Function at 0x180004a50
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r14d, 1
mov rdi, rcx
cmp edx, r14d
jne 0x180004ed1
lea rcx, [0x18000aa08]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
lea r8, [rbp + 0x48]
lea rdx, [entry0]
lea ecx, [r14 + 4]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
lea rcx, [0x18000abc0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rcx, str.KernelBase.dll
mov qword [rbp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str._stricmp
mov rcx, rbx
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str._wcsicmp
mov rcx, rbx
mov qword [0x180014948], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.strcmp
mov rcx, rbx
mov qword [0x180014960], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.swprintf
mov rcx, rbx
mov qword [0x180014950], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.sprintf
mov rcx, rbx
mov qword [0x180014938], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rbx, [0x180011ee0]
mov r8d, 0x104
mov rdx, rbx
mov qword [0x180014958], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, eax
lea rdi, [rbx + rax*2]
jmp 0x180004b61
sub rdi, 2
cmp word [rdi], 0x5c
jne 0x180004b5d
mov rax, qword [0x180014958]
lea r12, [0x1800116d0]
add rdi, 2
mov qword [0x180011ed0], rdi
test rax, rax
je 0x180004b9d
mov r8, rdi
lea rdx, str.LDNTVDM_is_running_inside__S_n
mov rcx, r12
call rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rdi
call fcn.180004994
test eax, eax
je 0x180004bb1
xor r14d, r14d
jmp 0x180004ed1
call fcn.1800048e4
test eax, eax
jne 0x180004ba9
mov rcx, qword [rbp + 0x48]
lea rdx, str.VDMConsoleOperation
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18000d638], rax
xor ebx, ebx
lea rsi, [rbp - 0x10]
lea rax, str.totalcmd64.exe
mov qword [rbp - 0x10], rax
lea rax, [0x1800012cc]
mov qword [rbp - 8], rax
mov rdx, qword [rsi]
mov rcx, rdi
call qword [0x180014960]
test eax, eax
je 0x180004c0f
add ebx, r14d
add rsi, 0x10
movsxd rax, ebx
cmp rax, r14
jb 0x180004bee
jmp 0x180004c4d
mov rax, qword [0x180014958]
test rax, rax
je 0x180004c43
movsxd r8, ebx
lea rdx, str.Installing_LDNTVDM_hook_for_application__S_n
add r8, r8
lea rcx, [0x18000d680]
mov r8, qword [rbp + r8*8 - 0x10]
call rax
lea rcx, [0x18000d680]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
movsxd rax, ebx
add rax, rax
call qword [rbp + rax*8 - 8]
call fcn.18000589c
mov rcx, qword [rbp + 0x48]
lea rdx, str.BasepProcessInvalidImage
mov dword [0x18000d624], eax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp + 0x48]
lea rdx, str.BaseIsDosApplication
mov qword [0x18000d648], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r9, [0x1800042a8]
mov rcx, r15
lea r8, str.BasepProcessInvalidImage
mov qword [0x18000d658], rax
lea rdx, str.ext_ms_win_kernelbase_processthread_l1_1_0.dll
call fcn.180002e90
mov rax, qword [0x180014958]
test rax, rax
je 0x180004cf5
mov r8, qword [0x18000d648]
lea rdx, str.LDNTVDM:_BasepProcessInvalidImageReal___08X_n
mov rcx, r12
call rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rax, qword [0x180014958]
test rax, rax
je 0x180004cf5
mov r8, qword [0x18000d658]
lea rdx, str.LDNTVDM:_BaseIsDosApplication___08X_n
mov rcx, r12
call rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rbx, [0x180014940]
mov rcx, r15
lea r9, [0x180004168]
mov qword [rsp + 0x20], rbx
lea r8, str.NtCreateUserProcess
lea rdx, [0x18000a3d8]
call fcn.180002d80
cmp eax, 0xfffffffe
jne 0x180004d46
mov rcx, qword [rbp + 0x48]
lea r9, [0x180004168]
lea r8, str.NtCreateUserProcess
mov qword [rsp + 0x20], rbx
lea rdx, [0x18000a3d8]
call fcn.180002d80
lea rdx, str.cmd.exe
mov rcx, rdi
call qword [0x180014960]
test eax, eax
jne 0x180004dc7
lea rcx, str.ext_ms_win_cmd_util_l1_1_0.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
jne 0x180004d84
lea rcx, str.ext_ms_win_cmd_util_l1_1_0.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x180004dc7
lea rdx, str.CmdBatNotificationStub
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [0x180004870]
mov r8, rbx
mov rcx, rax
mov rdx, rsi
lea rax, str.myCmdBatNotification
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 8
call fcn.180001dc0
lea rdx, str.ConHost.exe
mov rcx, rdi
call qword [0x180014960]
test eax, eax
jne 0x180004e7e
and qword [rbp - 0x10], 0
mov rax, qword [0x180014958]
test rax, rax
je 0x180004e05
lea rdx, str.LDNTVDM_is_running_inside_ConHost.exe_n
mov rcx, r12
call rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [0x18000aa08]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtVdmControl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, 7
lea r9, [rbp + 0x38]
mov edx, edi
mov rcx, rax
mov rbx, rax
lea r8d, [rdi + 0x39]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180004e67
mov r8d, edi
lea rdx, [0x18000b048]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RtlMoveMemory]
mov r8d, dword [rbp + 0x38]
lea r9, [rbp + 0x38]
mov edx, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [rbp - 0x10]
call fcn.180001424
call fcn.180005288
test eax, eax
je 0x180004e7e
call fcn.180005480
call fcn.180002a10
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call fcn.180001548
call fcn.1800010fc
lea rcx, str.windows.storage.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180004eb0
mov rcx, rax
call fcn.1800057f8
mov rax, qword [0x180014958]
test rax, rax
je 0x180004ed1
lea rdx, str.ldntvdm_Init_done__https:__github.com_leecher1337_ntvdmx64__n
mov rcx, r12
call rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea r11, [rsp + 0x40]
mov eax, r14d
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret