Function at 0x180003690
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
call fcn.18000b830
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.18000bd50
call fcn.180008120
test eax, eax
jne 0x18000384e
lea rcx, [0x18003eaf8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x1800036ed
lea rcx, [0x18003eaf8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x1800036ed
lea rcx, [0x18003eae8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, [0x18003eae8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180055a00], rax
test rax, rax
je 0x18000371c
lea rdx, [0x180004100]
lea rcx, [0x180055a00]
call fcn.18000b030
lea rcx, [0x18003eaf8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x180003753
lea rcx, [0x18003eaf8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180003753
lea rcx, [0x18003eb08]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, [0x18003eb08]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180055a08], rax
test rax, rax
je 0x180003782
lea rdx, [0x180003ec0]
lea rcx, [0x180055a08]
call fcn.18000b030
lea rcx, [0x18003eaf8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x1800037b9
lea rcx, [0x18003eaf8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x1800037b9
lea rcx, str.CreateProcessAsUserW
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, str.CreateProcessAsUserW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180055a18], rax
test rax, rax
je 0x1800037e8
lea rdx, [0x180003f90]
lea rcx, [0x180055a18]
call fcn.18000b030
lea rcx, [0x18003eaf8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x18000381f
lea rcx, [0x18003eaf8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x18000381f
lea rcx, str.CreateProcessAsUserA
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, str.CreateProcessAsUserA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180055a10], rax
test rax, rax
je 0x18000384e
lea rdx, [0x180003f30]
lea rcx, [0x180055a10]
call fcn.18000b030
lea rcx, str.User32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x180003885
lea rcx, str.User32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180003885
lea rcx, str.SetWindowsHookExW
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, str.SetWindowsHookExW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180055990], rax
test rax, rax
je 0x1800038b4
lea rdx, [0x180004440]
lea rcx, [0x180055990]
call fcn.18000b030
lea rcx, str.User32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x1800038eb
lea rcx, str.User32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x1800038eb
lea rcx, str.SetWindowsHookExA
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, str.SetWindowsHookExA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180055988], rax
test rax, rax
je 0x18000391a
lea rdx, [0x180004350]
lea rcx, [0x180055988]
call fcn.18000b030
lea rcx, str.User32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x180003951
lea rcx, str.User32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180003951
lea rcx, str.SetWindowDisplayAffinity
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, str.SetWindowDisplayAffinity
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180055998], rax
test rax, rax
je 0x180003980
lea rdx, [0x180004320]
lea rcx, [0x180055998]
call fcn.18000b030
lea rcx, str.User32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x1800039b7
lea rcx, str.User32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x1800039b7
lea rcx, str.GetWindowDisplayAffinity
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, str.GetWindowDisplayAffinity
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800559a0], rax
test rax, rax
je 0x1800039e6
lea rdx, [0x180004210]
lea rcx, [0x1800559a0]
call fcn.18000b030
lea rcx, str.OleAut32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x180003a1d
lea rcx, str.OleAut32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180003a1d
lea rcx, str.SysAllocString
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, str.SysAllocString
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800559d0], rax
test rax, rax
je 0x180003a4c
lea rdx, [0x180004560]
lea rcx, [0x1800559d0]
call fcn.18000b030
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x180003a83
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180003a83
lea rcx, str.NtQuerySystemInformation
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, str.NtQuerySystemInformation
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180055980], rax
test rax, rax
je 0x180003ab2
lea rdx, [0x180004220]
lea rcx, [0x180055980]
call fcn.18000b030
lea rcx, [0x18003eaf8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x180003ae9
lea rcx, [0x18003eaf8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180003ae9
lea rcx, str.Process32Next
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, str.Process32Next
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180055958], rax
test rax, rax
je 0x180003b18
lea rdx, [0x180004970]
lea rcx, [0x180055958]
call fcn.18000b030
lea rcx, [0x18003eaf8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x180003b4f
lea rcx, [0x18003eaf8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180003b4f
lea rcx, str.Process32NextW
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, str.Process32NextW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180055970], rax
test rax, rax
je 0x180003b7e
lea rdx, [0x180004ac0]
lea rcx, [0x180055970]
call fcn.18000b030
lea rcx, [0x18003eaf8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x180003bb5
lea rcx, [0x18003eaf8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180003bb5
lea rcx, str.QueryFullProcessImageNameA
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, str.QueryFullProcessImageNameA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800559c0], rax
test rax, rax
je 0x180003be4
lea rdx, [0x180004b90]
lea rcx, [0x1800559c0]
call fcn.18000b030
lea rcx, [0x18003eaf8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x180003c1b
lea rcx, [0x18003eaf8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180003c1b
lea rcx, str.QueryFullProcessImageNameW
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, str.QueryFullProcessImageNameW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800559c8], rax
test rax, rax
je 0x180003c4a
lea rdx, [0x180004be0]
lea rcx, [0x1800559c8]
call fcn.18000b030
lea rcx, str.User32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x180003c81
lea rcx, str.User32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180003c81
lea rcx, str.CreateDesktopW
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, str.CreateDesktopW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800559d8], rax
test rax, rax
je 0x180003cb0
lea rdx, [0x180003e60]
lea rcx, [0x1800559d8]
call fcn.18000b030
lea rcx, str.Ws2_32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x180003ce7
lea rcx, str.Ws2_32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180003ce7
lea rcx, str.GetNameInfoW
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, str.GetNameInfoW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180055960], rax
test rax, rax
je 0x180003d16
lea rdx, [0x180004870]
lea rcx, [0x180055960]
call fcn.18000b030
lea rcx, str.Fwpuclnt.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x180003d4d
lea rcx, str.Fwpuclnt.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180003d4d
lea rcx, str.FwpmFilterAdd0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, str.FwpmFilterAdd0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800559b0], rax
test rax, rax
je 0x180003d7c
lea rdx, [0x1800041f0]
lea rcx, [0x1800559b0]
call fcn.18000b030
lea rcx, [0x18003eaf8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x180003db3
lea rcx, [0x18003eaf8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180003db3
lea rcx, str.FindNextFileA
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, str.FindNextFileA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180055978], rax
test rax, rax
je 0x180003de2
lea rdx, [0x180004170]
lea rcx, [0x180055978]
call fcn.18000b030
lea rcx, [0x18003eaf8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x180003e19
lea rcx, [0x18003eaf8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180003e19
lea rcx, str.K32EnumProcessModules
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, str.K32EnumProcessModules
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800559e8], rax
test rax, rax
je 0x180003e48
lea rdx, [0x1800045c0]
lea rcx, [0x1800559e8]
call fcn.18000b030
add rsp, 0x20
pop rbx
jmp 0x18000b8a0
sub rsp, 0x28
xor ecx, ecx
call fcn.18000b8b0
add rsp, 0x28
ret