Function at 0x18001059c
Capabilities:
Allocate thread local storage
Check mutex on windows
Check os version
Create pipe
Get explorer pid
Get session user name

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xe0
xor r13d, r13d
mov r12, rcx
lea rcx, [0x180033f30]
lea r14d, [r13 + 1]
mov dword [rax + 0x10], r13d
mov ebp, r14d
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [0x1800339a8]
lea r11, [0x180033f20]
mov dword [0x180033f5c], r13d
mov ebx, 0xa8
mov qword [0x180033f28], r11
mov qword [0x180033f20], r11
mov r8, rbx
xor edx, edx
mov dword [0x180033f58], r13d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r13
mov qword [0x180033e40], rax
je 0x180010648
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
mov rcx, qword [0x180033e40]
add rcx, 0x70
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [0x180033e40]
lea r11, [0x1800373e8]
mov qword [rax], r11
mov edi, r13d
jmp 0x18001064d
mov edi, 8
cmp edi, r13d
jne 0x18001141d
mov r8, qword [0x180033b50]
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [0x180033b58], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x180033b58]
cmp rcx, r13
je 0x18001069d
cmp eax, 0xb7
jne 0x18001069a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x180033b58], r13
jmp 0x18001141a
mov eax, r13d
cmp eax, r13d
jne 0x18001141a
mov rcx, qword [0x1800339a8]
xor edx, edx
mov edi, r13d
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r13
mov qword [0x180033b80], rax
je 0x18001077d
lea rcx, [0x180033ee0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r11, [0x180033ed0]
lea rcx, [0x180033ea0]
mov qword [0x180033ed8], r11
mov qword [0x180033ed0], r11
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r11, [0x180033e80]
mov qword [0x180033e88], r11
mov qword [0x180033e80], r11
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae 0x18001072f
cmp qword [0x180033c40], r13
jne 0x18001072f
call fcn.180001950
mov qword [0x180033c40], rax
mov rbx, r13
mov dword [0x180033b78], r14d
mov esi, 3
lea r13, [0x180000000]
mov rcx, qword [rbx + r13 + 0x32718]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [0x180033b80]
mov qword [rbx + rcx], rax
add rbx, 8
sub rsi, r14
jne 0x180010745
mov dword [0x180033b7c], 3
xor r13d, r13d
mov dword [0x180033b74], r14d
jmp 0x180010782
mov edi, 8
cmp edi, r13d
jne 0x18001141d
mov ebx, dword [0x180033960]
mov rcx, qword [0x1800339a8]
mov edi, 0x3c6ef35f
xor edx, edx
imul ebx, ebx, 0x19660d
add ebx, edi
mov dword [0x180033960], ebx
shr ebx, 1
and ebx, 0xf
add ebx, 4
lea r8d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r13
mov r11, rax
mov qword [0x180033f08], rax
je 0x180010870
cmp ebx, r13d
mov r8d, r13d
jbe 0x180010846
mov r9d, dword [0x180033960]
mov rcx, rax
mov r8d, ebx
mov r10d, ebx
imul r9d, r9d, 0x19660d
mov eax, 0x51eb851f
add r9d, edi
mov dword [0x180033960], r9d
shr r9d, 1
mul r9d
shr edx, 3
imul edx, edx, 0x19
sub r9d, edx
add r9b, 0x41
mov byte [rcx], r9b
mov r9d, dword [0x180033960]
imul r9d, r9d, 0x19660d
add r9d, edi
test r9b, 2
mov dword [0x180033960], r9d
je 0x18001083e
add byte [rcx], 0x20
mov r9d, dword [0x180033960]
add rcx, r14
sub r10, r14
jne 0x1800107ea
mov eax, r8d
lea r9, [0x1800224bc]
lea rcx, [0x180033b00]
lea r8, [0x1800178b0]
mov edx, 0x7c
mov byte [rax + r11], r13b
call fcn.18001e664
mov edi, eax
jmp 0x180010875
mov edi, 8
cmp edi, r13d
jne 0x18001141d
lea rdx, [rsp + 0x128]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov r11d, dword [rsp + 0x128]
cmp r11d, r13d
je 0x1800108ca
mov rcx, qword [0x1800339a8]
mov r8, r11
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r13
mov qword [0x1800339f8], rax
je 0x1800108ca
lea rdx, [rsp + 0x128]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [0x180033afc]
mov dword [0x180033f10], r14d
cmp eax, 0x6a4b44c7
je 0x1800108e5
cmp eax, 0x4afa8999
jne 0x180010950
mov rcx, qword [0x180033b88]
lea rax, [rsp + 0xa0]
lea r8, [rsp + 0xa8]
mov r9d, 0x30
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_ZwQueryInformationProcess]
mov r8d, r13d
mov ecx, 0x400
cmp eax, r13d
cmovge r8d, dword [rsp + 0xd0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp rax, r13
jne 0x180010941
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x180010a58
jmp 0x18001094a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x180033afc]
cmp eax, 0x1795f247
jne 0x180010997
mov dword [rsp + 0x44], r13d
call qword [sym.imp.USER32.dll_GetShellWindow]
lea rdx, [rsp + 0x44]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r11d, dword [rsp + 0x44]
cmp r11d, r13d
je 0x18001098c
cmp r11d, dword [0x180033b90]
je 0x18001098c
mov dword [0x180033afc], r13d
jmp 0x180010997
test byte [0x18003212c], r14b
cmovne ebp, r13d
cmp r12, r13
je 0x1800109b1
lea rcx, [0x180033d38]
mov r8d, 0x18
mov rdx, r12
call sub.ntdll.dll_memcpy
lea rax, [0x180027510]
lea rcx, [0x18003691e]
mov qword [0x180033e48], r13
mov qword [0x180033e50], rax
mov edi, r13d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp rax, r13
mov qword [0x180033f60], rax
je 0x180010a35
lea rcx, [0x18003601d]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, r13d
lea rbx, [0x1800326f0]
mov qword [0x180033bb8], rax
mov r8d, dword [0x180033bc8]
mov rcx, qword [0x180033f60]
xor edx, edx
xor r8d, dword [rbx]
call fcn.1800246e8
cmp rax, r13
mov qword [rbx], rax
je 0x180010a2e
add esi, r14d
add rbx, 8
cmp esi, 5
jb 0x180010a00
jmp 0x180010a3a
mov edi, 0x7f
jmp 0x180010a3a
mov edi, 0x7e
cmp edi, r13d
jne 0x18001141d
cmp ebp, r13d
je 0x180010a4f
call fcn.18000968c
mov edi, eax
cmp edi, r13d
jne 0x18001141d
cmp qword [0x180033e30], r13
mov qword [rsp + 0x50], r13
jne 0x180010ade
mov r9d, dword [0x180033bc8]
mov rcx, qword [0x180033ba0]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x80]
xor r9d, 0x8241c5a7
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
call fcn.180004eb8
cmp eax, r13d
je 0x180010ade
cmp dword [rsp + 0x48], 0x90
jb 0x180010ade
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov r11, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x80]
mov edx, dword [rsp + 0x48]
mov r8d, r11d
mov rcx, rbx
xor r9d, r9d
mov dword [0x180033c4c], r11d
call fcn.180015164
mov qword [0x180033e30], rbx
lea rcx, [rsp + 0x50]
call fcn.180029ce4
mov rbx, qword [rsp + 0x50]
cmp rbx, r13
jne 0x180010b2d
mov r9d, dword [0x180033bc8]
mov rcx, qword [0x180033ba0]
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x50]
xor r9d, 0xb44b3408
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
call fcn.180004eb8
cmp eax, r13d
je 0x180010b47
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.180001ad0
mov rcx, qword [0x1800339a8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call fcn.180026c8c
mov rax, qword [0x180033bd0]
mov r11d, dword [0x180033b9c]
xor r11d, 0x109a6410
lea rsi, [0x180000000]
lea rcx, [rsp + 0x58]
lea rdx, [rax + rsi + 0x364dd]
mov r9d, r14d
xor r8d, r8d
mov dword [rsp + 0x58], r11d
mov r12, r13
call fcn.18001c904
cmp rax, r13
mov rbx, rax
lea rbp, [0x180033bd8]
je 0x180010bbe
mov r9, rax
xor r8d, r8d
mov edx, r14d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rcx, qword [0x1800339a8]
mov r8, rbx
xor edx, edx
mov r12, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [0x180033afc]
mov edi, r13d
cmp ecx, 0x6a4b44c7
ja 0x180010da3
je 0x180010c48
cmp ecx, 0x54406fa
je 0x180010c3e
cmp ecx, 0x1795f247
je 0x180010c32
cmp ecx, 0x4afa8999
je 0x180010c48
cmp ecx, 0x4e987882
je 0x180010c00
cmp ecx, 0x5e1c383c
jmp 0x180010dc9
mov rcx, qword [0x180033bd0]
lea rax, [rcx + rsi + 0x3694c]
mov qword [0x180033990], rax
lea rax, [rcx + rsi + 0x367ea]
mov qword [0x180033988], rax
lea rax, [rcx + rsi + 0x3624e]
jmp 0x180010e33
call fcn.1800054a4
mov edi, eax
jmp 0x180010e76
call fcn.180019264
jmp 0x180010e3f
lea rcx, [0x180036934]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp rax, r13
je 0x180010d99
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x180033ae0], eax
je 0x180010e41
cmp byte [0x180033b94], 6
ja 0x180010cbd
lea rcx, [0x180036c02]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x1800367fb]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x180036c69]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x180036bda]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x18003684f]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x180036c62]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x180036a82]
call fcn.18002b3b0
mov r11, qword [0x180033b00]
xor r8d, r8d
or dword [r11 + 0x34], r14d
lea ebp, [r8 + 0xc]
lea rcx, [0x180032a80]
mov edx, ebp
call fcn.180008b30
cmp eax, r13d
mov edi, eax
je 0x180010d0d
cmp dword [0x180033afc], 0x4afa8999
jne 0x180010d8d
mov rcx, qword [0x180033b88]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x60], r13
mov dword [rsp + 0x40], r13d
call fcn.180007874
cmp eax, r13d
mov edi, eax
jne 0x180010d7f
mov eax, dword [rsp + 0x40]
cmp eax, r13d
jbe 0x180010d6b
mov rbx, qword [rsp + 0x60]
mov rsi, rax
mov rax, qword [0x180033ba0]
cmp qword [rbx], rax
je 0x180010d62
mov r8, qword [rbx]
lea rcx, [0x180032960]
mov edx, ebp
call fcn.180008b30
add rbx, 8
sub rsi, r14
jne 0x180010d45
mov r8, qword [rsp + 0x60]
mov rcx, qword [0x1800339a8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [0x180032a80]
mov edx, ebp
call fcn.180011a20
lea rbp, [0x180033bd8]
jmp 0x180010e41
mov edi, 0x7e
jmp 0x180010e41
cmp ecx, 0x8519d3b0
je 0x180010e51
cmp ecx, 0xa2a3b6ac
je 0x180010e51
cmp ecx, 0xab26db33
je 0x180010e06
cmp ecx, 0xbf95f543
je 0x180010df8
cmp r12, r13
mov dword [0x180033afc], r13d
je 0x180010e76
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x180010e76
call fcn.1800052e0
jmp 0x180010e76
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180009d58
jmp 0x180010e76
mov rcx, qword [0x180033bd0]
lea rax, [rcx + rsi + 0x36065]
mov qword [0x180033990], rax
lea rax, [rcx + rsi + 0x367d9]
mov qword [0x180033988], rax
lea rax, [rcx + rsi + 0x36247]
mov qword [0x180033998], rax
call fcn.180003f90
mov edi, eax
cmp edi, r13d
jne 0x18001141d
call fcn.180015038
jmp 0x180010e76
cmp r12, r13
je 0x180010e6f
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x180010e6f
call fcn.1800052e0
mov edi, eax
mov dword [0x180033afc], r13d
cmp edi, r13d
jne 0x18001141d
mov rcx, qword [0x1800339a8]
xor edx, edx
lea r8d, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r13
mov rsi, rax
je 0x18001141d
mov rbx, qword [0x180033b48]
mov dword [rax + 4], r13d
xor edx, edx
mov ecx, 0x100000
mov r8, rbx
mov dword [rax], r13d
mov qword [0x180033aa0], rax
call qword [sym.imp.KERNEL32.dll_OpenEventA]
cmp rax, r13
jne 0x180010eec
mov r9, rbx
xor r8d, r8d
mov edx, r14d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateEventA]
cmp rax, r13
jne 0x180010eec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x18001141d
lock add dword [0x180033b70], r14d
lea rcx, [0x18002482c]
xor r8d, r8d
mov rdx, rax
call fcn.1800191d8
mov ecx, dword [rsi + 4]
mov qword [rsi + rcx*8 + 8], rax
mov eax, dword [rsi + 4]
cmp qword [rsi + rax*8 + 8], r13
jne 0x180010f25
lock add dword [0x180033b70], 0xffffffff
jmp 0x18001141d
add eax, r14d
cmp dword [0x180033afc], 0x1795f247
mov dword [rsi + 4], eax
jne 0x1800111d1
lea r8, [0x180033b10]
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
lea r9, [0x180020a9c]
lea r8, [0x1800071e8]
lea rcx, [0x180033c50]
mov edx, 0x4a30
call fcn.18001e664
cmp eax, r13d
mov edi, eax
jne 0x180010f7e
mov rax, qword [0x180033c50]
or dword [rax + 0x34], 3
cmp edi, r13d
jne 0x18001141d
lea rax, [0x180028108]
lea rcx, [0x180033d00]
mov qword [0x180033d00], rax
lea rax, [0x18001c72c]
mov qword [0x180033d18], rax
call fcn.18001286c
lea rax, [0x18000ec34]
mov qword [0x180033cb0], rax
lea rax, [0x18000e4c0]
lea r10, [0x18002a0a0]
lea rcx, [0x180033c90]
mov qword [0x180033ca0], rax
mov qword [0x180033c98], r10
call fcn.18001286c
lea rax, [0x180004768]
lea r10, [0x180019064]
mov qword [0x180033ce8], rax
lea rax, [0x1800195fc]
mov qword [0x180033cd0], r10
mov qword [0x180033cd8], rax
mov dword [0x180033cf0], r14d
lea rcx, [0x180033cc8]
call fcn.18001286c
lea r10, [0x18000b56c]
lea rcx, [0x180033c60]
mov qword [0x180033c70], r10
mov dword [0x180033c88], r14d
call fcn.18001286c
cmp dword [0x180033dd0], r13d
mov edi, r13d
mov dword [0x180033d68], r13d
je 0x1800110c2
cmp qword [0x180033d50], r13
jne 0x1800110c2
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
cmp rax, r13
mov qword [0x180033d50], rax
jne 0x180011084
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1800110c0
lock add dword [0x180033b70], r14d
lea r8, [0x180033d58]
lea rdx, [0x180033d50]
lea rcx, [0x180012080]
call fcn.1800191d8
cmp rax, r13
mov qword [0x180033d60], rax
jne 0x1800110c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lock add dword [0x180033b70], 0xffffffff
mov edi, eax
cmp edi, r13d
jne 0x18001141d
test byte [0x18003212c], 4
je 0x1800110e9
mov dword [0x180033c48], r14d
mov dword [0x180033d28], r14d
mov dword [0x180033cb8], r14d
lea rcx, section..bss
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp rax, r13
je 0x180011114
lea r8, [0x180033168]
lea rcx, [0x180033150]
mov r9d, r14d
mov edx, r14d
call fcn.180029668
mov rcx, qword [0x180033b08]
mov ebp, dword [rsi + 4]
lea rax, [0x180033bd8]
mov qword [rsp + 0x38], rax
mov eax, pe_nt_image_headers64
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], eax
lea r9d, [rax - 1]
mov edx, 0x40000003
mov r8d, 4
mov edi, r13d
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x18001119e
lock add dword [0x180033b70], r14d
lea rcx, [0x1800173d4]
xor r8d, r8d
mov rdx, rax
call fcn.1800191d8
cmp rax, r13
je 0x180011183
mov qword [rsi + rbp*8 + 8], rax
jmp 0x1800111a6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lock add dword [0x180033b70], 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800111a6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, r13d
jne 0x18001141d
add dword [rsi + 4], r14d
cmp dword [0x1800339ec], r13d
je 0x18001135a
lea rcx, [0x1800339e8]
call fcn.180022304
jmp 0x18001135a
cmp qword [0x180033ba8], r13
je 0x18001135a
mov rcx, qword [0x180033b20]
lea r8, [rsp + 0x98]
xor edx, edx
call fcn.18002a0d4
cmp eax, r13d
jne 0x18001129f
lea r9, [rsp + 0x98]
lea r8, [rsp + 0x130]
lea rdx, [rsp + 0x70]
lea rcx, [0x18003622a]
call fcn.1800152b0
cmp eax, r13d
jne 0x18001129f
cmp dword [rsp + 0x130], 4
mov rbp, qword [rsp + 0x70]
jbe 0x18001128d
mov rcx, qword [0x180033ba8]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov r8d, dword [0x180033b9c]
mov edx, dword [rsp + 0x130]
xor r9d, r9d
mov rcx, rbp
mov rbx, rax
call fcn.180015e14
mov r11d, dword [rsp + 0x130]
lea rdx, [rbp + 4]
mov rcx, rbx
mov byte [r11 + rbp - 1], r13b
call fcn.180016808
cmp eax, r13d
je 0x18001128d
xor r9d, r9d
mov rdx, rbp
mov ecx, 0x125
lea r8d, [r9 + 4]
call fcn.18000d3c8
mov rcx, qword [0x1800339a8]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x180033b20]
lea r8, [rsp + 0x78]
xor edx, edx
call fcn.18002a0d4
cmp eax, r13d
jne 0x18001135a
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x138]
lea rdx, [rsp + 0x88]
lea rcx, [0x18003622e]
call fcn.1800152b0
cmp eax, r13d
jne 0x18001135a
cmp dword [rsp + 0x138], r14d
mov rbp, qword [rsp + 0x88]
jbe 0x180011348
mov rcx, qword [0x180033ba8]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov r8d, dword [0x180033b9c]
mov edx, dword [rsp + 0x138]
xor r9d, r9d
mov rcx, rbp
mov rbx, rax
call fcn.180015e14
mov r11d, dword [rsp + 0x138]
mov rdx, rbp
add r11d, 0xffffffff
mov rcx, rbx
mov byte [r11 + rbp], r13b
call fcn.180016808
cmp eax, r13d
je 0x180011348
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180009d58
mov rcx, qword [0x1800339a8]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [0x180033afc]
cmp eax, r13d
je 0x18001141a
cmp eax, 0x1795f247
jne 0x1800113e0
cmp r12, r13
je 0x180011385
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov qword [0x180033b60], r12
mov rcx, qword [0x1800339a8]
xor edx, edx
lea r8d, [rdx + 0x43]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r13
mov qword [0x180033e10], rax
je 0x1800113e0
mov rcx, qword [0x180033bd0]
movzx r9d, byte [0x180033b95]
movzx r8d, byte [0x180033b94]
lea rdx, [0x180000000]
lea r10, [rcx + rdx + 0x36168]
lea rdx, [rcx + rdx + 0x36131]
mov rcx, rax
mov qword [rsp + 0x20], r10
call qword [sym.imp.USER32.dll_wsprintfA]
lock add dword [0x180033b70], r14d
mov rdx, qword [0x180033bb0]
lea rcx, [0x18000a8b8]
xor r8d, r8d
call fcn.1800191d8
mov ecx, dword [rsi + 4]
mov qword [rsi + rcx*8 + 8], rax
mov eax, dword [rsi + 4]
cmp qword [rsi + rax*8 + 8], r13
je 0x180010f18
add eax, r14d
mov dword [rsi + 4], eax
mov edi, r13d
mov eax, edi
add rsp, 0xe0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret