Function at 0x180004300
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x70
mov rax, qword [0x18007bbd0]
lea rcx, str.kernel32.dll
mov byte [rax + 0x26dd6e9], 1
mov rax, qword [0x18007bbd0]
mov byte [rax + 0x26dd6e0], 0
mov rax, qword [0x18007bbd0]
mov byte [rax + 0x26dd6e1], 0
mov rax, qword [0x18007bbd0]
mov byte [rax + 0x26984f1], 0
mov rax, qword [0x18007bbd0]
mov byte [rax + 0x26dd6e8], 0
mov rax, qword [0x18007bbd0]
mov byte [rax + 0x26dd6ea], 0
mov rax, qword [0x18007bbd0]
mov byte [rax + 0x26dd6eb], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800043b9
lea rdx, str.LoadLibraryW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800043b9
lea r8, [0x18007bbe8]
mov rcx, rax
lea rdx, [0x180003c30]
call fcn.1800488d4
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800043f6
lea rdx, str.Process32NextW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800043f6
lea r8, [0x18007bbe0]
mov rcx, rax
lea rdx, [0x1800041c0]
call fcn.1800488d4
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180004433
lea rdx, str.Process32FirstW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180004433
lea r8, [0x18007bc00]
mov rcx, rax
lea rdx, [0x180004130]
call fcn.1800488d4
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180004470
lea rdx, str.Module32FirstW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180004470
lea r8, [0x18007bbd8]
mov rcx, rax
lea rdx, [0x180003fa0]
call fcn.1800488d4
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800044ad
lea rdx, str.Module32NextW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800044ad
lea r8, [0x18007bc10]
mov rcx, rax
lea rdx, [0x180004030]
call fcn.1800488d4
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800044e6
lea rdx, str.GetUserNameW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800044e6
xor r8d, r8d
lea rdx, [0x180003e50]
mov rcx, rax
call fcn.1800488d4
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180004523
lea rdx, str.SetTimer
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180004523
lea r8, [0x18007bc08]
mov rcx, rax
lea rdx, [0x180003bf0]
call fcn.1800488d4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
mov qword [rsp + 0x30], rax
movups xmmword [rsp + 0x20], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x18
lea r8, [rsp + 0x20]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov rsi, qword [rsp + 0x20]
lea r14, [0x180000000]
mov ecx, dword [rsp + 0x28]
xor ebp, ebp
lea r10, [rsi - 0x2e]
add r10, rcx
cmp rsi, r10
jae 0x1800045c2
mov r9, rsi
neg r9
nop
lea rdx, [r14 + 0x4e080]
mov rcx, rsi
add rdx, r9
lea r8, [r14 + 0x4e0b0]
add r8, r9
cmp byte [rdx + rcx], 0x3f
je 0x1800045a6
movzx eax, byte [r8 + rcx]
cmp byte [rcx], al
jne 0x1800045b7
inc rcx
mov rax, rcx
sub rax, rsi
cmp rax, 0x2e
jb 0x180004597
jmp 0x1800045c5
inc rsi
dec r9
cmp rsi, r10
jb 0x180004580
mov rsi, rbp
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x18
lea r8, [rsp + 0x38]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov rdi, qword [rsp + 0x38]
mov eax, dword [rsp + 0x40]
lea r10, [rdi - 0xc]
add r10, rax
cmp rdi, r10
jae 0x180004652
mov r9, rdi
neg r9
nop dword [rax]
lea rdx, [r14 + 0x4e0e0]
mov rcx, rdi
add rdx, r9
lea r8, [r14 + 0x4e0f0]
add r8, r9
cmp byte [rdx + rcx], 0x3f
je 0x180004636
movzx eax, byte [r8 + rcx]
cmp byte [rcx], al
jne 0x180004647
inc rcx
mov rax, rcx
sub rax, rdi
cmp rax, 0xc
jb 0x180004627
jmp 0x180004655
inc rdi
dec r9
cmp rdi, r10
jb 0x180004610
mov rdi, rbp
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x18
lea r8, [rsp + 0x50]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov rbx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x58]
lea r10, [rbx - 0x1e]
add r10, rax
cmp rbx, r10
jae 0x1800046e2
mov r9, rbx
neg r9
nop dword [rax]
lea rdx, [r14 + 0x4e100]
mov rax, rbx
add rdx, r9
lea r8, [r14 + 0x4e120]
add r8, r9
cmp byte [rdx + rax], 0x3f
je 0x1800046c6
movzx ecx, byte [r8 + rax]
cmp byte [rax], cl
jne 0x1800046d7
inc rax
mov rcx, rax
sub rcx, rbx
cmp rcx, 0x1e
jb 0x1800046b7
jmp 0x1800046e5
inc rbx
dec r9
cmp rbx, r10
jb 0x1800046a0
mov rbx, rbp
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Heartbeat:
call fcn.1800065a0
lea rdx, [0x180003100]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x180006770]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.First_sub:
call fcn.1800065a0
lea rdx, [0x180003100]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x180006770]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.HWID:
call fcn.1800065a0
lea rdx, [0x180003100]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x180006770]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor r8d, r8d
lea rdx, [0x180003bc0]
mov rcx, rsi
call fcn.1800488d4
xor r8d, r8d
lea rdx, [0x180003bc0]
mov rcx, rdi
call fcn.1800488d4
lea r8, [0x18007bbf8]
mov rcx, rbx
lea rdx, [0x1800042c0]
call fcn.1800488d4
xor eax, eax
mov rbx, rbp
mov edi, 1
lock cmpxchg dword [0x18007bcac], edi
je 0x180004811
cmp rbx, 0x20
jae 0x1800047fa
xor ecx, ecx
jmp 0x1800047fc
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x18007bcac], edi
jne 0x1800047f0
cmp qword [0x18007bcb0], rbp
je 0x180004821
call fcn.1800487f4
jmp 0x180004826
mov eax, 2
xchg dword [0x18007bcac], ebp
lea r11, [rsp + 0x70]
test eax, eax
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
sete al
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret