Function at 0x1800317b0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x180248b00]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov r14, rdx
mov qword [rbp - 0x58], rdx
mov qword [rbp - 0x60], rcx
mov qword [rsp + 0x60], rcx
mov qword [rbp - 0x30], rdx
xor r13d, r13d
mov edi, r13d
mov dword [rsp + 0x30], r13d
mov ecx, dword [0x1802a8774]
mov rax, qword gs:[0x58]
mov edx, 4
mov rbx, qword [rax + rcx*8]
add rbx, rdx
lea rsi, [0x1802a8ad8]
mov eax, dword [rbx]
cmp dword [0x1802a8a90], eax
jle 0x180031935
lea rcx, [0x1802a8a90]
call fcn.18017ad2c
cmp dword [0x1802a8a90], 0xffffffff
jne 0x180031935
mov eax, dword [rbx]
cmp dword [0x1802a8af8], eax
jle 0x1800318d9
lea rcx, [0x1802a8af8]
call fcn.18017ad2c
cmp dword [0x1802a8af8], 0xffffffff
jne 0x1800318d9
lea rax, str.workspace
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 9
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x80]
call fcn.1800276f0
mov edi, 0x100000
lea rcx, [rsp + 0x38]
call fcn.18002fba0
nop
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [0x1802a8ab8]
call fcn.18001d9e0
nop
lea rcx, [rsp + 0x38]
call fcn.180022e90
nop
lea rcx, [rbp - 0x80]
call fcn.180022e90
lea rcx, [0x180182150]
call fcn.18017ab08
nop
lea rcx, [0x1802a8af8]
call fcn.18017acc0
lea rcx, [0x1802a8ab8]
cmp qword [0x1802a8ad0], 7
cmova rcx, qword [0x1802a8ab8]
call fcn.180179d30
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x180031e24
lea rdx, [0x1802a8ab8]
mov rcx, rsi
call fcn.18001dac0
bts edi, 0x13
mov dword [rsp + 0x30], edi
lea rcx, [0x180182160]
call fcn.18017ab08
nop
lea rcx, [0x1802a8a90]
call fcn.18017acc0
nop
mov rdx, rsi
lea rcx, [rbp - 0x80]
call fcn.18001dac0
bts edi, 0x11
mov dword [rsp + 0x30], edi
mov rdx, r14
lea rcx, [rbp - 0x80]
call fcn.18001d160
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x28]
call fcn.18001f8f0
nop
btr edi, 0x11
lea rcx, [rbp - 0x80]
call fcn.180022e90
mov byte [rsp + 0x58], 0
lea rsi, str..exe
mov qword [rbp], rsi
lea rax, str..scr
mov qword [rbp + 8], rax
lea rax, str..bat
mov qword [rbp + 0x10], rax
lea rax, str..com
mov qword [rbp + 0x18], rax
lea rax, str..csh
mov qword [rbp + 0x20], rax
lea rax, str..msi
mov qword [rbp + 0x28], rax
lea rax, [0x1801d1c20]
mov qword [rbp + 0x30], rax
lea rax, str..vbs
mov qword [rbp + 0x38], rax
lea rax, str..vbe
mov qword [rbp + 0x40], rax
lea rax, [0x1801d1c34]
mov qword [rbp + 0x48], rax
lea rax, str..wsf
mov qword [rbp + 0x50], rax
lea rax, str..wsh
mov qword [rbp + 0x58], rax
lea rax, str..ps1
mov qword [rbp + 0x60], rax
lea rax, [0x1801d1c50]
mov qword [rbp + 0x68], rax
lea r13, [rbp]
nop dword [rax]
nop word [rax + rax]
lea r15, [rbp - 0x28]
cmp qword [rbp - 0x10], 7
cmova r15, qword [rbp - 0x28]
mov r14, qword [rbp - 0x18]
call fcn.18017982c
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xor eax, eax
mov edx, eax
mov qword [rsp + 0x48], rax
mov ecx, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x50], rcx
mov byte [rsp + 0x38], al
bts edi, 8
mov dword [rsp + 0x30], edi
test r14, r14
je 0x180031aee
cmp r14, 0x7fffffff
ja 0x180031e50
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8d, r14d
mov rdx, r15
mov ecx, r12d
call fcn.18017989c
mov rbx, rax
mov qword [rsp + 0x60], rax
shr rax, 0x20
test eax, eax
jne 0x180031e46
movsxd rdx, ebx
xor r8d, r8d
lea rcx, [rsp + 0x38]
call fcn.180022f00
lea r9, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova r9, qword [rsp + 0x38]
mov dword [rsp + 0x20], ebx
mov r8d, r14d
mov rdx, r15
mov ecx, r12d
call fcn.18017989c
mov qword [rsp + 0x60], rax
shr rax, 0x20
test eax, eax
jne 0x180031e3c
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
btr edi, 8
or edi, 0xe0
lea r8, [rsp + 0x38]
cmp rcx, 0xf
cmova r8, qword [rsp + 0x38]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rsi + rax], 0
jne 0x180031b10
mov qword [rsp + 0x20], rax
mov r9, rsi
mov rcx, r8
call fcn.180014fd0
mov rbx, rax
lea rcx, [rsp + 0x38]
call fcn.180006890
mov r12d, dword [rsp + 0x58]
movzx r12d, r12b
cmp rbx, 0xffffffffffffffff
mov eax, 1
cmovne r12d, eax
mov dword [rsp + 0x58], r12d
add r13, 8
lea rax, [rbp + 0x70]
cmp r13, rax
je 0x180031b67
mov rsi, qword [r13]
jmp 0x180031a20
lea r14, [rbp - 0x28]
cmp qword [rbp - 0x10], 7
cmova r14, qword [rbp - 0x28]
mov rsi, qword [rbp - 0x18]
call fcn.18017982c
mov r15d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x18021d0f0]
movdqu xmmword [rsp + 0x70], xmm1
mov byte [rsp + 0x60], 0
bts edi, 0xc
mov dword [rsp + 0x30], edi
test rsi, rsi
je 0x180031c21
cmp rsi, 0x7fffffff
ja 0x180031e5b
xor r13d, r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, esi
mov rdx, r14
mov ecx, eax
call fcn.18017989c
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x180031e66
movsxd rdx, ebx
xor r8d, r8d
lea rcx, [rsp + 0x60]
call fcn.180022f00
lea r9, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova r9, qword [rsp + 0x60]
mov dword [rsp + 0x20], ebx
mov r8d, esi
mov rdx, r14
mov ecx, r15d
call fcn.18017989c
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x180031e1a
jmp 0x180031c24
xor r13d, r13d
btr edi, 0xc
or edi, 0xe00
or edi, 1
cmp qword [0x1802a8af0], 7
lea r15, [0x1802a8ad8]
cmova r15, qword [0x1802a8ad8]
mov rsi, qword [0x1802a8ae8]
call fcn.18017982c
mov r14d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x18021d0f0]
movdqu xmmword [rsp + 0x48], xmm1
mov byte [rsp + 0x38], 0
bts edi, 0x10
mov dword [rsp + 0x30], edi
test rsi, rsi
je 0x180031cf2
cmp rsi, 0x7fffffff
ja 0x180031e72
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, esi
mov rdx, r15
mov ecx, eax
call fcn.18017989c
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x180031e7d
movsxd rdx, ebx
xor r8d, r8d
lea rcx, [rsp + 0x38]
call fcn.180022f00
lea r9, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova r9, qword [rsp + 0x38]
mov dword [rsp + 0x20], ebx
mov r8d, esi
mov rdx, r15
mov ecx, r14d
call fcn.18017989c
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x180031e10
btr edi, 0x10
or edi, 0xe000
or edi, 2
mov dword [rsp + 0x30], edi
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x48]
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rcx, qword [rsp + 0x60]
cmp qword [rsp + 0x70], r8
jb 0x180031d52
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x180031d52
test r12b, r12b
jne 0x180031d52
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x50]
call fcn.18001dac0
nop
or edi, 4
jmp 0x180031d72
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x18021d0e0]
movdqu xmmword [rbp - 0x70], xmm1
mov word [rbp - 0x80], r13w
lea rax, [rbp - 0x80]
or edi, 8
mov dword [rsp + 0x30], edi
mov rdx, rax
mov rbx, qword [rbp - 0x60]
mov rcx, rbx
call fcn.18001dac0
or edi, 0x10
test dil, 8
je 0x180031d9b
and edi, 0xfffffff7
lea rcx, [rbp - 0x80]
call fcn.180022e90
nop
test dil, 4
je 0x180031dae
and edi, 0xfffffffb
lea rcx, [rbp - 0x50]
call fcn.180022e90
nop
test dil, 2
je 0x180031dc2
and edi, 0xfffffffd
lea rcx, [rsp + 0x38]
call fcn.180006890
nop
test dil, 1
je 0x180031dd3
lea rcx, [rsp + 0x60]
call fcn.180006890
nop
lea rcx, [rbp - 0x28]
call fcn.180022e90
nop
mov rcx, qword [rbp - 0x58]
call fcn.180022e90
mov rax, rbx
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.18017a790
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x180
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
shr rcx, 0x20
call fcn.18001b590
nop
shr rcx, 0x20
call fcn.18001b590
nop
shr rdx, 0x20
lea r8, [0x1802a8ab8]
lea rcx, str.create_directory
call fcn.18001e120
nop
mov ecx, dword [rsp + 0x64]
call fcn.18001b590
int3
mov ecx, dword [rsp + 0x64]
call fcn.18001b590
int3
mov ecx, socket
call fcn.18001b2b0
nop
mov ecx, socket
call fcn.18001b2b0
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.18001b590
nop
mov ecx, socket
call fcn.18001b2b0
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.18001b590
int3