Function at 0x18001eb00
Capabilities:
Create thread
Read .ini file

Disassembly:
push rdi
mov eax, 0x34ca0
call fcn.18004c5b0
sub rsp, rax
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x34cb0], rbx
mov qword [rsp + 0x34cb8], rbp
mov qword [rsp + 0x34cc0], rsi
mov rax, qword [0x180067480]
xor rax, rsp
mov qword [rsp + 0x34c90], rax
xor ebp, ebp
mov dword [0x18011c224], ebp
lea rcx, str.vrvprt_c:STRAT_POLICY_n
call fcn.18000ac40
cmp dword [0x180066074], ebp
je 0x18001eeb1
mov dword [0x180066074], ebp
xor edx, edx
mov r8d, 0x104
lea rcx, [0x1800d9b70]
call fcn.180031f80
mov r8d, 0x208
lea rdx, [rsp + 0x2bf40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.18000f610
test eax, eax
jne 0x18001ebac
lea rcx, str.VRVPRT_C.DLL:
call fcn.18000ac40
jmp 0x18001f2f8
cmp eax, 3
je 0x18001eeb1
lea rcx, [0x180054b40]
call fcn.18000ac40
mov byte [rsp + 0x2be30], bpl
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x2be31]
call fcn.180031f80
cmp qword [0x1801488e0], rbp
je 0x18001edc1
mov byte [rsp + 0x2c4d0], bpl
xor edx, edx
mov r8d, 0x63f
lea rcx, [rsp + 0x2c4d1]
call fcn.180031f80
mov byte [rsp + 0x2bd00], bpl
xor edx, edx
mov r8d, 0x12b
lea rcx, [rsp + 0x2bd01]
call fcn.180031f80
xor edx, edx
mov r8d, 0x5dc
lea rcx, [rsp + 0x684]
call fcn.180031f80
mov r8d, 1
lea rdx, str.protect.ini
lea rcx, [rsp + 0x38]
call fcn.18000ab00
cmp qword [rax + 0x20], 0x10
jb 0x18001ec5e
mov r8, qword [rax + 8]
jmp 0x18001ec62
lea r8, [rax + 8]
lea rdx, [0x180051d44]
lea rcx, [rsp + 0x2be30]
call fcn.1800335dc
cmp qword [rsp + 0x58], 0x10
jb 0x18001ec88
mov rcx, qword [rsp + 0x40]
call fcn.180021240
lea rax, [rsp + 0x2be30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x640
lea r9, [rsp + 0x2c4d0]
lea r8, [0x180051c58]
lea rdx, str.name
lea rcx, str.unhookprocess
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x2c4d0]
call fcn.180033c94
mov ebx, ebp
lea rsi, [rsp + 0x2c4d0]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2c4d0]
repne scasb al, byte [rdi]
not rcx
lea rax, [rsp + 0x2c4d0]
cmp byte [rcx + rax - 2], 0x3b
je 0x18001ed20
lea rdi, [rsp + 0x2c4d0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x180051e68]
mov word [rdi - 1], ax
nop word [rax + rax]
xor edx, edx
mov r8d, 0x12c
lea rcx, [rsp + 0x2bd00]
call fcn.180031f80
mov edx, 0x3b
mov rcx, rsi
call fcn.180032dd0
mov rdi, rax
test rax, rax
je 0x18001ed97
mov r8, rax
sub r8, rsi
mov rdx, rsi
lea rcx, [rsp + 0x2bd00]
call fcn.180034120
lea rdx, [rsp + 0x2bd00]
movsxd rcx, ebx
imul rcx, rcx, 0x32
lea rax, [rsp + 0x2bd00]
sub rcx, rax
lea rcx, [rsp + rcx + 0x684]
movzx eax, byte [rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x18001ed82
inc ebx
lea rsi, [rdi + 1]
jmp 0x18001ed20
mov dword [rsp + 0x680], ebx
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x680]
mov r8d, 0x5e0
call fcn.1800336d0
lea rcx, [rsp + 0x70]
call qword [0x1801488e0]
mov rax, qword [0x1801488e8]
test rax, rax
je 0x18001eeac
mov dword [rsp + 0x30], ebp
lea rdx, [rsp + 0x30]
lea rcx, [0x180069170]
call rax
cmp dword [rsp + 0x30], 0x66768
je 0x18001eea7
mov edx, 2
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x2bd00]
call fcn.18001e7d0
nop
lea rdx, str.VRVPTR:_PTRShareMemory_Size_not_Same__n
lea rcx, [rsp + 0x2bd00]
call fcn.18001e8b0
lea rdx, str.PRTHOOK.DLL_AllVrvPrtShareMem_Size_
lea rcx, [rsp + 0x2bd00]
call fcn.18001e8b0
mov rcx, rax
mov edx, dword [rsp + 0x30]
call fcn.18001e410
mov rcx, rax
lea rdx, str.VRVPRT_C.DLL_Size
call fcn.18001e8b0
mov rcx, rax
mov edx, 0x66768
call fcn.18001e5f0
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x2bd00]
call fcn.18000a0c0
nop
cmp qword [rax + 0x20], 0x10
jb 0x18001ee78
mov rcx, qword [rax + 8]
jmp 0x18001ee7c
lea rcx, [rax + 8]
call fcn.18000ac40
nop
cmp qword [rsp + 0x58], 0x10
jb 0x18001ee95
mov rcx, qword [rsp + 0x40]
call fcn.180021240
nop
lea rcx, [rsp + 0x2bd00]
call fcn.180006730
jmp 0x18001f2f8
call fcn.18000ec80
call fcn.18000b430
lea rdi, [0x180113ea4]
cmp qword [0x180148938], rbp
jne 0x18001eee5
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
xor r9d, r9d
lea r8, [0x18000fb30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x180148938], rax
cmp qword [0x180148940], rbp
jne 0x18001ef12
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
xor r9d, r9d
lea r8, [0x18000c030]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x180148940], rax
cmp dword [0x180113fb0], ebp
je 0x18001ef3e
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
xor r9d, r9d
lea r8, [0x180002bf0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x180148948], rax
mov rax, qword [0x1800d9b60]
test rax, rax
je 0x18001ef6a
lea rdi, [rsp + 0x2c4d0]
lea rsi, [0x18010bc90]
mov ecx, 0x1b6c
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x2c4d0]
call rax
cmp qword [0x1800d9b58], rbp
je 0x18001efa3
lea rcx, [0x180054a78]
call fcn.18000ac40
lea rdi, [rsp + 0x2c4d0]
lea rsi, [0x180108cc0]
mov ecx, 0x2f7c
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x2c4d0]
call qword [0x1800d9b58]
cmp qword [0x1800d9b50], rbp
je 0x18001efdc
lea rcx, [0x180054a40]
call fcn.18000ac40
lea rdi, [rsp + 0x2c4d0]
lea rsi, [0x1801004b0]
mov ecx, 0x87b8
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x2c4d0]
call qword [0x1800d9b50]
mov rdi, qword [0x1800d9b48]
test rdi, rdi
je 0x18001f00c
lea rcx, [rsp + 0x2bf40]
lea rdx, [0x1800fff50]
mov r8d, 0x404
call fcn.1800336d0
lea rcx, [rsp + 0x2bf40]
call rdi
mov rdi, qword [0x1800d9b40]
test rdi, rdi
je 0x18001f03c
lea rcx, [rsp + 0x2c4d0]
lea rdx, [0x1800ff510]
mov r8d, 0x9f0
call fcn.1800336d0
lea rcx, [rsp + 0x2c4d0]
call rdi
mov rax, qword [0x1800d9b38]
test rax, rax
je 0x18001f068
lea rdi, [rsp + 0x2c4d0]
lea rsi, [0x1800fcb20]
mov ecx, 0x2958
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x2c4d0]
call rax
mov rax, qword [0x1800d9b28]
test rax, rax
je 0x18001f094
lea rdi, [rsp + 0xc60]
lea rsi, [0x1800dd0d0]
mov ecx, 0x1c174
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0xc60]
call rax
mov rax, qword [0x1800d9b30]
test rax, rax
je 0x18001f0c0
lea rdi, [rsp + 0x2c4d0]
lea rsi, [0x1800f9250]
mov ecx, 0x38c8
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x2c4d0]
call rax
mov rax, qword [0x18011a348]
test rax, rax
je 0x18001f0ec
lea rdi, [rsp + 0x2c4d0]
lea rsi, [0x180113eb0]
mov ecx, 0x5cec
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x2c4d0]
call rax
mov rdi, qword [0x18011a458]
test rdi, rdi
je 0x18001f11c
lea rcx, [rsp + 0x2be30]
lea rdx, [0x1800dcf70]
mov r8d, 0x10c
call fcn.1800336d0
lea rcx, [rsp + 0x2be30]
call rdi
mov rdi, qword [0x18011a5a8]
test rdi, rdi
je 0x18001f146
lea rcx, [rsp + 0x70]
lea rdx, [0x1800dc810]
mov r8d, 0x610
call fcn.1800336d0
lea rcx, [rsp + 0x70]
call rdi
mov rdi, qword [0x18011bc48]
test rdi, rdi
je 0x18001f176
lea rcx, [rsp + 0x2c4d0]
lea rdx, [0x1800dbaa0]
mov r8d, 0xc20
call fcn.1800336d0
lea rcx, [rsp + 0x2c4d0]
call rdi
mov rdi, qword [0x18011bc98]
test rdi, rdi
je 0x18001f1a6
lea rcx, [rsp + 0x2bf40]
lea rdx, [0x180119cf0]
mov r8d, 0x508
call fcn.1800336d0
lea rcx, [rsp + 0x2bf40]
call rdi
mov rdi, qword [0x18011c228]
test rdi, rdi
je 0x18001f1d6
lea rcx, [rsp + 0x2be30]
lea rdx, [0x18011a350]
mov r8d, pe_nt_image_headers64
call fcn.1800336d0
lea rcx, [rsp + 0x2be30]
call rdi
mov rax, qword [0x18011c278]
test rax, rax
je 0x18001f202
lea rdi, [rsp + 0x2c4d0]
lea rsi, [0x18011a5b0]
mov ecx, 0x1698
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x2c4d0]
call rax
mov rdi, qword [0x18011d7d8]
test rdi, rdi
je 0x18001f232
lea rcx, [rsp + 0x2bf40]
lea rdx, [0x18011bca0]
mov r8d, 0x584
call fcn.1800336d0
lea rcx, [rsp + 0x2bf40]
call rdi
mov rax, qword [0x180148878]
test rax, rax
je 0x18001f25e
lea rdi, [rsp + 0x2c4d0]
lea rsi, [0x18011c280]
mov ecx, 0x150c
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x2c4d0]
call rax
mov rax, qword [0x1801488c8]
test rax, rax
je 0x18001f28a
lea rdi, [rsp + 0xc60]
lea rsi, [0x18011d7e0]
mov ecx, 0x2b094
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0xc60]
call rax
cmp qword [0x180148920], rbp
je 0x18001f2ec
mov rax, qword [0x1801488e8]
test rax, rax
je 0x18001f2ec
mov dword [rsp + 0x30], ebp
lea rdx, [rsp + 0x30]
lea rcx, [0x180069170]
call rax
mov r8d, 0x66768
lea rdx, [0x180069170]
mov rcx, qword [0x180148920]
call fcn.1800336d0
cmp qword [0x180148928], rbp
je 0x18001f2ec
lea rcx, str.VRVPRT:
call fcn.18000ac40
mov rcx, qword [0x180148928]
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea rcx, str.VRVPRT_C.DLL:StartPolicy_out
call fcn.18000ac40
mov rcx, qword [rsp + 0x34c90]
xor rcx, rsp
call fcn.180031f50
lea r11, [rsp + 0x34ca0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret