Function at 0x1800f3ef0
Capabilities:
Create thread
Get session user name

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xaa0]
sub rsp, 0xba0
mov rax, qword [0x1801094f8]
xor rax, rsp
mov qword [rbp + 0xa90], rax
xor esi, esi
mov qword [rsp + 0x70], rdx
mov rbx, rdx
mov qword [rsp + 0x68], rcx
mov rdx, rcx
mov qword [rbp - 0x80], r9
imul ecx, r8d, 0x6c
mov eax, r8d
mov r11, r9
mov dword [rsp + 0x48], r8d
mov r13d, r8d
mov dword [rsp + 0x4c], esi
mov edi, esi
mov dword [rsp + 0x60], eax
lea r9, [0x180000000]
mov dword [rsp + 0x50], ecx
cmp r8d, ecx
ja 0x1800f47da
mov ecx, dword [rsp + 0x58]
mov r14d, pe_nt_image_headers64
mov r12, qword [rbp - 0x78]
movzx r13d, byte [rsp + 0x40]
mov r8d, dword [rsp + 0x50]
mov dword [rsp + 0x44], ecx
movzx ecx, byte [rsp + 0x40]
mov byte [rsp + 0x41], cl
mov ecx, eax
mov r10d, 0x756c
cmp eax, 0x115e
ja 0x1800f4136
je 0x1800f409f
cmp eax, 0x924
ja 0x1800f403b
je 0x1800f402f
sub eax, 0xea
je 0x1800f4003
sub eax, 4
je 0x1800f3ff7
cmp eax, 0x30
jne 0x1800f472c
lea r8d, [rax - 0x2c]
lea rdx, str.padaryti_multi_pradino_pakrovimo__Multi_Boot__CD_DVD
lea rcx, [rbp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov ecx, dword [rsp + 0x48]
mov r11, qword [rbp - 0x80]
mov rdx, qword [rsp + 0x68]
mov r8d, dword [rsp + 0x50]
mov byte [rbp + 0x34], 0
jmp 0x1800f472c
mov dword [rbp + 0x48], 0x65
jmp 0x1800f472c
mov r12, rdx
movzx eax, si
mov rcx, rdx
nop dword [rax]
mov byte [rcx], al
lea rcx, [rcx + 1]
inc ax
cmp ax, r14w
jb 0x1800f4010
mov ecx, dword [rsp + 0x48]
mov byte [rdx + 0x100], 0
jmp 0x1800f472c
mov byte [rdx + 0x101], 0
jmp 0x1800f472c
cmp eax, 0x94c
je 0x1800f405d
mov r10d, dword [rsp + 0x44]
cmp eax, 0xb2c
jne 0x1800f4731
mov word [rbp + 0x34], 0x7b20
jmp 0x1800f4731
mov r8d, 3
lea rdx, [0x180103660]
lea rcx, [rbp + 0x4a]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov eax, dword [0x180103668]
mov ecx, dword [rsp + 0x48]
mov r11, qword [rbp - 0x80]
mov rdx, qword [rsp + 0x68]
mov r8d, dword [rsp + 0x50]
mov dword [rbp + 0x4e], eax
movzx eax, word [0x18010366c]
mov word [rbp + 0x52], ax
jmp 0x1800f472c
xor dl, dl
movzx r9d, si
xor r10b, r10b
nop dword [rax + rax]
mov r8d, 0xea
mov eax, r8d
sub eax, 0xea
je 0x1800f40fb
sub eax, 1
je 0x1800f40e8
sub eax, 1
je 0x1800f40d5
cmp eax, 1
jne 0x1800f4111
inc r9w
jmp 0x1800f4111
movzx eax, r10b
mov byte [rax + r12], r13b
movzx eax, dl
inc eax
cdq
idiv dword [r11]
jmp 0x1800f4111
movzx eax, r10b
movzx ecx, r9w
movzx eax, byte [rax + r12]
mov byte [rcx + r12], al
jmp 0x1800f4111
movzx eax, r9w
movzx r13d, byte [rax + r12]
movzx eax, dl
movzx ecx, byte [rax + rbx]
add cl, r13b
add r10b, cl
inc r8d
cmp r8d, 0xee
jb 0x1800f40b6
cmp r9w, r14w
jb 0x1800f40b0
mov ecx, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x68]
mov r8d, dword [rsp + 0x50]
jmp 0x1800f472c
cmp eax, 0x11aa
je 0x1800f4725
cmp eax, 0x153a
je 0x1800f470c
cmp eax, 0x1f48
je 0x1800f46f2
cmp eax, 0x2956
je 0x1800f46e3
cmp eax, 0x3364
jne 0x1800f472c
cmp qword [rbx + 0x10], 0x35
mov r10d, 1
mov dword [rsp + 0x44], r10d
jb 0x1800f4731
mov r15d, esi
cmp r15d, 0xb
ja case.default.0x1800f419e
mov eax, r15d
mov ecx, dword [r9 + rax*4 + 0xf4a2c]
add rcx, r9
jmp rcx
mov rax, qword [rbx + 0x10]
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
cmp rax, 0x11
jb 0x1800f4a24
add rax, 0xffffffffffffffef
mov esi, 0x24
cmp rax, rsi
cmovb rsi, rax
cmp qword [rbx + 0x18], 0x10
mov rax, rbx
jb 0x1800f41d7
mov rax, qword [rbx]
lea r14, [rax + 0x11]
cmp rsi, 0xf
ja 0x1800f41fe
mov r8, rsi
mov qword [rbp], rsi
mov rdx, r14
lea rcx, [rbp - 0x10]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rsi - 0x10], 0
jmp 0x1800f42a0
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x1800f4a18
mov rdi, rsi
or rdi, 0xf
cmp rdi, rax
jbe 0x1800f4222
mov rdi, rax
jmp 0x1800f422f
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1800f4268
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800f4a1e
mov rcx, rax
call fcn.1800fe2e0
test rax, rax
je 0x1800f47bb
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1800f4279
test rcx, rcx
je 0x1800f4277
call fcn.1800fe2e0
mov rbx, rax
jmp 0x1800f4279
xor ebx, ebx
mov r8, rsi
mov qword [rbp], rsi
mov rdx, r14
mov qword [rbp + 8], rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [rsp + 0x4c]
mov byte [rbx + rsi], 0
mov qword [rbp - 0x10], rbx
mov rbx, qword [rsp + 0x70]
or edi, 1
lea rdx, [rbp - 0x10]
lea rcx, [0x180109448]
mov dword [rsp + 0x4c], edi
call fcn.1800e68b0
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x1800f42f2
mov rcx, qword [rbp - 0x10]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800f42ed
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800f47bb
call fcn.1800fe31c
mov edx, dword [rsp + 0x78]
lea rcx, [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_CredWriteA]
movzx eax, byte [rsp + 0x40]
xor esi, esi
cmp dword [rsp + 0x58], esi
mov ecx, esi
cmovne ecx, eax
mov byte [rsp + 0x40], cl
jmp 0x1800f46ad
mov r8d, 2
mov byte [rbp + 0x22], 0
lea rdx, [0x18010357d]
lea rcx, [rbp + 0x22]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x24], 0
jmp 0x1800f46ad
mov r8d, 2
lea rdx, [0x1801035b4]
lea rcx, [rbp + 0x26]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x28], 0
mov byte [rsp + 0x40], 1
jmp 0x1800f46ad
mov eax, 0x6375
mov word [rbp + 0x20], ax
jmp case.default.0x1800f419e
mov word [rbp + 0x24], 0x72
jmp case.default.0x1800f419e
mov eax, 0x7274
mov word [rbp + 0x1e], ax
jmp case.default.0x1800f419e
mov word [rbp + 0x25], 0x6f
jmp case.default.0x1800f419e
mov byte [rbp + 0x1e], 0
jmp case.default.0x1800f419e
mov eax, dword [0x1801035d2]
lea rdx, [0x180103604]
mov dword [rbp + 0x10], eax
lea rcx, [rbp + 0x10]
movzx eax, byte [0x1801035d6]
mov r8d, 4
mov byte [rbp + 0x14], al
mov byte [rbp + 0x15], 0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, dword [0x180103649]
mov dword [rbp + 0x19], eax
movzx eax, byte [0x18010364d]
mov byte [rbp + 0x1d], al
jmp 0x1800f46ad
lea r8, [rbp - 0x68]
mov dword [rsp + 0x78], 1
xor edx, edx
lea rcx, [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_CredGetTargetInfoA]
mov dword [rsp + 0x58], eax
jmp 0x1800f46ad
mov esi, 0xb
mov qword [rbp + 8], 0xf
cmp qword [rbx + 0x10], rsi
mov r14, rbx
mov byte [rbp - 0x10], 0
cmovb rsi, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1800f442b
mov r14, qword [rbx]
cmp rsi, 0xf
ja 0x1800f444e
mov r8, rsi
mov qword [rbp], rsi
mov rdx, r14
lea rcx, [rbp - 0x10]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rsi - 0x10], 0
jmp 0x1800f44f0
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x1800f4a18
mov rdi, rsi
or rdi, 0xf
cmp rdi, rax
jbe 0x1800f4472
mov rdi, rax
jmp 0x1800f447f
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1800f44b8
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800f4a1e
mov rcx, rax
call fcn.1800fe2e0
test rax, rax
je 0x1800f47bb
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1800f44c9
test rcx, rcx
je 0x1800f44c7
call fcn.1800fe2e0
mov rbx, rax
jmp 0x1800f44c9
xor ebx, ebx
mov r8, rsi
mov qword [rbp], rsi
mov rdx, r14
mov qword [rbp + 8], rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [rsp + 0x4c]
mov byte [rbx + rsi], 0
mov qword [rbp - 0x10], rbx
mov rbx, qword [rsp + 0x70]
or edi, 2
lea rdx, [rbp - 0x10]
lea rcx, [0x180109468]
mov dword [rsp + 0x4c], edi
call fcn.1800e68b0
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x1800f4542
mov rcx, qword [rbp - 0x10]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800f453d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800f47bb
call fcn.1800fe31c
mov rax, qword [rbx + 0x10]
xorps xmm0, xmm0
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
cmp rax, 0xb
jb 0x1800f4a24
add rax, 0xfffffffffffffff5
mov esi, 6
cmp rax, rsi
cmovb rsi, rax
cmp qword [rbx + 0x18], 0x10
mov rax, rbx
jb 0x1800f4590
mov rax, qword [rbx]
lea r14, [rax + 0xb]
cmp rsi, 0xf
ja 0x1800f45b7
mov r8, rsi
mov qword [rbp], rsi
mov rdx, r14
lea rcx, [rbp - 0x10]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rsi - 0x10], 0
jmp 0x1800f4659
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x1800f4a18
mov rdi, rsi
or rdi, 0xf
cmp rdi, rax
jbe 0x1800f45db
mov rdi, rax
jmp 0x1800f45e8
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1800f4621
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800f4a1e
mov rcx, rax
call fcn.1800fe2e0
test rax, rax
je 0x1800f47bb
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1800f4632
test rcx, rcx
je 0x1800f4630
call fcn.1800fe2e0
mov rbx, rax
jmp 0x1800f4632
xor ebx, ebx
mov r8, rsi
mov qword [rbp], rsi
mov rdx, r14
mov qword [rbp + 8], rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [rsp + 0x4c]
mov byte [rbx + rsi], 0
mov qword [rbp - 0x10], rbx
mov rbx, qword [rsp + 0x70]
or edi, 4
lea rdx, [rbp - 0x10]
lea rcx, [0x180109488]
mov dword [rsp + 0x4c], edi
call fcn.1800e68b0
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x1800f46ab
mov rcx, qword [rbp - 0x10]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800f46a6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800f47bb
call fcn.1800fe31c
xor esi, esi
lea r9, [0x180000000]
inc r15d
lea eax, [r15 + 0xd3]
cmp eax, 0xdf
jb 0x1800f4186
mov ecx, dword [rsp + 0x48]
mov r14d, pe_nt_image_headers64
mov r11, qword [rbp - 0x80]
mov rdx, qword [rsp + 0x68]
mov r8d, dword [rsp + 0x50]
jmp 0x1800f472c
mov byte [rbp + 0x42], 0
mov byte [rsp + 0x41], 1
mov qword [rbp - 0x70], rsi
jmp 0x1800f472c
mov eax, dword [0x1801036cc]
mov dword [rbp + 0x3b], eax
movzx eax, byte [0x1801036d0]
mov byte [rbp + 0x3f], al
mov word [rbp + 0x40], r10w
jmp 0x1800f472c
mov eax, dword [0x180103676]
mov dword [rbp + 0x36], eax
movzx eax, byte [0x18010367a]
mov byte [rbp + 0x3a], al
mov byte [rbp + 0x3b], 0
jmp 0x1800f472c
mov dword [rbp + 0x52], 0x4c
mov r10d, dword [rsp + 0x44]
mov eax, ecx
lea r9, [0x180000000]
add eax, dword [rsp + 0x60]
lea eax, [rax + rcx*8]
mov dword [rsp + 0x60], eax
cmp eax, r8d
jbe 0x1800f3f8e
mov r13d, dword [rsp + 0x48]
movzx ebx, byte [rsp + 0x40]
lea r14d, [r13 + 0x234]
cmp r13d, r14d
jae case.0x1800f47b9.246
mov r15d, dword [rsp + 0x64]
movzx esi, byte [rsp + 0x40]
mov rdi, qword [rbp - 0x78]
mov r12, qword [rsp + 0x70]
nop dword [rax + rax]
cmp r13d, 0x208
ja 0x1800f49c8
je 0x1800f499d
lea eax, [r13 - 0xee]
cmp eax, 0xeb
ja case.0x1800f47b9.248
movzx eax, byte [r9 + rax + 0xf4a88]
mov ecx, dword [r9 + rax*4 + 0xf4a5c]
add rcx, r9
jmp rcx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp byte [rsp + 0x40], 0
je 0x1800f47d3
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_CredFree]
mov al, 1
jmp 0x1800f49ee
movzx eax, byte [rsp + 0x40]
mov r10d, dword [rsp + 0x58]
mov byte [rsp + 0x41], al
mov dword [rsp + 0x44], r10d
jmp 0x1800f4753
xor ecx, ecx
lea rax, [rbp - 0x78]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rcx
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
mov r8d, r15d
mov qword [rsp + 0x20], rcx
mov edx, r10d
lea rcx, [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoA]
test eax, eax
je 0x1800f4831
mov byte [rsp + 0x41], 0
jmp case.0x1800f47b9.248
cmp byte [rsp + 0x41], 0
je case.0x1800f47b9.248
mov rax, qword [rbp - 0x70]
xor ecx, ecx
mov edx, dword [rsp + 0x44]
xor r9d, r9d
mov qword [rsp + 0x30], rcx
mov r8d, r15d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoA]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp case.0x1800f47b9.248
lea rdx, [rsp + 0x7c]
lea rcx, [rbp + 0x80]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor bl, bl
jmp case.0x1800f47b9.248
mov r8d, 3
lea rdx, [0x1801036e8]
lea rcx, [rbp + 0x48]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8d, 2
lea rdx, [0x1801036f0]
lea rcx, [rbp + 0x64]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov eax, dword [0x1801036f4]
mov dword [rbp + 0x66], eax
movzx eax, word [0x1801036f8]
mov word [rbp + 0x6a], ax
lea rax, [rbp + 0x48]
sub rax, 2
nop word [rax + rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x1800f48e0
movups xmm0, xmmword [str._RESIZE]
movups xmmword [rax], xmm0
jmp case.0x1800f47b9.248
mov r15d, 4
mov dword [rsp + 0x7c], 0x104
jmp case.0x1800f47b9.248
mov sil, 1
xor edi, edi
jmp case.0x1800f47b9.248
xor eax, eax
lea r8, [0x1800f16e0]
mov qword [rsp + 0x28], rax
mov r9, r12
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [r12], rax
test rax, rax
jne case.0x1800f47b9.248
jmp 0x1800f49ee
mov dword [rsp + 0x64], 0x400
jmp case.0x1800f47b9.248
movsd xmm0, qword [str.OW_T]
movsd qword [rbp + 0x54], xmm0
mov dword [rbp + 0x5c], 0x4f
jmp case.0x1800f47b9.248
lea r8, [rsp + 0x58]
mov dword [rsp + 0x58], 1
mov edx, 0x109
mov rcx, r12
call fcn.1800f6f80
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne case.0x1800f47b9.248
xor sil, sil
jmp case.0x1800f47b9.248
test sil, sil
je 0x1800f49c4
lea r9, [rsp + 0x64]
mov rcx, rdi
lea r8, [rbp + 0x290]
lea rdx, [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_GetServiceKeyNameW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov bl, 1
jmp case.0x1800f47b9.248
cmp r13d, 0x237
je case.0x1800f47b9.246
add r13d, 0x2f
cmp r13d, r14d
jae case.0x1800f47b9.246
mov r10d, dword [rsp + 0x44]
lea r9, [0x180000000]
jmp 0x1800f4780
movzx eax, bl
mov rcx, qword [rbp + 0xa90]
xor rcx, rsp
call fcn.1800fe830
mov rbx, qword [rsp + 0xbf0]
add rsp, 0xba0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800fb7e0
int3
call fcn.1800fb6a0
int3
call fcn.1800fb820
int3