Function at 0x18001f240
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
call fcn.18001e040
test eax, eax
jne 0x180020000
lea rdx, str.360desktop
lea rcx, [0x180108f60]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
mov edi, 1
xor esi, esi
test rax, rax
jne 0x18001f29b
lea rdx, str.360FileBrowser
lea rcx, [0x180108f60]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x18001f29b
mov ebx, esi
jmp 0x18001f29d
mov ebx, edi
call fcn.180046e00
mov ecx, esi
cmp dword [rax], 0x3e7
setne cl
mov dword [0x180108d2c], ecx
call fcn.180046e00
mov ecx, dword [rax]
mov dword [0x1801037cc], ecx
mov dword [rsp + 0x80], 4
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x88]
lea r8, [0x1800cfa18]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x18001f31f
cmp dword [rsp + 0x88], 4
jne 0x18001f31f
cmp dword [rsp + 0x90], esi
jne 0x18001f37e
mov dword [rsp + 0x80], 4
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x88]
lea r8, [0x1800cfa58]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x18001f386
cmp dword [rsp + 0x88], 4
jne 0x18001f386
cmp dword [rsp + 0x90], esi
je 0x18001f386
mov dword [0x180108d38], edi
jmp 0x18001f38c
mov dword [0x180108d38], esi
lea rdx, [rsp + 0x80]
lea rcx, [0x180108f60]
call fcn.180040360
mov dword [0x18010b2b8], eax
call fcn.180046e00
mov ecx, dword [rax + 0xc]
cmp ecx, edi
je 0x18001f3bf
cmp ecx, 3
jne 0x18001f3c4
cmp dword [0x1801037cc], edi
jne 0x18001f3c4
call fcn.18004cc00
mov dword [0x18010bc58], esi
cmp byte [0x18010699b], sil
je 0x18001f3d8
call fcn.18007cd9c
mov dword [0x18010b83c], edi
call fcn.1800a5780
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.1800a6230
lea rdx, str.taskmgr.exe
lea rcx, [0x180108f60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x18001f455
cmp dword [0x18010b304], esi
jne 0x18001f46e
mov dword [0x18010b304], esi
lea rdx, str.NtQuerySystemInformation
lea rcx, str.ntdll.dll
call fcn.1800a7b40
mov qword [0x18010b308], rax
test rax, rax
je 0x18001f46e
lea rdx, [0x180044240]
lea rcx, [0x18010b308]
call fcn.1800a6320
test eax, eax
jne 0x18001f46e
mov dword [0x18010b304], edi
jmp 0x18001f46e
cmp dword [0x180108d44], esi
jne 0x18001f461
test ebx, ebx
je 0x18001f46e
cmp dword [0x180108d3c], esi
jne 0x18001f46e
call fcn.180044a00
lea rdx, str.sldworks.exe
lea rcx, [0x180108f60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x18001f491
mov dword [0x180108f5c], edi
jmp 0x18001f53a
lea rdx, str.wpscloudsvr.exe
lea rcx, [0x180108f60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x18001f4b4
mov dword [0x180109168], edi
jmp 0x18001f53a
lea rdx, str.allegro.exe
lea rcx, [0x180108f60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x18001f4d4
mov dword [0x18010916c], edi
jmp 0x18001f53a
lea rdx, str.wps.exe
lea rcx, [0x180108f60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x18001f534
lea rdx, str.et.exe
lea rcx, [0x180108f60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x18001f534
lea rdx, str.wpp.exe
lea rcx, [0x180108f60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x18001f534
lea rdx, str.wpspdf.exe
lea rcx, [0x180108f60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x18001f53a
mov dword [0x180108f58], edi
call fcn.180016f20
cmp dword [0x180108d2c], esi
je 0x18001fa7a
cmp dword [0x180108d44], esi
jne 0x18001fa7a
lea rcx, [0x1801087e8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov r11d, dword [0x1801037cc]
cmp r11d, 2
jne 0x18001f57d
call fcn.18001dac0
mov r11d, dword [0x1801037cc]
test r11d, r11d
je 0x18001f591
cmp r11d, edi
je 0x18001f591
cmp r11d, 2
jne 0x18001fa6b
call fcn.18001e4d0
test eax, eax
je 0x18001f646
or dword [0x18010b17c], 2
cmp dword [0x18010b188], esi
jne 0x18001f646
mov dword [0x18010b188], esi
lea rdx, [0x1800d0288]
lea rcx, str.kernelbase.dll
call fcn.1800a7b40
mov qword [0x18010b180], rax
test rax, rax
je 0x18001f5f5
lea rdx, [0x18001cb70]
lea rcx, [0x18010b180]
call fcn.1800a6320
test eax, eax
jne 0x18001f5f5
mov dword [0x18010b188], edi
jmp 0x18001f646
cmp dword [0x18010b188], esi
jne 0x18001f646
mov dword [0x18010b188], esi
lea rdx, [0x1800d0288]
lea rcx, [0x1800cee20]
call fcn.1800a7b40
mov qword [0x18010b180], rax
test rax, rax
je 0x18001f646
lea rdx, [0x18001cb70]
lea rcx, [0x18010b180]
call fcn.1800a6320
mov ecx, dword [0x18010b188]
test eax, eax
cmove ecx, edi
mov dword [0x18010b188], ecx
mov rax, qword [0x18010b180]
mov qword [0x18010d230], rax
lea rdx, str.acad.exe
lea rcx, [0x180108f60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x18001f88f
lea rdx, str.x2.exe
lea rcx, [0x180108f60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x18001f88f
lea rdx, str.Photoshop.exe
lea rcx, [0x180108f60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x18001f88f
lea rdx, str.xtop.exe
lea rcx, [0x180108f60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x18001f819
mov dword [0x18010b174], edi
cmp dword [0x18010b18c], esi
jne 0x18001f76b
mov dword [0x18010b18c], esi
lea rdx, str.CopyFileExW
lea rcx, str.kernelbase.dll
call fcn.1800a7b40
mov qword [0x18010b190], rax
test rax, rax
je 0x18001f71a
lea rdx, [0x18001d200]
lea rcx, [0x18010b190]
call fcn.1800a6320
test eax, eax
jne 0x18001f71a
mov dword [0x18010b18c], edi
jmp 0x18001f76b
cmp dword [0x18010b18c], esi
jne 0x18001f76b
mov dword [0x18010b18c], esi
lea rdx, str.CopyFileExW
lea rcx, [0x1800cee20]
call fcn.1800a7b40
mov qword [0x18010b190], rax
test rax, rax
je 0x18001f76b
lea rdx, [0x18001d200]
lea rcx, [0x18010b190]
call fcn.1800a6320
mov ecx, dword [0x18010b18c]
test eax, eax
cmove ecx, edi
mov dword [0x18010b18c], ecx
cmp dword [0x18010b1bc], esi
jne 0x18001fa6b
mov dword [0x18010b1bc], esi
lea rdx, [0x1800d0490]
lea rcx, str.kernelbase.dll
call fcn.1800a7b40
mov qword [0x18010b1c0], rax
test rax, rax
je 0x18001f7be
lea rdx, [0x18001d690]
lea rcx, [0x18010b1c0]
call fcn.1800a6320
test eax, eax
jne 0x18001f7be
mov dword [0x18010b1bc], edi
jmp 0x18001fa6b
cmp dword [0x18010b1bc], esi
jne 0x18001fa6b
mov dword [0x18010b1bc], esi
lea rdx, [0x1800d0490]
lea rcx, [0x1800cee20]
call fcn.1800a7b40
mov qword [0x18010b1c0], rax
test rax, rax
je 0x18001fa6b
lea rdx, [0x18001d690]
lea rcx, [0x18010b1c0]
call fcn.1800a6320
test eax, eax
jne 0x18001fa6b
mov dword [0x18010b1bc], edi
jmp 0x18001fa6b
cmp dword [0x180108f58], esi
je 0x18001fa6b
cmp dword [0x1801037cc], edi
jne 0x18001fa6b
cmp dword [0x18010b1d4], esi
jne 0x18001fa6b
mov dword [0x18010b1d4], esi
lea rdx, str._XIsFileExist
lea rcx, str.kbase.dll
call fcn.1800a7b40
mov qword [0x18010b1d8], rax
test rax, rax
je 0x18001fa6b
lea rdx, [0x18001f1d0]
lea rcx, [0x18010b1d8]
call fcn.1800a6320
mov ecx, dword [0x18010b1d4]
test eax, eax
cmove ecx, edi
mov dword [0x18010b1d4], ecx
jmp 0x18001fa6b
cmp dword [0x18010b1b8], esi
jne 0x18001f930
mov dword [0x18010b1b8], esi
lea rdx, [0x1800d0430]
lea rcx, str.kernelbase.dll
call fcn.1800a7b40
mov qword [0x18010b1b0], rax
test rax, rax
je 0x18001f8df
lea rdx, [0x18001d420]
lea rcx, [0x18010b1b0]
call fcn.1800a6320
test eax, eax
jne 0x18001f8df
mov dword [0x18010b1b8], edi
jmp 0x18001f930
cmp dword [0x18010b1b8], esi
jne 0x18001f930
mov dword [0x18010b1b8], esi
lea rdx, [0x1800d0430]
lea rcx, [0x1800cee20]
call fcn.1800a7b40
mov qword [0x18010b1b0], rax
test rax, rax
je 0x18001f930
lea rdx, [0x18001d420]
lea rcx, [0x18010b1b0]
call fcn.1800a6320
mov ecx, dword [0x18010b1b8]
test eax, eax
cmove ecx, edi
mov dword [0x18010b1b8], ecx
cmp dword [0x18010b1a4], esi
jne 0x18001f9d1
mov dword [0x18010b1a4], esi
lea rdx, [0x1800d0440]
lea rcx, str.kernelbase.dll
call fcn.1800a7b40
mov qword [0x18010b1a8], rax
test rax, rax
je 0x18001f980
lea rdx, [0x18001d4d0]
lea rcx, [0x18010b1a8]
call fcn.1800a6320
test eax, eax
jne 0x18001f980
mov dword [0x18010b1a4], edi
jmp 0x18001f9d1
cmp dword [0x18010b1a4], esi
jne 0x18001f9d1
mov dword [0x18010b1a4], esi
lea rdx, [0x1800d0440]
lea rcx, [0x1800cee20]
call fcn.1800a7b40
mov qword [0x18010b1a8], rax
test rax, rax
je 0x18001f9d1
lea rdx, [0x18001d4d0]
lea rcx, [0x18010b1a8]
call fcn.1800a6320
mov ecx, dword [0x18010b1a4]
test eax, eax
cmove ecx, edi
mov dword [0x18010b1a4], ecx
cmp dword [0x18010b1a0], esi
jne 0x18001fa6b
mov dword [0x18010b1a0], esi
lea rdx, str.MoveFileWithProgressW
lea rcx, str.kernelbase.dll
call fcn.1800a7b40
mov qword [0x18010b198], rax
test rax, rax
je 0x18001fa21
lea rdx, [0x18001d580]
lea rcx, [0x18010b198]
call fcn.1800a6320
test eax, eax
jne 0x18001fa21
mov dword [0x18010b1a0], edi
jmp 0x18001fa6b
cmp dword [0x18010b1a0], esi
jne 0x18001fa6b
mov dword [0x18010b1a0], esi
lea rdx, str.MoveFileWithProgressW
lea rcx, [0x1800cee20]
call fcn.1800a7b40
mov qword [0x18010b198], rax
test rax, rax
je 0x18001fa6b
lea rdx, [0x18001d580]
lea rcx, [0x18010b198]
call fcn.1800a6320
test eax, eax
jne 0x18001fa6b
mov dword [0x18010b1a0], edi
call fcn.180024c40
call fcn.1800437b0
jmp 0x18001fc08
lea rdx, [0x180108f60]
lea rcx, str.EnterprisePortal.exe
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x18001fb5b
xor r8d, r8d
lea rdx, [0x18007920c]
mov ecx, edi
call fcn.180084df0
mov dword [0x18010b170], edi
cmp dword [0x18010b1bc], esi
jne 0x18001fc08
mov dword [0x18010b1bc], esi
lea rdx, [0x1800d0490]
lea rcx, str.kernelbase.dll
call fcn.1800a7b40
mov qword [0x18010b1c0], rax
test rax, rax
je 0x18001fb00
lea rdx, [0x18001d690]
lea rcx, [0x18010b1c0]
call fcn.1800a6320
test eax, eax
jne 0x18001fb00
mov dword [0x18010b1bc], edi
jmp 0x18001fc08
cmp dword [0x18010b1bc], esi
jne 0x18001fc08
mov dword [0x18010b1bc], esi
lea rdx, [0x1800d0490]
lea rcx, [0x1800cee20]
call fcn.1800a7b40
mov qword [0x18010b1c0], rax
test rax, rax
je 0x18001fc08
lea rdx, [0x18001d690]
lea rcx, [0x18010b1c0]
call fcn.1800a6320
test eax, eax
jne 0x18001fc08
mov dword [0x18010b1bc], edi
jmp 0x18001fc08
cmp dword [0x180109168], esi
je 0x18001fc08
cmp dword [0x18010b18c], esi
jne 0x18001fc08
mov dword [0x18010b18c], esi
lea rdx, str.CopyFileExW
lea rcx, str.kernelbase.dll
call fcn.1800a7b40
mov qword [0x18010b190], rax
test rax, rax
je 0x18001fbb7
lea rdx, [0x18001d200]
lea rcx, [0x18010b190]
call fcn.1800a6320
test eax, eax
jne 0x18001fbb7
mov dword [0x18010b18c], edi
jmp 0x18001fc08
cmp dword [0x18010b18c], esi
jne 0x18001fc08
mov dword [0x18010b18c], esi
lea rdx, str.CopyFileExW
lea rcx, [0x1800cee20]
call fcn.1800a7b40
mov qword [0x18010b190], rax
test rax, rax
je 0x18001fc08
lea rdx, [0x18001d200]
lea rcx, [0x18010b190]
call fcn.1800a6320
mov ecx, dword [0x18010b18c]
test eax, eax
cmove ecx, edi
mov dword [0x18010b18c], ecx
mov dword [rsp + 0x80], 4
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x88]
lea r8, str.CryptEnabled
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x18001fd33
cmp dword [rsp + 0x88], 4
jne 0x18001fd33
cmp dword [rsp + 0x90], esi
je 0x18001fd33
cmp dword [0x180108d44], esi
je 0x18001fd33
cmp dword [0x180103864], 0xa
jb 0x18001fd33
or dword [0x18010b17c], edi
cmp dword [0x18010b188], esi
jne 0x18001fd33
mov dword [0x18010b188], esi
lea rdx, [0x1800d0288]
lea rcx, str.kernelbase.dll
call fcn.1800a7b40
mov qword [0x18010b180], rax
test rax, rax
je 0x18001fce2
lea rdx, [0x18001cb70]
lea rcx, [0x18010b180]
call fcn.1800a6320
test eax, eax
jne 0x18001fce2
mov dword [0x18010b188], edi
jmp 0x18001fd33
cmp dword [0x18010b188], esi
jne 0x18001fd33
mov dword [0x18010b188], esi
lea rdx, [0x1800d0288]
lea rcx, [0x1800cee20]
call fcn.1800a7b40
mov qword [0x18010b180], rax
test rax, rax
je 0x18001fd33
lea rdx, [0x18001cb70]
lea rcx, [0x18010b180]
call fcn.1800a6320
mov ecx, dword [0x18010b188]
test eax, eax
cmove ecx, edi
mov dword [0x18010b188], ecx
lea rcx, [0x180108f60]
call fcn.18004c040
test eax, eax
je 0x18001fed5
lea r8, [0x180108f60]
lea rdx, str.ScrnCapProc:_s__HK_CreateFileW_CloseHandle
lea rcx, str.athenwDbg
call fcn.18005c640
lea rcx, [0x180108850]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x18010b178], edi
lea rcx, [0x18010ca50]
call fcn.1800208b0
lea rcx, [0x18010ca90]
call fcn.180020d70
or dword [0x18010b17c], 4
cmp dword [0x18010b188], esi
jne 0x18001fe34
mov dword [0x18010b188], esi
lea rdx, [0x1800d0288]
lea rcx, str.kernelbase.dll
call fcn.1800a7b40
mov qword [0x18010b180], rax
test rax, rax
je 0x18001fde3
lea rdx, [0x18001cb70]
lea rcx, [0x18010b180]
call fcn.1800a6320
test eax, eax
jne 0x18001fde3
mov dword [0x18010b188], edi
jmp 0x18001fe34
cmp dword [0x18010b188], esi
jne 0x18001fe34
mov dword [0x18010b188], esi
lea rdx, [0x1800d0288]
lea rcx, [0x1800cee20]
call fcn.1800a7b40
mov qword [0x18010b180], rax
test rax, rax
je 0x18001fe34
lea rdx, [0x18001cb70]
lea rcx, [0x18010b180]
call fcn.1800a6320
mov edx, dword [0x18010b188]
test eax, eax
cmove edx, edi
mov dword [0x18010b188], edx
cmp dword [0x18010b1e8], esi
jne 0x18001fed5
mov dword [0x18010b1e8], esi
lea rdx, [0x1800d0548]
lea rcx, str.kernelbase.dll
call fcn.1800a7b40
mov qword [0x18010b1e0], rax
test rax, rax
je 0x18001fe84
lea rdx, [0x18001d870]
lea rcx, [0x18010b1e0]
call fcn.1800a6320
test eax, eax
jne 0x18001fe84
mov dword [0x18010b1e8], edi
jmp 0x18001fed5
cmp dword [0x18010b1e8], esi
jne 0x18001fed5
mov dword [0x18010b1e8], esi
lea rdx, [0x1800d0548]
lea rcx, [0x1800cee20]
call fcn.1800a7b40
mov qword [0x18010b1e0], rax
test rax, rax
je 0x18001fed5
lea rdx, [0x18001d870]
lea rcx, [0x18010b1e0]
call fcn.1800a6320
mov ecx, dword [0x18010b1e8]
test eax, eax
cmove ecx, edi
mov dword [0x18010b1e8], ecx
cmp dword [0x180108d44], esi
jne 0x18001fee5
test ebx, ebx
je 0x18001ff83
cmp dword [0x180108d3c], esi
jne 0x18001ff83
mov dword [0x18010bc58], esi
cmp byte [0x18010699b], sil
je 0x18001ff05
call fcn.18007cd9c
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x18004e640]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x18010b7e0], rax
cmp dword [0x180103864], 6
ja 0x18001ff83
cmp dword [0x18010b5bc], esi
jne 0x18001ff83
mov dword [0x18010b5bc], esi
lea rdx, str.SHCreateStreamOnFileEx
lea rcx, str.shlwapi.dll
call fcn.1800a7b40
mov qword [0x18010b5c8], rax
test rax, rax
je 0x18001ff83
lea rdx, [0x18004e720]
lea rcx, [0x18010b5c8]
call fcn.1800a6320
mov ecx, dword [0x18010b5bc]
test eax, eax
cmove ecx, edi
mov dword [0x18010b5bc], ecx
lea rcx, [0x1801088a0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r9, str.foAllExts
lea r8, str.SoftwareWOW6432Nodeprojonepodlp_smpcache_
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x38]
call fcn.180053c64
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [0x180103a10]
call fcn.18000db80
nop
cmp qword [rsp + 0x58], 8
jb 0x18001ffd9
mov rcx, qword [rsp + 0x40]
call fcn.18009a864
call fcn.18003b060
call fcn.1800a5a50
mov r11, qword [0x18010d230]
cmp dword [0x18010b188], 0
cmovne r11, qword [0x18010b180]
mov qword [0x18010d230], r11
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret