Function at 0x180002a00
Capabilities:
Enumerate threads
Extract resource via kernel32 functions
Get file size
Link many functions at runtime
Read file on windows
Resume thread
Suspend thread
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xda0]
sub rsp, 0xea0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xd90], rax
mov byte [0x180023ea0], 1
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0xb90]
call fcn.180015c90
lea rcx, str.Loading_configuration..._r_n
call fcn.180001e50
xor r14d, r14d
mov qword [rsp + 0x48], r14
lea r8, [rsp + 0x48]
lea rdx, [0x180001f10]
lea ecx, [r14 + 4]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov esi, 0xff
mov r8d, esi
lea rdx, [rbp + 0xb90]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, [rbp + 0xb90]
mov r13, 0xffffffffffffffff
mov rdx, r13
nop dword [rax + rax]
inc rdx
cmp word [rax + rdx*2], r14w
jne 0x180002ab0
test edx, edx
je 0x180002b1f
mov eax, edx
lea rcx, [rbp + 0xb90]
lea rcx, [rcx + rax*2]
nop dword [rax + rax]
cmp word [rcx], 0x5c
je 0x180002ae1
sub rcx, 2
add edx, 0xffffffff
jne 0x180002ad0
jmp 0x180002b1f
lea eax, [rdx + 1]
lea rbx, [rbp + 0xb90]
lea rbx, [rbx + rax*2]
mov eax, esi
sub eax, edx
lea r8d, [rax + rax]
xor edx, edx
mov rcx, rbx
call fcn.180015c90
movups xmm0, xmmword [str.rdpwrap.ini]
movups xmmword [rbx], xmm0
mov eax, dword [0x18001ed38]
mov dword [rbx + 0x10], eax
movzx eax, word [0x18001ed3c]
mov word [rbx + 0x14], ax
mov ecx, 0x400
call fcn.180004b10
mov rbx, rax
lea r8, [rbp + 0xb90]
lea rdx, str.Configuration_file:__S_r_n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov rcx, rbx
call fcn.180001e50
mov rcx, rbx
call fcn.180004b18
mov ecx, 0x30
call fcn.180004b20
mov rbx, rax
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov dword [rsp + 0x48], r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 3]
lea rcx, [rbp + 0xb90]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180002c89
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rbx], eax
cmp eax, 0xffffffff
je 0x180002c89
mov ecx, eax
call fcn.180004b10
mov qword [rbx + 8], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x48]
mov r8d, dword [rbx]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180002c89
mov ecx, 1
mov edx, dword [rbx]
test edx, edx
je 0x180002c1a
mov rax, qword [rbx + 8]
cmp byte [rax], 0xd
jne 0x180002c11
cmp byte [rax + 1], 0xa
jne 0x180002c11
inc ecx
inc rax
sub rdx, 1
jne 0x180002c04
mov dword [rbx + 0x10], ecx
mov eax, 4
mul rcx
cmovo rax, r13
mov rcx, rax
call fcn.180004b10
mov qword [rbx + 0x18], rax
mov dword [rax], r14d
mov r8d, 1
mov edx, r14d
cmp dword [rbx], r14d
jbe 0x180002c80
nop word [rax + rax]
mov r9, qword [rbx + 8]
mov eax, edx
cmp byte [rax + r9], 0xd
jne 0x180002c7a
lea r10d, [rdx + 2]
lea eax, [r10 - 1]
cmp byte [rax + r9], 0xa
jne 0x180002c7a
mov ecx, r8d
mov rax, qword [rbx + 0x18]
mov dword [rax + rcx*4], r10d
inc r8d
inc edx
cmp edx, dword [rbx]
jb 0x180002c50
mov rcx, rbx
call fcn.1800010e0
nop
mov qword [0x180023ed8], rbx
mov edx, r14d
mov r9d, dword [rbx + 0x20]
test r9d, r9d
je 0x180002cd2
mov r10, qword [rbx + 0x28]
mov eax, edx
imul r8, rax, 0x110
lea rcx, [r8 + r10]
mov rax, r13
inc rax
cmp byte [rcx + rax], 0
jne 0x180002cb0
cmp rax, 4
jne 0x180002ccb
cmp dword [rcx], 0x6e69614d
je 0x180002d48
inc edx
cmp edx, r9d
jb 0x180002ca0
mov ecx, 0x13e
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsp + 0x48], r14
lea r8, [rsp + 0x48]
lea rdx, [0x180001f10]
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov r8d, esi
lea r12, str._rdpwrap.txt
mov rdx, r12
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rdx, r13
inc rdx
cmp word [r12 + rdx*2], 0
jne 0x180002d14
test edx, edx
je 0x180002f5e
mov eax, edx
lea rcx, [r12 + rax*2]
nop dword [rax]
cmp word [rcx], 0x5c
je 0x180002f29
sub rcx, 2
add edx, 0xffffffff
jne 0x180002d30
jmp 0x180002f5e
mov rcx, r10
add rcx, r8
je 0x180002cd2
mov r8d, r14d
mov r9d, dword [rcx + 0x100]
test r9d, r9d
je 0x180002dad
mov r10, qword [rcx + 0x108]
nop word [rax + rax]
mov eax, r8d
imul rdx, rax, 0x1fe
add rdx, r10
mov rax, r13
inc rax
cmp byte [rdx + rax], 0
jne 0x180002d80
cmp rax, 7
jne 0x180002da5
cmp dword [rdx], 0x46676f4c
jne 0x180002da5
cmp word [rdx + 4], 0x6c69
jne 0x180002da5
cmp byte [rdx + 6], 0x65
je 0x180002db7
inc r8d
cmp r8d, r9d
jb 0x180002d70
mov ecx, 0x76a
jmp 0x180002cd7
test rdx, rdx
je 0x180002dad
lea rcx, [rbp + 0x190]
mov eax, 3
nop dword [rax + rax]
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rdx, [rdx + 0x80]
sub rax, 1
jne 0x180002dd0
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov rax, qword [rdx + 0x70]
mov qword [rcx + 0x70], rax
mov eax, dword [rdx + 0x78]
mov dword [rcx + 0x78], eax
movzx eax, word [rdx + 0x7c]
mov word [rcx + 0x7c], ax
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x790]
call fcn.180015c90
lea rax, [rbp + 0x190]
mov r8, r13
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180002e90
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x790]
call fcn.180016050
lea rax, [rbp + 0x28f]
mov r8, r13
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180002ec0
lea rdx, [rbp + 0x28f]
lea rcx, [rbp + 0x88f]
call fcn.180016050
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x990]
call fcn.180015c90
mov r8, rsi
lea rdx, [rbp + 0x88f]
lea rcx, [rbp + 0x990]
call fcn.18000c410
mov rcx, r14
lea r12, str._rdpwrap.txt
movzx eax, word [rbp + rcx + 0x990]
mov word [rcx + r12], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x180002f11
jmp 0x180002f5e
lea eax, [rdx + 1]
lea rbx, [r12 + rax*2]
sub esi, edx
lea r8d, [rsi + rsi]
xor edx, edx
mov rcx, rbx
call fcn.180015c90
movups xmm0, xmmword [str.rdpwrap.txt]
movups xmmword [rbx], xmm0
mov eax, dword [0x18001ed70]
mov dword [rbx + 0x10], eax
movzx eax, word [0x18001ed74]
mov word [rbx + 0x14], ax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180002fce
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x48]
mov r8d, 0x1d
lea rdx, str.Initializing_RDP_Wrapper..._r_n
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.termsrv.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x180023ed0], rax
test rax, rax
jne 0x180003044
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [rax + 3]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800049ff
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, 0x31
lea rdx, str.Error:_Failed_to_load_Terminal_Services_library_r_n
jmp 0x1800049e3
lea rdx, [0x18001ede8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180023eb0], rax
lea rdx, [0x18001edf8]
mov rcx, qword [0x180023ed0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180023ea8], rax
mov ecx, 0x1000
call fcn.180004b10
mov rbx, rax
mov rcx, qword [0x180023ea8]
mov r8, qword [0x180023ed0]
sub rcx, r8
mov r9, qword [0x180023eb0]
sub r9, r8
mov qword [rsp + 0x20], rcx
lea rdx, str.Base_addr:__0x_p_r_nSvcMain:____termsrv.dll0x_p_r_nSvcGlobals:_termsrv.dll0x_p_r_n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov rcx, rbx
call fcn.180001e50
mov rcx, rbx
call fcn.180004b18
lea rcx, str.termsrv.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x18000498f
mov edx, 1
lea r8d, [rdx + 0xf]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x18000498f
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x18000498f
mov edx, dword [rax + 0x30]
mov dword [0x180023eb8], edx
movzx ecx, word [rax + 0x36]
mov word [0x180023ebc], cx
movzx eax, word [rax + 0x34]
mov word [0x180023ebe], ax
mov eax, edx
shr eax, 0x10
movzx r15d, al
shl r15w, 8
movzx eax, dl
or r15w, ax
je 0x18000498f
mov ecx, 0x400
call fcn.180004b10
mov rbx, rax
movzx ecx, word [0x180023ebe]
movzx edx, word [0x180023ebc]
movzx r9d, word [0x180023eb8]
movzx r8d, word [0x180023eba]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea rdx, str.Version:_____d._d._d._d_r_n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov rcx, rbx
call fcn.180001e50
mov rcx, rbx
call fcn.180004b18
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180003209
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x48]
mov r8d, 0x15
lea rdx, str.Freezing_threads..._r_n
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r14d, eax
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180003296
mov dword [rsp + 0x50], 0x1c
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
mov r8d, dword [rsp + 0x58]
cmp r8d, esi
je 0x18000327b
cmp dword [rsp + 0x5c], r14d
jne 0x18000327b
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18000327b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x180003244
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [0x180023ed8]
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x190]
call fcn.180015c90
xor edx, edx
mov r9d, dword [rbx + 0x20]
movabs rsi, 0x7963696c6f504c53
test r9d, r9d
je 0x180003302
mov r10, qword [rbx + 0x28]
nop word [rax + rax]
mov eax, edx
imul r8, rax, 0x110
lea rcx, [r8 + r10]
mov rax, r13
inc rax
cmp byte [rcx + rax], 0
jne 0x1800032e0
cmp rax, 4
jne 0x1800032fb
cmp dword [rcx], 0x6e69614d
je 0x18000351f
inc edx
cmp edx, r9d
jb 0x1800032d0
mov ecx, 0x13e
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, 1
mov ecx, 0x600
lea rdi, [0x1800021a0]
cmp r15w, cx
jne 0x1800033dd
test al, al
je 0x1800033dd
lea rcx, str.slc.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x180023ec8], rax
lea rdx, str.SLGetWindowsInformationDWORD
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180023ee0], rax
cmp rax, 0xffffffffffffffff
je 0x1800033dd
lea rcx, str.Hook_SLGetWindowsInformationDWORD_r_n
call fcn.180001e50
mov word [0x180023ee8], 0xb848
mov qword [0x180023ef0], rdi
mov word [0x180023ef8], 0xc350
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x18
lea r8, [0x180023f00]
mov rdx, qword [0x180023ee0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x18
lea r8, [0x180023ee8]
mov rdx, qword [0x180023ee0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rbx, qword [0x180023ed8]
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp - 0x70]
call fcn.180015c90
xor edx, edx
mov r9d, dword [rbx + 0x20]
test r9d, r9d
je 0x180003442
mov r10, qword [rbx + 0x28]
nop dword [rax]
nop dword [rax + rax]
mov eax, edx
imul r8, rax, 0x110
lea rcx, [r8 + r10]
mov rax, r13
inc rax
cmp byte [rcx + rax], 0
jne 0x180003420
cmp rax, 4
jne 0x18000343b
cmp dword [rcx], 0x6e69614d
je 0x18000365a
inc edx
cmp edx, r9d
jb 0x180003410
mov ecx, 0x13e
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, 1
mov ecx, 0x601
cmp r15w, cx
jne 0x18000379a
test al, al
je 0x1800037d0
lea rcx, str.slc.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x180023ec8], rax
lea rdx, str.SLGetWindowsInformationDWORD
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180023ee0], rax
cmp rax, 0xffffffffffffffff
je 0x1800037d0
lea rcx, str.Hook_SLGetWindowsInformationDWORD_r_n
call fcn.180001e50
mov word [0x180023ee8], 0xb848
mov qword [0x180023ef0], rdi
mov word [0x180023ef8], 0xc350
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x18
lea r8, [0x180023f00]
mov rdx, qword [0x180023ee0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x18
lea r8, [0x180023ee8]
mov rdx, qword [0x180023ee0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x1800037d0
mov rcx, r10
add rcx, r8
je 0x180003302
xor r8d, r8d
mov r9d, dword [rcx + 0x100]
test r9d, r9d
je 0x180003582
mov r10, qword [rcx + 0x108]
movabs r11, 0x3036544e6b6f6f48
nop dword [rax + rax]
mov eax, r8d
imul rdx, rax, 0x1fe
add rdx, r10
mov rax, r13
inc rax
cmp byte [rdx + rax], 0
jne 0x180003560
cmp rax, 0x10
jne 0x18000357a
cmp qword [rdx], rsi
jne 0x18000357a
cmp qword [rdx + 8], r11
je 0x18000358c
inc r8d
cmp r8d, r9d
jb 0x180003550
mov ecx, 0x76a
jmp 0x180003307
test rdx, rdx
je 0x180003582
lea rcx, [rbp + 0x190]
mov eax, 3
nop dword [rax]
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rdx, [rdx + 0x80]
sub rax, 1
jne 0x1800035a0
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov rax, qword [rdx + 0x70]
mov qword [rcx + 0x70], rax
mov eax, dword [rdx + 0x78]
mov dword [rcx + 0x78], eax
movzx eax, word [rdx + 0x7c]
mov word [rcx + 0x7c], ax
xor edx, edx
lea r8d, [rdx + 0xa]
lea rcx, [rbp + 0x28f]
call fcn.18000bd24
test eax, eax
setne al
jmp 0x18000330f
mov rcx, r10
add rcx, r8
je 0x180003442
xor r8d, r8d
mov r9d, dword [rcx + 0x100]
test r9d, r9d
je 0x1800036c2
mov r10, qword [rcx + 0x108]
movabs r11, 0x3136544e6b6f6f48
nop word [rax + rax]
mov eax, r8d
imul rdx, rax, 0x1fe
add rdx, r10
mov rax, r13
inc rax
cmp byte [rdx + rax], 0
jne 0x1800036a0
cmp rax, 0x10
jne 0x1800036ba
cmp qword [rdx], rsi
jne 0x1800036ba
cmp qword [rdx + 8], r11
je 0x1800036cc
inc r8d
cmp r8d, r9d
jb 0x180003690
mov ecx, 0x76a
jmp 0x180003447
test rdx, rdx
je 0x1800036c2
lea rcx, [rbp - 0x70]
mov eax, 3
nop word [rax + rax]
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rdx, [rdx + 0x80]
sub rax, 1
jne 0x1800036e0
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov rax, qword [rdx + 0x70]
mov qword [rcx + 0x70], rax
mov eax, dword [rdx + 0x78]
mov dword [rcx + 0x78], eax
movzx eax, word [rdx + 0x7c]
mov word [rcx + 0x7c], ax
xor edx, edx
lea r8d, [rdx + 0xa]
lea rcx, [rbp + 0x8f]
call fcn.18000bd24
test eax, eax
setne al
jmp 0x18000344f
mov eax, 0x602
cmp r15w, ax
jne 0x1800037d0
lea rcx, str.slc.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x180023ec8], rax
lea rdx, str.SLGetWindowsInformationDWORD
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180023ee0], rax
mov ecx, 0x100
call fcn.180004b10
mov r15, rax
xor edx, edx
mov r8d, 0x100
mov rcx, rax
call fcn.180015c90
movzx ecx, word [0x180023ebe]
movzx edx, word [0x180023ebc]
movzx r9d, word [0x180023eb8]
movzx r8d, word [0x180023eba]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea rdx, str._d._d._d._d
mov rcx, r15
call qword [sym.imp.USER32.dll_wsprintfA]
mov rdx, r15
mov rbx, qword [0x180023ed8]
mov rcx, rbx
call fcn.180001630
test rax, rax
je 0x1800046a0
mov rcx, qword [0x180023ed0]
test rcx, rcx
je 0x1800046a0
movsxd rax, dword [rcx + 0x3c]
mov qword [0x180023ec0], rcx
cmp dword [rax + rcx + 0x1c], 0
jbe 0x1800046a0
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x390]
call fcn.180015c90
mov rdx, r15
mov rcx, rbx
call fcn.180001630
movabs rsi, 0x36782e65646f4379
movabs r13, 0x782e686374615079
test rax, rax
jne 0x1800038a3
mov ecx, 0x13e
jmp 0x180003906
xor r8d, r8d
mov r9d, dword [rax + 0x100]
test r9d, r9d
je 0x180003901
mov r10, qword [rax + 0x108]
movabs rbx, 0x6c6e4f6c61636f4c
mov eax, r8d
imul rdx, rax, 0x1fe
add rdx, r10
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x1800038d7
cmp rax, 0x12
jne 0x1800038f9
cmp qword [rdx], rbx
jne 0x1800038f9
cmp qword [rdx + 8], r13
jne 0x1800038f9
cmp word [rdx + 0x10], 0x3436
je 0x180003948
inc r8d
cmp r8d, r9d
jb 0x1800038c3
mov ecx, 0x76a
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x990]
call fcn.180015c90
mov rdx, r15
mov rcx, qword [0x180023ed8]
call fcn.180001630
test rax, rax
jne 0x180003c57
mov ecx, 0x13e
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x180003cc3
test rdx, rdx
je 0x180003901
lea rcx, [rbp + 0x390]
mov eax, 3
nop dword [rax]
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rdx, [rdx + 0x80]
sub rax, 1
jne 0x180003960
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov rax, qword [rdx + 0x70]
mov qword [rcx + 0x70], rax
mov eax, dword [rdx + 0x78]
mov dword [rcx + 0x78], eax
movzx eax, word [rdx + 0x7c]
mov word [rcx + 0x7c], ax
xor edx, edx
lea r8d, [rdx + 0xa]
lea rcx, [rbp + 0x48f]
call fcn.18000bd24
test eax, eax
je 0x18000390c
lea rcx, str.Patch_CEnforcementCore::GetInstanceOfTSLicense_r_n
call fcn.180001e50
lea r9, [rbp - 0x70]
lea r8, str.LocalOnlyOffset.x64
mov rdx, r15
mov rcx, qword [0x180023ed8]
call fcn.180001970
xor ecx, ecx
test al, al
cmovne ecx, dword [rbp + 0x98]
mov edi, ecx
add rdi, qword [0x180023ec0]
mov rdx, r15
mov rcx, qword [0x180023ed8]
call fcn.180001630
test rax, rax
jne 0x180003a70
mov ecx, 0x13e
jmp 0x180003906
xor r8d, r8d
mov r9d, dword [rax + 0x100]
test r9d, r9d
je 0x180003901
mov r10, qword [rax + 0x108]
nop word [rax + rax]
mov eax, r8d
imul rdx, rax, 0x1fe
add rdx, r10
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x180003aa4
cmp rax, 0x11
jne 0x180003ac4
cmp qword [rdx], rbx
jne 0x180003ac4
cmp qword [rdx + 8], rsi
jne 0x180003ac4
cmp byte [rdx + 0x10], 0x34
je 0x180003ad1
inc r8d
cmp r8d, r9d
jb 0x180003a90
jmp 0x180003901
test rdx, rdx
je 0x180003901
lea rcx, [rbp - 0x70]
mov eax, 3
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rdx, [rdx + 0x80]
sub rax, 1
jne 0x180003af0
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov rax, qword [rdx + 0x70]
mov qword [rcx + 0x70], rax
mov eax, dword [rdx + 0x78]
mov dword [rcx + 0x78], eax
movzx eax, word [rdx + 0x7c]
mov word [rcx + 0x7c], ax
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x190]
call fcn.180015c90
lea rax, [rbp - 0x70]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180003bb0
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x190]
call fcn.180016050
lea rax, [rbp + 0x8f]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180003be0
lea rdx, [rbp + 0x8f]
lea rcx, [rbp + 0x28f]
call fcn.180016050
lea r9, [rbp + 0x590]
lea r8, [rbp + 0x28f]
call fcn.180001a60
test al, al
je 0x18000390c
cmp rdi, qword [0x180023ec0]
jbe 0x18000390c
movzx ebx, byte [rbp + 0x68f]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea r8, [rbp + 0x690]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x18000390c
xor edi, edi
mov esi, dword [rax + 0x100]
test esi, esi
je 0x180003cae
mov r14, qword [rax + 0x108]
nop word [rax + rax]
mov eax, edi
imul rbx, rax, 0x1fe
add rbx, r14
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], 0
jne 0x180003c83
cmp rax, 0x13
jne 0x180003ca8
mov r8, rax
lea rdx, str.SingleUserPatch.x64
mov rcx, rbx
call fcn.1800166d0
test eax, eax
je 0x180003cf9
inc edi
cmp edi, esi
jb 0x180003c70
mov ecx, 0x76a
call qword [sym.imp.KERNEL32.dll_SetLastError]
movabs rsi, 0x36782e65646f4379
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x390]
call fcn.180015c90
mov rdx, r15
mov rcx, qword [0x180023ed8]
call fcn.180001630
test rax, rax
jne 0x180004017
mov ecx, 0x13e
jmp 0x180004083
test rbx, rbx
je 0x180003cae
lea rcx, [rbp + 0x990]
mov eax, 3
nop word [rax + rax]
movups xmm0, xmmword [rbx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rbx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rbx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rbx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rbx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rbx, [rbx + 0x80]
sub rax, 1
jne 0x180003d10
movups xmm0, xmmword [rbx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rbx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rbx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rbx + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov rax, qword [rbx + 0x70]
mov qword [rcx + 0x70], rax
mov eax, dword [rbx + 0x78]
mov dword [rcx + 0x78], eax
movzx eax, word [rbx + 0x7c]
mov word [rcx + 0x7c], ax
xor edx, edx
lea r8d, [rdx + 0xa]
lea rcx, [rbp + 0xa8f]
call fcn.18000bd24
test eax, eax
je 0x180003cb9
lea rcx, str.Patch_CSessionArbitrationHelper::IsSingleSessionPerUserEnabled_r_n
call fcn.180001e50
lea r9, [rbp - 0x70]
lea r8, str.SingleUserOffset.x64
mov rdx, r15
mov rcx, qword [0x180023ed8]
call fcn.180001970
xor ecx, ecx
test al, al
cmovne ecx, dword [rbp + 0x98]
mov edi, ecx
add rdi, qword [0x180023ec0]
mov rdx, r15
mov rcx, qword [0x180023ed8]
call fcn.180001630
test rax, rax
jne 0x180003e20
mov ecx, 0x13e
jmp 0x180003cb3
xor r8d, r8d
mov r9d, dword [rax + 0x100]
test r9d, r9d
je 0x180003cae
mov r10, qword [rax + 0x108]
movabs rbx, 0x782e65646f437265
movabs r11, 0x7355656c676e6953
nop
mov eax, r8d
imul rdx, rax, 0x1fe
add rdx, r10
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x180003e64
cmp rax, 0x12
jne 0x180003e86
cmp qword [rdx], r11
jne 0x180003e86
cmp qword [rdx + 8], rbx
jne 0x180003e86
cmp word [rdx + 0x10], 0x3436
je 0x180003e93
inc r8d
cmp r8d, r9d
jb 0x180003e50
jmp 0x180003cae
test rdx, rdx
je 0x180003cae
lea rcx, [rbp - 0x70]
mov eax, 3
nop word [rax + rax]
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rdx, [rdx + 0x80]
sub rax, 1
jne 0x180003eb0
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov rax, qword [rdx + 0x70]
mov qword [rcx + 0x70], rax
mov eax, dword [rdx + 0x78]
mov dword [rcx + 0x78], eax
movzx eax, word [rdx + 0x7c]
mov word [rcx + 0x7c], ax
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x190]
call fcn.180015c90
lea rax, [rbp - 0x70]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180003f70
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x190]
call fcn.180016050
lea rax, [rbp + 0x8f]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180003fa0
lea rdx, [rbp + 0x8f]
lea rcx, [rbp + 0x28f]
call fcn.180016050
lea r9, [rbp + 0x590]
lea r8, [rbp + 0x28f]
call fcn.180001a60
test al, al
je 0x180003cb9
cmp rdi, qword [0x180023ec0]
jbe 0x180003cb9
movzx ebx, byte [rbp + 0x68f]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea r8, [rbp + 0x690]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x180003cb9
xor r8d, r8d
mov r9d, dword [rax + 0x100]
test r9d, r9d
je 0x18000407e
mov r10, qword [rax + 0x108]
movabs rbx, 0x63696c6f50666544
nop word [rax + rax]
mov eax, r8d
imul rdx, rax, 0x1fe
add rdx, r10
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x180004054
cmp rax, 0x12
jne 0x180004076
cmp qword [rdx], rbx
jne 0x180004076
cmp qword [rdx + 8], r13
jne 0x180004076
cmp word [rdx + 0x10], 0x3436
je 0x1800040bf
inc r8d
cmp r8d, r9d
jb 0x180004040
mov ecx, 0x76a
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x990]
call fcn.180015c90
mov rdx, r15
mov rcx, qword [0x180023ed8]
call fcn.180001630
test rax, rax
jne 0x1800043c7
mov ecx, 0x13e
jmp 0x180004435
test rdx, rdx
je 0x18000407e
lea rcx, [rbp + 0x390]
mov eax, 3
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rdx, [rdx + 0x80]
sub rax, 1
jne 0x1800040d0
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov rax, qword [rdx + 0x70]
mov qword [rcx + 0x70], rax
mov eax, dword [rdx + 0x78]
mov dword [rcx + 0x78], eax
movzx eax, word [rdx + 0x7c]
mov word [rcx + 0x7c], ax
xor edx, edx
lea r8d, [rdx + 0xa]
lea rcx, [rbp + 0x48f]
call fcn.18000bd24
test eax, eax
je 0x180004089
lea rcx, str.Patch_CDefPolicy::Query_r_n
call fcn.180001e50
lea r9, [rbp - 0x70]
lea r8, str.DefPolicyOffset.x64
mov rdx, r15
mov rcx, qword [0x180023ed8]
call fcn.180001970
xor ecx, ecx
test al, al
cmovne ecx, dword [rbp + 0x98]
mov edi, ecx
add rdi, qword [0x180023ec0]
mov rdx, r15
mov rcx, qword [0x180023ed8]
call fcn.180001630
test rax, rax
jne 0x1800041e0
mov ecx, 0x13e
jmp 0x180004083
xor r8d, r8d
mov r9d, dword [rax + 0x100]
test r9d, r9d
je 0x18000407e
mov r10, qword [rax + 0x108]
nop word [rax + rax]
mov eax, r8d
imul rdx, rax, 0x1fe
add rdx, r10
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x180004214
cmp rax, 0x11
jne 0x180004234
cmp qword [rdx], rbx
jne 0x180004234
cmp qword [rdx + 8], rsi
jne 0x180004234
cmp byte [rdx + 0x10], 0x34
je 0x180004241
inc r8d
cmp r8d, r9d
jb 0x180004200
jmp 0x18000407e
test rdx, rdx
je 0x18000407e
lea rcx, [rbp - 0x70]
mov eax, 3
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rdx, [rdx + 0x80]
sub rax, 1
jne 0x180004260
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov rax, qword [rdx + 0x70]
mov qword [rcx + 0x70], rax
mov eax, dword [rdx + 0x78]
mov dword [rcx + 0x78], eax
movzx eax, word [rdx + 0x7c]
mov word [rcx + 0x7c], ax
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x190]
call fcn.180015c90
lea rax, [rbp - 0x70]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180004320
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x190]
call fcn.180016050
lea rax, [rbp + 0x8f]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180004350
lea rdx, [rbp + 0x8f]
lea rcx, [rbp + 0x28f]
call fcn.180016050
lea r9, [rbp + 0x590]
lea r8, [rbp + 0x28f]
call fcn.180001a60
test al, al
je 0x180004089
cmp rdi, qword [0x180023ec0]
jbe 0x180004089
movzx ebx, byte [rbp + 0x68f]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea r8, [rbp + 0x690]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x180004089
xor r8d, r8d
mov r9d, dword [rax + 0x100]
test r9d, r9d
je 0x180004430
mov r10, qword [rax + 0x108]
movabs rbx, 0x7963696c6f504c53
movabs r11, 0x6c616e7265746e49
mov eax, r8d
imul rdx, rax, 0x1fe
add rdx, r10
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x180004405
cmp rax, 0x14
jne 0x180004428
cmp qword [rdx], rbx
jne 0x180004428
cmp qword [rdx + 8], r11
jne 0x180004428
cmp dword [rdx + 0x10], 0x3436782e
je 0x180004471
inc r8d
cmp r8d, r9d
jb 0x1800043f1
mov ecx, 0x76a
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x390]
call fcn.180015c90
mov rdx, r15
mov rcx, qword [0x180023ed8]
call fcn.180001630
test rax, rax
jne 0x180004628
mov ecx, 0x13e
jmp 0x18000469a
test rdx, rdx
je 0x180004430
lea rcx, [rbp + 0x990]
mov eax, 3
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rdx, [rdx + 0x80]
sub rax, 1
jne 0x180004482
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov rax, qword [rdx + 0x70]
mov qword [rcx + 0x70], rax
mov eax, dword [rdx + 0x78]
mov dword [rcx + 0x78], eax
movzx eax, word [rdx + 0x7c]
mov word [rcx + 0x7c], ax
xor edx, edx
lea r8d, [rdx + 0xa]
lea rcx, [rbp + 0xa8f]
call fcn.18000bd24
test eax, eax
je 0x18000443b
lea rcx, str.Hook_SLGetWindowsInformationDWORDWrapper_r_n
call fcn.180001e50
mov ecx, 0x400
call fcn.180004b10
mov rbx, rax
lea r9, [rbp - 0x70]
lea r8, str.SLPolicyOffset.x64
mov rdx, r15
mov rcx, qword [0x180023ed8]
call fcn.180001970
xor ecx, ecx
test al, al
cmovne ecx, dword [rbp + 0x98]
mov edi, ecx
add rdi, qword [0x180023ec0]
mov word [rsp + 0x78], 0xb848
lea rax, [0x180002310]
mov qword [rbp - 0x80], rax
mov word [rbp - 0x78], 0xc350
xor edx, edx
mov r8d, 0x400
mov rcx, rbx
call fcn.180015c90
lea r9, [rbp + 0x390]
lea r8, str.SLPolicyFunc.x64
mov rdx, r15
mov rcx, qword [0x180023ed8]
call fcn.1800018a0
lea rcx, str.New_Win8SL
lea r8, [rbp + 0x48f]
test al, al
cmove r8, rcx
mov edx, 0x400
mov rcx, rbx
call fcn.18000c1b4
mov rcx, rbx
call fcn.180004b18
cmp rdi, qword [0x180023ec0]
jbe 0x18000443b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x18
lea r8, [rsp + 0x78]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x18000443b
xor r8d, r8d
mov r9d, dword [rax + 0x100]
test r9d, r9d
je 0x180004695
mov r10, qword [rax + 0x108]
movabs r11, 0x6f4874696e494c53
nop dword [rax + rax]
mov eax, r8d
imul rdx, rax, 0x1fe
add rdx, r10
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x180004664
cmp rax, 0xe
jne 0x18000468d
cmp qword [rdx], r11
jne 0x18000468d
cmp dword [rdx + 8], 0x782e6b6f
jne 0x18000468d
cmp word [rdx + 0xc], 0x3436
je 0x1800047b1
inc r8d
cmp r8d, r9d
jb 0x180004650
mov ecx, 0x76a
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, r15
call fcn.180004b18
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180004720
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, 0x15
lea rdx, str.Resumimg_threads..._r_n
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r14d, eax
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1800049ff
mov dword [rsp + 0x50], 0x1c
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
nop
mov r8d, dword [rsp + 0x58]
cmp r8d, esi
je 0x180004797
cmp dword [rsp + 0x5c], r14d
jne 0x180004797
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180004797
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x180004760
mov rcx, rdi
jmp 0x1800049f9
test rdx, rdx
je 0x180004695
lea rcx, [rbp + 0x390]
mov eax, 3
nop word [rax + rax]
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rdx, [rdx + 0x80]
sub rax, 1
jne 0x1800047d0
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov rax, qword [rdx + 0x70]
mov qword [rcx + 0x70], rax
mov eax, dword [rdx + 0x78]
mov dword [rcx + 0x78], eax
movzx eax, word [rdx + 0x7c]
mov word [rcx + 0x7c], ax
xor edx, edx
lea r8d, [rdx + 0xa]
lea rcx, [rbp + 0x48f]
call fcn.18000bd24
test eax, eax
je 0x1800046a0
lea rcx, str.Hook_CSLQuery::Initialize_r_n
call fcn.180001e50
mov ecx, 0x400
call fcn.180004b10
mov rbx, rax
lea r9, [rbp - 0x70]
lea r8, str.SLInitOffset.x64
mov rdx, r15
mov rcx, qword [0x180023ed8]
call fcn.180001970
xor ecx, ecx
test al, al
cmovne ecx, dword [rbp + 0x98]
mov edi, ecx
add rdi, qword [0x180023ec0]
mov word [rsp + 0x78], 0xb848
lea r14, [0x180002430]
mov qword [rbp - 0x80], r14
mov word [rbp - 0x78], 0xc350
xor edx, edx
mov r8d, 0x400
mov rcx, rbx
call fcn.180015c90
lea r9, [rbp + 0x990]
lea r8, str.SLInitFunc.x64
mov rdx, r15
mov rcx, qword [0x180023ed8]
call fcn.1800018a0
lea rsi, str.New_CSLQuery_Initialize
lea r8, [rbp + 0xa8f]
test al, al
cmove r8, rsi
mov edx, 0x400
mov rcx, rbx
call fcn.18000c1b4
mov rdx, rsi
mov rcx, rbx
call fcn.180015bb0
mov rcx, qword [rbp - 0x80]
test eax, eax
cmovne rcx, r14
mov qword [rbp - 0x80], rcx
mov rcx, rbx
call fcn.180004b18
cmp rdi, qword [0x180023ec0]
jbe 0x1800046a0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x18
lea r8, [rsp + 0x78]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x1800046a0
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800049ff
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, 0x33
lea rdx, str.Error:_Failed_to_detect_Terminal_Services_version_r_n
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xd90]
xor rcx, rsp
call fcn.180004af0
lea r11, [rsp + 0xea0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret