Function at 0x1800033f0
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
call fcn.18000b3f0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.18000bdb0
call fcn.1800077a0
test eax, eax
jne 0x1800035ae
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x18000344d
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x18000344d
lea rcx, [0x18003c9e8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, [0x18003c9e8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180054398], rax
test rax, rax
je 0x18000347c
lea rdx, [0x180003b50]
lea rcx, [0x180054398]
call fcn.18000a7d0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x1800034b3
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x1800034b3
lea rcx, [0x18003ca08]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, [0x18003ca08]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800543a0], rax
test rax, rax
je 0x1800034e2
lea rdx, [0x180003a20]
lea rcx, [0x1800543a0]
call fcn.18000a7d0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x180003519
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180003519
lea rcx, str.CreateProcessAsUserW
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, str.CreateProcessAsUserW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800543b0], rax
test rax, rax
je 0x180003548
lea rdx, [0x180003af0]
lea rcx, [0x1800543b0]
call fcn.18000a7d0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x18000357f
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x18000357f
lea rcx, str.CreateProcessAsUserA
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, str.CreateProcessAsUserA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800543a8], rax
test rax, rax
je 0x1800035ae
lea rdx, [0x180003a90]
lea rcx, [0x1800543a8]
call fcn.18000a7d0
lea rcx, str.User32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x1800035e5
lea rcx, str.User32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x1800035e5
lea rcx, str.SetWindowsHookExW
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, str.SetWindowsHookExW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180054358], rax
test rax, rax
je 0x180003614
lea rdx, [0x180003df0]
lea rcx, [0x180054358]
call fcn.18000a7d0
lea rcx, str.User32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x18000364b
lea rcx, str.User32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x18000364b
lea rcx, str.SetWindowsHookExA
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, str.SetWindowsHookExA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180054350], rax
test rax, rax
je 0x18000367a
lea rdx, [0x180003d30]
lea rcx, [0x180054350]
call fcn.18000a7d0
lea rcx, str.User32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x1800036b1
lea rcx, str.User32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x1800036b1
lea rcx, str.SetWindowDisplayAffinity
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, str.SetWindowDisplayAffinity
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180054360], rax
test rax, rax
je 0x1800036e0
lea rdx, [0x180003cd0]
lea rcx, [0x180054360]
call fcn.18000a7d0
lea rcx, str.User32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x180003717
lea rcx, str.User32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180003717
lea rcx, str.GetWindowDisplayAffinity
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, str.GetWindowDisplayAffinity
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180054368], rax
test rax, rax
je 0x180003746
lea rdx, [0x180003bc0]
lea rcx, [0x180054368]
call fcn.18000a7d0
lea rcx, str.OleAut32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x18000377d
lea rcx, str.OleAut32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x18000377d
lea rcx, str.SysAllocString
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, str.SysAllocString
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180054380], rax
test rax, rax
je 0x1800037ac
lea rdx, [0x180003ee0]
lea rcx, [0x180054380]
call fcn.18000a7d0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x1800037e3
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x1800037e3
lea rcx, str.NtQuerySystemInformation
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, str.NtQuerySystemInformation
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180054348], rax
test rax, rax
je 0x180003812
lea rdx, [0x180003bd0]
lea rcx, [0x180054348]
call fcn.18000a7d0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x180003849
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180003849
lea rcx, str.Process32Next
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, str.Process32Next
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180054338], rax
test rax, rax
je 0x180003878
lea rdx, [0x180004040]
lea rcx, [0x180054338]
call fcn.18000a7d0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x1800038af
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x1800038af
lea rcx, str.Process32NextW
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, str.Process32NextW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180054340], rax
test rax, rax
je 0x1800038de
lea rdx, [0x180004190]
lea rcx, [0x180054340]
call fcn.18000a7d0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x180003915
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180003915
lea rcx, str.QueryFullProcessImageNameA
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, str.QueryFullProcessImageNameA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180054378], rax
test rax, rax
je 0x180003944
lea rdx, [0x180004260]
lea rcx, [0x180054378]
call fcn.18000a7d0
lea rcx, str.User32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x18000397b
lea rcx, str.User32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x18000397b
lea rcx, str.CreateDesktopW
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, str.CreateDesktopW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180054388], rax
test rax, rax
je 0x1800039aa
lea rdx, [0x1800039c0]
lea rcx, [0x180054388]
call fcn.18000a7d0
add rsp, 0x20
pop rbx
jmp 0x18000b460
sub rsp, 0x28
xor ecx, ecx
call fcn.18000b470
add rsp, 0x28
ret