea rcx, [0x129b4df0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
je 0x1288496f
lea rdx, str.LdrEnumerateLoadedModules
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x129abc80], rax
lea rdx, str.LdrAddRefDll
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x129abc88], rax
lea rdx, str.RtlCreateUnicodeString
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x129abc90], rax
lea rdx, str.RtlFreeUnicodeString
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x129abc98], rax
cmp dword [0x129adcc4], 7
jl 0x1288496f
mov dword [0x129abca0], ebp
mov dword [0x129abc24], ebp
test r13b, r13b
je 0x128849f0
call fcn.12886640
lea r9, [0x129ade80]
mov r8d, 0x185
lea rdx, str.NtSetDefaultHardErrorPort
mov rcx, r12
call fcn.12818e30
test eax, eax
je 0x128849a3
mov eax, 6
jmp 0x12885223
call fcn.12821b40
lea rcx, str.HopedotVOSComm
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x129abae8], eax
lea rdx, str.VOSHelper
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rdi, rax
test rax, rax
je 0x128849f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, eax
mov r8d, 0x3000
mov edx, dword [0x129abae8]
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
call fcn.128889a0
test eax, eax
jne 0x12884a00
mov eax, ebp
jmp 0x12885223
call sym.hdHook.dll_int___cdecl_LTest_int____ptr64_
call fcn.128477a0
call fcn.1285cb70
call fcn.128ab870
call fcn.128a7cb0
test r13b, r13b
je 0x12884a2e
cmp dword [0x129ade0c], 0
je 0x12884a2e
mov ecx, ebp
call fcn.12889da0
call fcn.12885310
call fcn.128510a0
mov r8d, 0x80
lea rdx, [rsp + 0xd0]
lea rcx, [0x129bead0]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x12884b4a
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xd0]
call fcn.1295ab94
test eax, eax
je 0x12884b4a
test r13b, r13b
je 0x12884a88
mov ecx, ebp
call fcn.12821170
mov qword [0x129abb08], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
lea rcx, [0x129ac550]
call fcn.1287dc50
test eax, eax
je 0x12884aaa
mov eax, 2
jmp 0x12885223
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
mov edx, eax
lea rcx, str.RegMapper_Initialize_successed___ums
call fcn.12805270
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
lea rcx, [0x129acba0]
call fcn.12882b90
test eax, eax
jne 0x12884ae2
mov eax, 3
jmp 0x12885223
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
mov edx, eax
lea rcx, str.FileIoMapper_Initialize_successed___ums
call fcn.12805270
lea rcx, [0x12a21f48]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x12a21ef0]
call fcn.12855220
lea rcx, str.PortMapper_Initialize_successed_
call fcn.12805270
lea rcx, [0x129ad7f0]
call fcn.12957330
mov edx, eax
lea rcx, str.RPCM_Initialize_lret:_0x_x
call fcn.12805270
test r13b, r13b
je 0x12884b4a
call fcn.128240e0
test eax, eax
jne 0x12884b4a
call fcn.1285b320
movzx ecx, byte [0x129ad260]
call fcn.12885ab0
call fcn.12885aa0
test eax, eax
je 0x12884b6b
lea rcx, str.SxsM
call fcn.12805270
call fcn.12849fa0
call fcn.1284a5e0
call fcn.12846e40
call fcn.12887150
call fcn.1283ce00
call fcn.1281f3b0
call fcn.1284f920
call fcn.128243d0
mov edx, ebp
xchg dword [0x129abb80], edx
test r13b, r13b
je 0x12884ba5
call fcn.1283ce90
lea rcx, str.Api_hooking_successed_
call fcn.12805270
mov rcx, qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
call fcn.12836c30
cmp qword [rax + 0x20], 8
jb 0x12884bca
mov rcx, qword [rax + 8]
jmp 0x12884bce
lea rcx, [rax + 8]
lea rdx, [0x129bfc10]
call fcn.1295a6e4
test eax, eax
je 0x12884c01
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x12820c40]
xor edx, edx
xor ecx, ecx
call fcn.12958fc0
mov qword [0x129abce0], rax
call fcn.128a7fe0
call fcn.12837750
cmp dword [0x129ade0c], 0
je 0x12884c19
call fcn.128893a0
mov qword [rsp + 0x98], 7
mov qword [rsp + 0x90], rsi
mov word [rsp + 0x80], si
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rsi
mov word [rsp + 0x50], si
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, str.VosInstallDir
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, str.VosInstallDir
lea rcx, [rsp + 0x48]
call fcn.12803dc0
nop
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x48]
call fcn.12888930
mov edi, eax
cmp qword [rsp + 0x68], 8
jb 0x12884c94
mov rcx, qword [rsp + 0x50]
call fcn.12958250
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rsi
mov word [rsp + 0x50], si
test edi, edi
je 0x12884cef
lea r9, [rsp + 0x80]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x98]
cmp rax, 8
cmovae r9, rcx
lea r8, [rsp + 0x80]
cmp rax, 8
cmovae r8, rcx
lea rdx, str._sSoftwareWindowsSystem32__sSoftwareWindows
lea rcx, [0x12a21c58]
call fcn.12804810
nop
cmp qword [rsp + 0x98], 8
jb 0x12884d07
mov rcx, qword [rsp + 0x80]
call fcn.12958250
mov qword [rsp + 0x98], 7
mov qword [rsp + 0x90], rsi
mov word [rsp + 0x80], si
call fcn.128240e0
test eax, eax
jne 0x12884d31
call fcn.1280b120
call fcn.12821110
test eax, eax
jne 0x12884d5c
call fcn.12837420
test eax, eax
je 0x12884e64
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
mov rcx, r12
call fcn.1285ae90
jmp 0x12884e64
test r13b, r13b
je 0x12884e64
mov rcx, qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
call fcn.12836c30
cmp qword [rax + 0x20], 8
jb 0x12884d7e
mov rcx, qword [rax + 8]
jmp 0x12884d82
lea rcx, [rax + 8]
lea rdx, [0x129bfc10]
call fcn.1295a6e4
test eax, eax
sete al
test al, al
jne 0x12884dc5
mov rcx, qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
call fcn.12836c30
cmp qword [rax + 0x20], 8
jb 0x12884db0
mov rcx, qword [rax + 8]
jmp 0x12884db4
lea rcx, [rax + 8]
lea rdx, str.services.exe
call fcn.1295a6e4
jmp 0x12884e64
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x129bf6a0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [0x129bf6a0]
lea rcx, [0x12a21c80]
call fcn.12803dc0
lea rdx, [0x129ada60]
mov qword [0x12a21d20], rdx
mov dword [0x12a21d28], ebp
mov rax, qword [0x12a21d10]
mov rcx, qword [rax]
mov qword [rax], rax
mov rax, qword [0x12a21d10]
mov qword [rax + 8], rax
mov qword [0x12a21d18], rsi
cmp rcx, qword [0x12a21d10]
je 0x12884e44
nop dword [rax + rax]
mov rdi, qword [rcx]
call fcn.12958250
mov rcx, rdi
cmp rdi, qword [0x12a21d10]
jne 0x12884e30
lea rdx, [0x12a21c80]
lea rcx, [0x12851810]
call qword [sym.imp.USER32.dll_EnumWindowStationsW]
lea rcx, [0x12a21c80]
call fcn.12851930
call fcn.1282feb0
test eax, eax
je 0x12884ea9
mov rcx, qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
call fcn.12836c30
cmp qword [rax + 0x20], 8
jb 0x12884e86
mov rcx, qword [rax + 8]
jmp 0x12884e8a
lea rcx, [rax + 8]
lea rdx, str.services.exe
call fcn.1295a6e4
mov ecx, dword [0x129abb20]
test eax, eax
cmove ecx, ebp
mov dword [0x129abb20], ecx
jmp 0x12884eaf
mov ecx, dword [0x129abb20]
cmp dword [0x129ae22c], 0
je 0x12884ec4
test ecx, ecx
je 0x12884ec4
mov dword [0x129ae22c], ebp
jmp 0x12884eca
mov dword [0x129ae22c], esi
call fcn.12886bc0
cmp byte [0x129ac442], 0
je 0x12884f47
mov rcx, qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
call fcn.12836c30
cmp qword [rax + 0x20], 8
jb 0x12884ef1
mov rcx, qword [rax + 8]
jmp 0x12884ef5
lea rcx, [rax + 8]
lea rdx, str.sqlservr.exe
call fcn.1295a6e4
test eax, eax
je 0x12884f3a
mov rcx, qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
call fcn.12836c30
cmp qword [rax + 0x20], 8
jb 0x12884f1e
mov rcx, qword [rax + 8]
jmp 0x12884f22
lea rcx, [rax + 8]
lea rdx, str.inetinfo.exe
call fcn.1295a6e4
test eax, eax
je 0x12884f3a
mov dword [0x129abcc0], esi
jmp 0x12884f40
mov dword [0x129abcc0], ebp
call fcn.12885be0
jmp 0x12884f7e
mov rcx, qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
call fcn.12836c30
cmp qword [rax + 0x20], 8
jb 0x12884f60
mov rcx, qword [rax + 8]
jmp 0x12884f64
lea rcx, [rax + 8]
lea rdx, str.sqlservr.exe
call fcn.1295a6e4
test eax, eax
jne 0x12884f7e
mov eax, 0xb
jmp 0x12885223
xor r8d, r8d
lea rdx, [0x1285cf00]
lea rcx, [0x129adb50]
call fcn.1280cff0
test eax, eax
je 0x12884fb0
mov edx, eax
lea rcx, str.pmc.start_failed:_0x_x
call fcn.12805270
mov eax, 7
jmp 0x12885223
call fcn.12823e80
cmp dword [0x129ad8d0], 0
je 0x12884fc3
call fcn.1284f5d0
mov rcx, qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
call fcn.12836c30
cmp qword [rax + 0x20], 8
jb 0x12884fdc
mov rcx, qword [rax + 8]
jmp 0x12884fe0
lea rcx, [rax + 8]
lea rdx, str.explorer.exe
call fcn.1295a6e4
test eax, eax
jne 0x1288501c
lea r8, str.Globalhopedotvoseventexplorerinitend
xor edx, edx
lea ecx, [rax + 2]
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov rdi, rax
test rax, rax
je 0x1288501c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, r15d
mov edx, eax
lea rcx, str.voshook.dll_has_been_Loaded.__ums
call fcn.12805270
mov dword [0x129abaec], ebp
jmp 0x12885221
lock or dword [0x129abafc], 2
mov rcx, qword [0x129abbc0]
test rcx, rcx
je 0x12885058
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea rcx, [0x129adb50]
call fcn.1280c110
call fcn.1281ee60
mov rcx, qword [0x129abce0]
test rcx, rcx
je 0x128850a3
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x12885096
mov edx, 0xfffffffe
mov rcx, qword [0x129abce0]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x129abce0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.12821110
test eax, eax
jne 0x128850b5
xor ecx, ecx
call fcn.1285af90
jmp 0x128850d3
mov rcx, qword [0x129abb18]
test rcx, rcx
je 0x128850c7
call qword [sym.imp.USER32.dll_CloseDesktop]
lea rcx, [0x12a21c80]
call fcn.12832360
xor ecx, ecx
call fcn.1285af90
xor esi, esi
mov rcx, qword [0x129ac4b0]
test rcx, rcx
je 0x128850f5
call qword [0x129adff8]
mov qword [0x129ac4b0], rsi
mov rcx, qword [0x129abb30]
test rcx, rcx
je 0x12885107
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.128a7c90
lea rdx, str.VOSHelper
lea rcx, str.VOSHELPER
call qword [sym.imp.USER32.dll_FindWindowW]
mov rdi, rax
test rax, rax
je 0x12885146
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, eax
mov r8d, 0x4000
mov edx, dword [0x129abae8]
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov ebp, 1
mov dword [rsp + 0x40], ebp
lea rcx, [rsp + 0x40]
call fcn.12885ad0
call fcn.1281f5a0
call fcn.12819370
test eax, eax
je 0x1288516c
call fcn.12957fc0
cmp dword [rsp + 0x40], esi
je 0x1288517e
lea rcx, [0x129ade80]
call fcn.128133f0
call fcn.128a7ce0
call fcn.128a7fc0
mov rcx, qword [0x129ac4b0]
test rcx, rcx
je 0x128851a1
call qword [0x129adff8]
mov qword [0x129ac4b0], rsi
mov rcx, qword [0x129abb08]
test rcx, rcx
je 0x128851b3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
xchg dword [0x12a2174c], eax
mov rcx, r12
call fcn.12889380
cmp dword [0x129abbd0], esi
je 0x128851f5
mov rcx, qword [0x129abbd8]
test rcx, rcx
je 0x128851dd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x129abbe0]
test rcx, rcx
je 0x128851ef
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x129abbd0], esi
call fcn.128854e0
call fcn.12885460
call sym.hdHook.dll_int___cdecl_LTest_int____ptr64_
cmp dword [0x129abaec], esi
jne 0x12885215
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
lea rcx, str.voshook.dll_Unloaded
call fcn.12805270
xor eax, eax
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.12959850
mov rbx, qword [rsp + 0x228]
add rsp, 0x1e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret