Function at 0x180002b10
Capabilities:
Enumerate threads
Extract resource via kernel32 functions
Link many functions at runtime
Resume thread
Suspend thread
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xda0]
sub rsp, 0xea0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xd90], rax
mov byte [0x180024ea0], 1
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0xb90]
call fcn.180016140
lea rcx, str.Loading_configuration..._r_n
call fcn.180001e00
xor r13d, r13d
mov qword [rsp + 0x40], r13
lea r8, [rsp + 0x40]
lea rdx, [0x180001ec0]
lea ecx, [r13 + 4]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov edi, 0xff
mov r8d, edi
lea rdx, [rbp + 0xb90]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0xb90]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r13w
jne 0x180002bb5
test rax, rax
je 0x180002c13
cmp word [rbp + rax*2 + 0xb90], 0x5c
je 0x180002bd7
sub rax, 1
jne 0x180002bc4
jmp 0x180002c13
lea rbx, [rbp + 0xb92]
lea rbx, [rbx + rax*2]
mov r8, rdi
sub r8, rax
add r8, r8
xor edx, edx
mov rcx, rbx
call fcn.180016140
movups xmm0, xmmword [str.rdpwrap.ini]
movups xmmword [rbx], xmm0
mov eax, dword [0x18001fd70]
mov dword [rbx + 0x10], eax
movzx eax, word [0x18001fd74]
mov word [rbx + 0x14], ax
mov ecx, 0x400
call fcn.180004c20
mov rbx, rax
lea r8, [rbp + 0xb90]
lea rdx, str.Configuration_file:__S_r_n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov rcx, rbx
call fcn.180001e00
mov rcx, rbx
call fcn.180004c28
mov ecx, 0x30
call fcn.180004c38
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
lea rdx, [rbp + 0xb90]
mov rcx, rax
call fcn.180001010
nop
mov qword [0x180024ed8], rax
test rax, rax
jne 0x180002ce1
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [rax + 3]
lea rcx, str._rdpwrap.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180004b06
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, 0x25
lea rdx, str.Error:_Failed_to_load_configuration_r_n
jmp 0x180004aea
mov edx, r13d
mov r9d, dword [rax + 0x20]
test r9d, r9d
je 0x180002d23
mov r11, qword [rax + 0x28]
mov eax, edx
imul r8, rax, 0x110
lea rcx, [r8 + r11]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x180002d05
cmp rax, 4
jne 0x180002d1c
cmp dword [rcx], 0x6e69614d
je 0x180002d9b
inc edx
cmp edx, r9d
jb 0x180002cf1
mov ecx, 0x13e
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsp + 0x40], r13
lea r8, [rsp + 0x40]
lea rdx, [0x180001ec0]
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov r8d, edi
lea r12, str._rdpwrap.txt
mov rdx, r12
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [r12 + rax*2], 0
jne 0x180002d70
test rax, rax
je 0x180002fae
cmp word [r12 + rax*2], 0x5c
je 0x180002f79
sub rax, 1
jne 0x180002d84
jmp 0x180002fae
mov rcx, r11
add rcx, r8
je 0x180002d23
mov r8d, r13d
mov r9d, dword [rcx + 0x100]
test r9d, r9d
je 0x180002e01
mov r10, qword [rcx + 0x108]
nop dword [rax]
mov eax, r8d
imul rdx, rax, 0x1fe
add rdx, r10
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x180002dd4
cmp rax, 7
jne 0x180002df9
cmp dword [rdx], 0x46676f4c
jne 0x180002df9
cmp word [rdx + 4], 0x6c69
jne 0x180002df9
cmp byte [rdx + 6], 0x65
je 0x180002e0b
inc r8d
cmp r8d, r9d
jb 0x180002dc0
mov ecx, 0x76a
jmp 0x180002d28
test rdx, rdx
je 0x180002e01
lea rcx, [rbp + 0x190]
mov eax, 3
nop dword [rax]
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rdx, [rdx + 0x80]
sub rax, 1
jne 0x180002e20
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov rax, qword [rdx + 0x70]
mov qword [rcx + 0x70], rax
mov eax, dword [rdx + 0x78]
mov dword [rcx + 0x78], eax
movzx eax, word [rdx + 0x7c]
mov word [rcx + 0x7c], ax
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x790]
call fcn.180016140
lea rax, [rbp + 0x190]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180002ee0
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x790]
call fcn.180016500
lea rax, [rbp + 0x28f]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180002f10
lea rdx, [rbp + 0x28f]
lea rcx, [rbp + 0x88f]
call fcn.180016500
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x990]
call fcn.180016140
mov r8, rdi
lea rdx, [rbp + 0x88f]
lea rcx, [rbp + 0x990]
call fcn.18000c968
mov rcx, r13
lea r12, str._rdpwrap.txt
movzx eax, word [rbp + rcx + 0x990]
mov word [rcx + r12], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x180002f61
jmp 0x180002fae
lea rbx, [r12 + rax*2]
sub rdi, rax
lea r8, [rdi + rdi]
xor edx, edx
lea rcx, [rbx + 2]
call fcn.180016140
movups xmm0, xmmword [str.rdpwrap.txt]
movups xmmword [rbx + 2], xmm0
mov eax, dword [0x18001fdd0]
mov dword [rbx + 0x12], eax
movzx eax, word [0x18001fdd4]
mov word [rbx + 0x16], ax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [rax + 3]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18000302c
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x40]
mov r8d, 0x1d
lea rdx, str.Initializing_RDP_Wrapper..._r_n
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.termsrv.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x180024ed0], rax
test rax, rax
jne 0x1800030a2
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [rax + 3]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180004b06
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, 0x31
lea rdx, str.Error:_Failed_to_load_Terminal_Services_library_r_n
jmp 0x180004aea
lea rdx, [0x18001fe48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180024eb0], rax
lea rdx, [0x18001fe58]
mov rcx, qword [0x180024ed0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180024ea8], rax
mov ecx, 0x1000
call fcn.180004c20
mov rbx, rax
mov r9, qword [0x180024eb0]
mov r8, qword [0x180024ed0]
sub r9, r8
mov rcx, qword [0x180024ea8]
sub rcx, r8
mov qword [rsp + 0x20], rcx
lea rdx, str.Base_addr:__0x_p_r_nSvcMain:____termsrv.dll0x_llx_r_nSvcGlobals:_termsrv.dll0x_llx_r_n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov rcx, rbx
call fcn.180001e00
mov rcx, rbx
call fcn.180004c28
lea rcx, str.termsrv.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x180004a96
mov edx, 1
lea r8d, [rdx + 0xf]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x180004a96
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x180004a96
mov edx, dword [rax + 0x30]
mov dword [0x180024eb8], edx
movzx ecx, word [rax + 0x36]
mov word [0x180024ebc], cx
movzx eax, word [rax + 0x34]
mov word [0x180024ebe], ax
mov eax, edx
shr eax, 0x10
movzx r15d, al
shl r15w, 8
movzx eax, dl
or r15w, ax
je 0x180004a96
mov ecx, 0x400
call fcn.180004c20
mov rbx, rax
movzx ecx, word [0x180024ebe]
movzx edx, word [0x180024ebc]
movzx r9d, word [0x180024eb8]
movzx r8d, word [0x180024eba]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea rdx, str.Version:_____d._d._d._d_r_n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov rcx, rbx
call fcn.180001e00
mov rcx, rbx
call fcn.180004c28
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180003267
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x40]
mov r8d, 0x15
lea rdx, str.Freezing_threads..._r_n
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r14d, eax
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18000330b
mov dword [rsp + 0x48], 0x1c
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
mov r8d, dword [rsp + 0x50]
cmp r8d, esi
je 0x1800032f0
cmp dword [rsp + 0x54], r14d
jne 0x1800032f0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1800032f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1800032b5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [0x180024ed8]
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x190]
call fcn.180016140
mov edx, r13d
mov r9d, dword [rbx + 0x20]
movabs rsi, 0x7963696c6f504c53
test r9d, r9d
je 0x180003376
mov r10, qword [rbx + 0x28]
mov eax, edx
imul r8, rax, 0x110
lea rcx, [r8 + r10]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x180003354
cmp rax, 4
jne 0x18000336f
cmp dword [rcx], 0x6e69614d
je 0x180003593
inc edx
cmp edx, r9d
jb 0x180003340
mov ecx, 0x13e
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, 1
mov ecx, 0x600
lea rdi, [0x180002150]
cmp r15w, cx
jne 0x180003455
test al, al
je 0x180003455
lea rcx, str.slc.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x180024ec8], rax
lea rdx, str.SLGetWindowsInformationDWORD
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180024ee0], rax
cmp rax, 0xffffffffffffffff
je 0x180003455
lea rcx, str.Hook_SLGetWindowsInformationDWORD_r_n
call fcn.180001e00
mov word [0x180024ee8], 0xb848
mov qword [0x180024ef0], rdi
mov word [0x180024ef8], 0xc350
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x18
lea r8, [0x180024f00]
mov rdx, qword [0x180024ee0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x18
lea r8, [0x180024ee8]
mov rdx, qword [0x180024ee0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rbx, qword [0x180024ed8]
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp - 0x70]
call fcn.180016140
mov edx, r13d
mov r9d, dword [rbx + 0x20]
test r9d, r9d
je 0x1800034b6
mov r10, qword [rbx + 0x28]
nop dword [rax]
mov eax, edx
imul r8, rax, 0x110
lea rcx, [r8 + r10]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x180003494
cmp rax, 4
jne 0x1800034af
cmp dword [rcx], 0x6e69614d
je 0x1800036cb
inc edx
cmp edx, r9d
jb 0x180003480
mov ecx, 0x13e
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, 1
mov ecx, 0x601
cmp r15w, cx
jne 0x18000380a
test al, al
je 0x180003840
lea rcx, str.slc.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x180024ec8], rax
lea rdx, str.SLGetWindowsInformationDWORD
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180024ee0], rax
cmp rax, 0xffffffffffffffff
je 0x180003840
lea rcx, str.Hook_SLGetWindowsInformationDWORD_r_n
call fcn.180001e00
mov word [0x180024ee8], 0xb848
mov qword [0x180024ef0], rdi
mov word [0x180024ef8], 0xc350
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x18
lea r8, [0x180024f00]
mov rdx, qword [0x180024ee0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x18
lea r8, [0x180024ee8]
mov rdx, qword [0x180024ee0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x180003840
mov rcx, r10
add rcx, r8
je 0x180003376
mov r8d, r13d
mov r9d, dword [rcx + 0x100]
test r9d, r9d
je 0x1800035f6
mov r10, qword [rcx + 0x108]
movabs r11, 0x3036544e6b6f6f48
nop
mov eax, r8d
imul rdx, rax, 0x1fe
add rdx, r10
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x1800035d4
cmp rax, 0x10
jne 0x1800035ee
cmp qword [rdx], rsi
jne 0x1800035ee
cmp qword [rdx + 8], r11
je 0x180003600
inc r8d
cmp r8d, r9d
jb 0x1800035c0
mov ecx, 0x76a
jmp 0x18000337b
test rdx, rdx
je 0x1800035f6
lea rcx, [rbp + 0x190]
mov eax, 3
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rdx, [rdx + 0x80]
sub rax, 1
jne 0x180003611
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov rax, qword [rdx + 0x70]
mov qword [rcx + 0x70], rax
mov eax, dword [rdx + 0x78]
mov dword [rcx + 0x78], eax
movzx eax, word [rdx + 0x7c]
mov word [rcx + 0x7c], ax
xor edx, edx
lea r8d, [rdx + 0xa]
lea rcx, [rbp + 0x28f]
call fcn.18000be54
test eax, eax
setne al
jmp 0x180003383
mov rcx, r10
add rcx, r8
je 0x1800034b6
mov r8d, r13d
mov r9d, dword [rcx + 0x100]
test r9d, r9d
je 0x180003736
mov r10, qword [rcx + 0x108]
movabs r11, 0x3136544e6b6f6f48
nop word [rax + rax]
mov eax, r8d
imul rdx, rax, 0x1fe
add rdx, r10
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x180003714
cmp rax, 0x10
jne 0x18000372e
cmp qword [rdx], rsi
jne 0x18000372e
cmp qword [rdx + 8], r11
je 0x180003740
inc r8d
cmp r8d, r9d
jb 0x180003700
mov ecx, 0x76a
jmp 0x1800034bb
test rdx, rdx
je 0x180003736
lea rcx, [rbp - 0x70]
mov eax, 3
nop
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rdx, [rdx + 0x80]
sub rax, 1
jne 0x180003750
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov rax, qword [rdx + 0x70]
mov qword [rcx + 0x70], rax
mov eax, dword [rdx + 0x78]
mov dword [rcx + 0x78], eax
movzx eax, word [rdx + 0x7c]
mov word [rcx + 0x7c], ax
xor edx, edx
lea r8d, [rdx + 0xa]
lea rcx, [rbp + 0x8f]
call fcn.18000be54
test eax, eax
setne al
jmp 0x1800034c3
mov eax, 0x602
cmp r15w, ax
jne 0x180003840
lea rcx, str.slc.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x180024ec8], rax
lea rdx, str.SLGetWindowsInformationDWORD
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180024ee0], rax
mov ecx, 0x100
call fcn.180004c20
mov r15, rax
xor edx, edx
mov r8d, 0x100
mov rcx, rax
call fcn.180016140
movzx ecx, word [0x180024ebe]
movzx edx, word [0x180024ebc]
movzx r9d, word [0x180024eb8]
movzx r8d, word [0x180024eba]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea rdx, str._d._d._d._d
mov rcx, r15
call qword [sym.imp.USER32.dll_wsprintfA]
mov rdx, r15
mov rbx, qword [0x180024ed8]
mov rcx, rbx
call fcn.180001840
test rax, rax
je 0x180004790
mov rcx, qword [0x180024ed0]
test rcx, rcx
je 0x180004790
movsxd rax, dword [rcx + 0x3c]
mov qword [0x180024ec0], rcx
cmp dword [rax + rcx + 0x1c], 0
jbe 0x180004790
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x390]
call fcn.180016140
mov rdx, r15
mov rcx, rbx
call fcn.180001840
mov edi, 0xffffffff
movabs rsi, 0x36782e65646f4379
movabs r13, 0x782e686374615079
test rax, rax
jne 0x180003918
mov ecx, 0x13e
jmp 0x180003983
xor r8d, r8d
mov r9d, dword [rax + 0x100]
test r9d, r9d
je 0x18000397e
mov r10, qword [rax + 0x108]
movabs rbx, 0x6c6e4f6c61636f4c
nop dword [rax + rax]
mov eax, r8d
imul rdx, rax, 0x1fe
add rdx, r10
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x180003954
cmp rax, 0x12
jne 0x180003976
cmp qword [rdx], rbx
jne 0x180003976
cmp qword [rdx + 8], r13
jne 0x180003976
cmp word [rdx + 0x10], 0x3436
je 0x1800039cb
inc r8d
cmp r8d, r9d
jb 0x180003940
mov ecx, 0x76a
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x990]
call fcn.180016140
mov rdx, r15
mov rcx, qword [0x180024ed8]
call fcn.180001840
test rax, rax
jne 0x180003ce7
mov ecx, 0x13e
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14d, 0xffffffff
jmp 0x180003d59
test rdx, rdx
je 0x18000397e
lea rcx, [rbp + 0x390]
mov eax, 3
nop dword [rax]
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rdx, [rdx + 0x80]
sub rax, 1
jne 0x1800039e0
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov rax, qword [rdx + 0x70]
mov qword [rcx + 0x70], rax
mov eax, dword [rdx + 0x78]
mov dword [rcx + 0x78], eax
movzx eax, word [rdx + 0x7c]
mov word [rcx + 0x7c], ax
xor edx, edx
lea r8d, [rdx + 0xa]
lea rcx, [rbp + 0x48f]
call fcn.18000be54
test eax, eax
je 0x180003989
lea rcx, str.Patch_CEnforcementCore::GetInstanceOfTSLicense_r_n
call fcn.180001e00
lea r9, [rbp - 0x70]
lea r8, str.LocalOnlyOffset.x64
mov rdx, r15
mov rcx, qword [0x180024ed8]
call fcn.180001b80
test al, al
je 0x180003ada
mov rax, qword [rbp + 0x98]
cmp rax, rdi
jbe 0x180003adc
lea rcx, str._ERROR__ValueHex_is_too_big
call fcn.180001e00
xor eax, eax
mov edi, eax
add rdi, qword [0x180024ec0]
mov rdx, r15
mov rcx, qword [0x180024ed8]
call fcn.180001840
test rax, rax
jne 0x180003b03
mov ecx, 0x13e
jmp 0x180003983
xor r8d, r8d
mov r9d, dword [rax + 0x100]
test r9d, r9d
je 0x18000397e
mov r10, qword [rax + 0x108]
nop dword [rax]
mov eax, r8d
imul rdx, rax, 0x1fe
add rdx, r10
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x180003b34
cmp rax, 0x11
jne 0x180003b54
cmp qword [rdx], rbx
jne 0x180003b54
cmp qword [rdx + 8], rsi
jne 0x180003b54
cmp byte [rdx + 0x10], 0x34
je 0x180003b61
inc r8d
cmp r8d, r9d
jb 0x180003b20
jmp 0x18000397e
test rdx, rdx
je 0x18000397e
lea rcx, [rbp - 0x70]
mov eax, 3
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rdx, [rdx + 0x80]
sub rax, 1
jne 0x180003b80
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov rax, qword [rdx + 0x70]
mov qword [rcx + 0x70], rax
mov eax, dword [rdx + 0x78]
mov dword [rcx + 0x78], eax
movzx eax, word [rdx + 0x7c]
mov word [rcx + 0x7c], ax
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x190]
call fcn.180016140
lea rax, [rbp - 0x70]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180003c40
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x190]
call fcn.180016500
lea rax, [rbp + 0x8f]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180003c70
lea rdx, [rbp + 0x8f]
lea rcx, [rbp + 0x28f]
call fcn.180016500
lea r9, [rbp + 0x590]
lea r8, [rbp + 0x28f]
call fcn.180001c70
test al, al
je 0x180003989
cmp rdi, qword [0x180024ec0]
jbe 0x180003989
movzx ebx, byte [rbp + 0x68f]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea r8, [rbp + 0x690]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x180003989
xor edi, edi
mov esi, dword [rax + 0x100]
test esi, esi
je 0x180003d3e
mov r14, qword [rax + 0x108]
nop word [rax + rax]
mov eax, edi
imul rbx, rax, 0x1fe
add rbx, r14
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], 0
jne 0x180003d13
cmp rax, 0x13
jne 0x180003d38
mov r8, rax
lea rdx, str.SingleUserPatch.x64
mov rcx, rbx
call fcn.180016b80
test eax, eax
je 0x180003d8f
inc edi
cmp edi, esi
jb 0x180003d00
mov ecx, 0x76a
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14d, 0xffffffff
movabs rsi, 0x36782e65646f4379
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x390]
call fcn.180016140
mov rdx, r15
mov rcx, qword [0x180024ed8]
call fcn.180001840
test rax, rax
jne 0x1800040c7
mov ecx, 0x13e
jmp 0x180004133
test rbx, rbx
je 0x180003d3e
lea rcx, [rbp + 0x990]
mov eax, 3
movups xmm0, xmmword [rbx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rbx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rbx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rbx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rbx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rbx, [rbx + 0x80]
sub rax, 1
jne 0x180003da0
movups xmm0, xmmword [rbx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rbx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rbx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rbx + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov rax, qword [rbx + 0x70]
mov qword [rcx + 0x70], rax
mov eax, dword [rbx + 0x78]
mov dword [rcx + 0x78], eax
movzx eax, word [rbx + 0x7c]
mov word [rcx + 0x7c], ax
xor edx, edx
lea r8d, [rdx + 0xa]
lea rcx, [rbp + 0xa8f]
call fcn.18000be54
test eax, eax
je 0x180003d49
lea rcx, str.Patch_CSessionArbitrationHelper::IsSingleSessionPerUserEnabled_r_n
call fcn.180001e00
lea r9, [rbp - 0x70]
lea r8, str.SingleUserOffset.x64
mov rdx, r15
mov rcx, qword [0x180024ed8]
call fcn.180001b80
mov r14d, 0xffffffff
test al, al
je 0x180003ea0
mov rax, qword [rbp + 0x98]
cmp rax, r14
jbe 0x180003ea2
lea rcx, str._ERROR__ValueHex_is_too_big
call fcn.180001e00
xor eax, eax
mov edi, eax
add rdi, qword [0x180024ec0]
mov rdx, r15
mov rcx, qword [0x180024ed8]
call fcn.180001840
test rax, rax
jne 0x180003ecf
mov ecx, 0x13e
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x180003d4f
xor r8d, r8d
mov r9d, dword [rax + 0x100]
test r9d, r9d
je 0x180003f3e
mov r10, qword [rax + 0x108]
movabs rbx, 0x782e65646f437265
movabs r11, 0x7355656c676e6953
nop dword [rax]
mov eax, r8d
imul rdx, rax, 0x1fe
add rdx, r10
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x180003f14
cmp rax, 0x12
jne 0x180003f36
cmp qword [rdx], r11
jne 0x180003f36
cmp qword [rdx + 8], rbx
jne 0x180003f36
cmp word [rdx + 0x10], 0x3436
je 0x180003f4e
inc r8d
cmp r8d, r9d
jb 0x180003f00
mov ecx, 0x76a
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x180003d4f
test rdx, rdx
je 0x180003f3e
lea rcx, [rbp - 0x70]
mov eax, 3
nop dword [rax]
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rdx, [rdx + 0x80]
sub rax, 1
jne 0x180003f60
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov rax, qword [rdx + 0x70]
mov qword [rcx + 0x70], rax
mov eax, dword [rdx + 0x78]
mov dword [rcx + 0x78], eax
movzx eax, word [rdx + 0x7c]
mov word [rcx + 0x7c], ax
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x190]
call fcn.180016140
lea rax, [rbp - 0x70]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180004020
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x190]
call fcn.180016500
lea rax, [rbp + 0x8f]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180004050
lea rdx, [rbp + 0x8f]
lea rcx, [rbp + 0x28f]
call fcn.180016500
lea r9, [rbp + 0x590]
lea r8, [rbp + 0x28f]
call fcn.180001c70
test al, al
je 0x180003d4f
cmp rdi, qword [0x180024ec0]
jbe 0x180003d4f
movzx ebx, byte [rbp + 0x68f]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea r8, [rbp + 0x690]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x180003d4f
xor r8d, r8d
mov r9d, dword [rax + 0x100]
test r9d, r9d
je 0x18000412e
mov r10, qword [rax + 0x108]
movabs rbx, 0x63696c6f50666544
nop word [rax + rax]
mov eax, r8d
imul rdx, rax, 0x1fe
add rdx, r10
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x180004104
cmp rax, 0x12
jne 0x180004126
cmp qword [rdx], rbx
jne 0x180004126
cmp qword [rdx + 8], r13
jne 0x180004126
cmp word [rdx + 0x10], 0x3436
je 0x180004178
inc r8d
cmp r8d, r9d
jb 0x1800040f0
mov ecx, 0x76a
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x990]
call fcn.180016140
mov rdx, r15
mov rcx, qword [0x180024ed8]
call fcn.180001840
test rax, rax
jne 0x180004497
mov ecx, 0x13e
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor r13d, r13d
jmp 0x18000451a
test rdx, rdx
je 0x18000412e
lea rcx, [rbp + 0x390]
mov eax, 3
nop dword [rax]
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rdx, [rdx + 0x80]
sub rax, 1
jne 0x180004190
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov rax, qword [rdx + 0x70]
mov qword [rcx + 0x70], rax
mov eax, dword [rdx + 0x78]
mov dword [rcx + 0x78], eax
movzx eax, word [rdx + 0x7c]
mov word [rcx + 0x7c], ax
xor edx, edx
lea r8d, [rdx + 0xa]
lea rcx, [rbp + 0x48f]
call fcn.18000be54
test eax, eax
je 0x180004139
lea rcx, str.Patch_CDefPolicy::Query_r_n
call fcn.180001e00
lea r9, [rbp - 0x70]
lea r8, str.DefPolicyOffset.x64
mov rdx, r15
mov rcx, qword [0x180024ed8]
call fcn.180001b80
test al, al
je 0x18000428a
mov rax, qword [rbp + 0x98]
cmp rax, r14
jbe 0x18000428c
lea rcx, str._ERROR__ValueHex_is_too_big
call fcn.180001e00
xor eax, eax
mov edi, eax
add rdi, qword [0x180024ec0]
mov rdx, r15
mov rcx, qword [0x180024ed8]
call fcn.180001840
test rax, rax
jne 0x1800042b3
mov ecx, 0x13e
jmp 0x180004133
xor r8d, r8d
mov r9d, dword [rax + 0x100]
test r9d, r9d
je 0x18000412e
mov r10, qword [rax + 0x108]
nop dword [rax]
mov eax, r8d
imul rdx, rax, 0x1fe
add rdx, r10
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x1800042e4
cmp rax, 0x11
jne 0x180004304
cmp qword [rdx], rbx
jne 0x180004304
cmp qword [rdx + 8], rsi
jne 0x180004304
cmp byte [rdx + 0x10], 0x34
je 0x180004311
inc r8d
cmp r8d, r9d
jb 0x1800042d0
jmp 0x18000412e
test rdx, rdx
je 0x18000412e
lea rcx, [rbp - 0x70]
mov eax, 3
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rdx, [rdx + 0x80]
sub rax, 1
jne 0x180004330
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov rax, qword [rdx + 0x70]
mov qword [rcx + 0x70], rax
mov eax, dword [rdx + 0x78]
mov dword [rcx + 0x78], eax
movzx eax, word [rdx + 0x7c]
mov word [rcx + 0x7c], ax
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x190]
call fcn.180016140
lea rax, [rbp - 0x70]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1800043f0
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x190]
call fcn.180016500
lea rax, [rbp + 0x8f]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180004420
lea rdx, [rbp + 0x8f]
lea rcx, [rbp + 0x28f]
call fcn.180016500
lea r9, [rbp + 0x590]
lea r8, [rbp + 0x28f]
call fcn.180001c70
test al, al
je 0x180004139
cmp rdi, qword [0x180024ec0]
jbe 0x180004139
movzx ebx, byte [rbp + 0x68f]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea r8, [rbp + 0x690]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x180004139
xor r13d, r13d
mov r8d, r13d
mov r9d, dword [rax + 0x100]
test r9d, r9d
je 0x18000450f
mov r10, qword [rax + 0x108]
movabs rbx, 0x7963696c6f504c53
movabs r11, 0x6c616e7265746e49
nop dword [rax]
nop dword [rax + rax]
mov eax, r8d
imul rdx, rax, 0x1fe
add rdx, r10
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r13b
jne 0x1800044e4
cmp rax, 0x14
jne 0x180004507
cmp qword [rdx], rbx
jne 0x180004507
cmp qword [rdx + 8], r11
jne 0x180004507
cmp dword [rdx + 0x10], 0x3436782e
je 0x180004550
inc r8d
cmp r8d, r9d
jb 0x1800044d0
mov ecx, 0x76a
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x390]
call fcn.180016140
mov rdx, r15
mov rcx, qword [0x180024ed8]
call fcn.180001840
test rax, rax
jne 0x18000471c
mov ecx, 0x13e
jmp 0x18000478a
test rdx, rdx
je 0x18000450f
lea rcx, [rbp + 0x990]
mov eax, 3
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rdx, [rdx + 0x80]
sub rax, 1
jne 0x180004561
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov rax, qword [rdx + 0x70]
mov qword [rcx + 0x70], rax
mov eax, dword [rdx + 0x78]
mov dword [rcx + 0x78], eax
movzx eax, word [rdx + 0x7c]
mov word [rcx + 0x7c], ax
xor edx, edx
lea r8d, [rdx + 0xa]
lea rcx, [rbp + 0xa8f]
call fcn.18000be54
test eax, eax
je 0x18000451a
lea rcx, str.Hook_SLGetWindowsInformationDWORDWrapper_r_n
call fcn.180001e00
mov ecx, 0x400
call fcn.180004c20
mov rdi, rax
lea r9, [rbp - 0x70]
lea r8, str.SLPolicyOffset.x64
mov rdx, r15
mov rcx, qword [0x180024ed8]
call fcn.180001b80
test al, al
je 0x180004668
mov rax, qword [rbp + 0x98]
cmp rax, r14
jbe 0x18000466b
lea rcx, str._ERROR__ValueHex_is_too_big
call fcn.180001e00
mov eax, r13d
mov ebx, eax
add rbx, qword [0x180024ec0]
mov word [rsp + 0x70], 0xb848
lea rax, [0x1800022c0]
mov qword [rsp + 0x78], rax
mov word [rbp - 0x80], 0xc350
xor edx, edx
mov r8d, 0x400
mov rcx, rdi
call fcn.180016140
lea r9, [rbp + 0x390]
lea r8, str.SLPolicyFunc.x64
mov rdx, r15
mov rcx, qword [0x180024ed8]
call fcn.180001ab0
lea rcx, str.New_Win8SL
lea r8, [rbp + 0x48f]
test al, al
cmove r8, rcx
mov edx, 0x400
mov rcx, rdi
call fcn.18000c70c
mov rcx, rdi
call fcn.180004c28
cmp rbx, qword [0x180024ec0]
jbe 0x18000451a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x18
lea r8, [rsp + 0x70]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x18000451a
mov r8d, r13d
mov r9d, dword [rax + 0x100]
test r9d, r9d
je 0x180004785
mov r10, qword [rax + 0x108]
movabs r11, 0x6f4874696e494c53
nop dword [rax]
mov eax, r8d
imul rdx, rax, 0x1fe
add rdx, r10
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x180004754
cmp rax, 0xe
jne 0x18000477d
cmp qword [rdx], r11
jne 0x18000477d
cmp dword [rdx + 8], 0x782e6b6f
jne 0x18000477d
cmp word [rdx + 0xc], 0x3436
je 0x1800048aa
inc r8d
cmp r8d, r9d
jb 0x180004740
mov ecx, 0x76a
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, r15
call fcn.180004c28
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180004808
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x40]
mov r8d, 0x15
lea rdx, str.Resumimg_threads..._r_n
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x4c], xmm0
mov qword [rsp + 0x5c], r13
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r14d, eax
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180004b06
mov dword [rsp + 0x48], 0x1c
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
mov r8d, dword [rsp + 0x50]
cmp r8d, esi
je 0x180004890
cmp dword [rsp + 0x54], r14d
jne 0x180004890
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x180004890
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x180004855
mov rcx, rdi
jmp 0x180004b00
test rdx, rdx
je 0x180004785
lea rcx, [rbp + 0x390]
mov eax, 3
nop
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rdx, [rdx + 0x80]
sub rax, 1
jne 0x1800048c0
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov rax, qword [rdx + 0x70]
mov qword [rcx + 0x70], rax
mov eax, dword [rdx + 0x78]
mov dword [rcx + 0x78], eax
movzx eax, word [rdx + 0x7c]
mov word [rcx + 0x7c], ax
xor edx, edx
lea r8d, [rdx + 0xa]
lea rcx, [rbp + 0x48f]
call fcn.18000be54
test eax, eax
je 0x180004790
lea rcx, str.Hook_CSLQuery::Initialize_r_n
call fcn.180001e00
mov ecx, 0x400
call fcn.180004c20
mov rdi, rax
lea r9, [rbp - 0x70]
lea r8, str.SLInitOffset.x64
mov rdx, r15
mov rcx, qword [0x180024ed8]
call fcn.180001b80
test al, al
je 0x1800049c7
mov rax, qword [rbp + 0x98]
cmp rax, r14
jbe 0x1800049ca
lea rcx, str._ERROR__ValueHex_is_too_big
call fcn.180001e00
mov eax, r13d
mov ebx, eax
add rbx, qword [0x180024ec0]
mov word [rsp + 0x70], 0xb848
lea r14, [0x1800023e0]
mov qword [rsp + 0x78], r14
mov word [rbp - 0x80], 0xc350
xor edx, edx
mov r8d, 0x400
mov rcx, rdi
call fcn.180016140
lea r9, [rbp + 0x990]
lea r8, str.SLInitFunc.x64
mov rdx, r15
mov rcx, qword [0x180024ed8]
call fcn.180001ab0
lea rsi, str.New_CSLQuery_Initialize
lea r8, [rbp + 0xa8f]
test al, al
cmove r8, rsi
mov edx, 0x400
mov rcx, rdi
call fcn.18000c70c
mov rdx, rsi
mov rcx, rdi
call fcn.180016060
mov rcx, qword [rsp + 0x78]
test eax, eax
cmovne rcx, r14
mov qword [rsp + 0x78], rcx
mov rcx, rdi
call fcn.180004c28
cmp rbx, qword [0x180024ec0]
jbe 0x180004790
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x18
lea r8, [rsp + 0x70]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x180004790
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180004b06
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, 0x33
lea rdx, str.Error:_Failed_to_detect_Terminal_Services_version_r_n
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xd90]
xor rcx, rsp
call fcn.180004c00
lea r11, [rsp + 0xea0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret