Function at 0x18004a650
Capabilities:
Read file via mapping

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x368]
sub rsp, 0x430
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rax, qword [0x1800c5470]
xor rax, rsp
mov qword [rbp + 0x320], rax
mov edi, r9d
mov dword [rbp - 0x74], r8d
mov dword [rbp - 0x68], edx
mov qword [rsp + 0x60], rcx
mov r10, qword [rcx + 0x10]
or r8, 0xffffffffffffffff
mov r15d, 0x104
xor r13d, r13d
test r10, r10
je 0x18004a6c7
mov rax, r8
inc rax
cmp word [r10 + rax*2], r13w
jne 0x18004a6b1
cmp rax, r15
jb 0x18004a6c7
xor eax, eax
jmp 0x18004a9a0
mov rdx, qword [rcx + 0x28]
test rdx, rdx
je 0x18004a6e2
mov rax, r8
inc rax
cmp word [rdx + rax*2], r13w
jne 0x18004a6d3
cmp rax, r15
jae 0x18004a6c0
mov rdx, qword [rcx + 0x48]
test rdx, rdx
je 0x18004a6fd
mov rax, r8
inc rax
cmp word [rdx + rax*2], r13w
jne 0x18004a6ee
cmp rax, r15
jae 0x18004a6c0
test dword [rcx + 4], 0x200013
jne 0x18004a6c0
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x18004a71e
mov r14, r8
inc r14
cmp word [rax + r14*2], r13w
jne 0x18004a712
jmp 0x18004a721
mov r14, r13
mov rax, qword [rcx + 0x20]
test rax, rax
je 0x18004a739
mov rsi, r8
inc rsi
cmp word [rax + rsi*2], r13w
jne 0x18004a72d
jmp 0x18004a73c
mov rsi, r13
mov rbx, rsi
cmp r14, rsi
cmova rbx, r14
cmp rbx, 0x2000
jae 0x18004a6c0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x110]
call sub.msvcrt.dll_memset
mov r8d, r15d
lea rdx, [rbp + 0x110]
mov rcx, qword [0x180169370]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp word [rbp + 0x110], r13w
je 0x18004a6c0
lea rdx, str...360DeskAna64.exe
lea rcx, [rbp + 0x110]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov dword [rbp - 0x7c], r13d
mov dword [rbp - 0x80], r13d
lea r8, [rbp - 0x80]
lea rdx, [rbp - 0x7c]
lea rcx, [rbp + 0x110]
call fcn.180019044
mov eax, dword [rbp - 0x80]
mov ecx, dword [rbp - 0x7c]
mov r9d, 0x10000
cmp ecx, r9d
jne 0x18004a7e4
cmp eax, 0x3eb
jae 0x18004a7e4
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp 0x18004a9a0
mov edx, r13d
mov dword [rbp - 0x78], edx
mov r8d, 1
test edi, edi
je 0x18004a805
cmp ecx, r9d
jb 0x18004a805
cmp eax, 0x40d
cmovae edx, r8d
mov dword [rbp - 0x78], edx
mov r12, r13
cmp ecx, r9d
jb 0x18004a83f
cmp eax, 0x417
jb 0x18004a83f
mov r15d, 0x400
cmp rbx, r15
jb 0x18004a84e
sub rbx, r15
movabs rax, 0xfc0fc0fc0fc0fc1
mul rbx
shr rdx, 4
add rdx, r8
imul r12, rdx, 0x104
jmp 0x18004a84e
mov r15d, 0x400
cmp rbx, r15
jae 0x18004a6c0
call fcn.180018e8c
test eax, eax
jne 0x18004a86b
lea rcx, [rbp + 0x110]
call fcn.18006998c
test eax, eax
je 0x18004a6c0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x18004a882
call qword [sym.imp.SHELL32.dll_ILGetSize]
mov r13d, eax
lea rax, [r13 + 0x1678]
mov qword [rsp + 0x70], rax
test r12, r12
je 0x18004a8a3
lea rax, [r12*4 + 0x1680]
add rax, r13
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.msvcrt.dll_srand]
mov eax, dword [0x18016b498]
test al, 1
jne 0x18004a8d9
or eax, 1
mov dword [0x18016b498], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [0x18016b49c], eax
lock inc dword [0x18016a77c]
call fcn.18000a7ac
mov rcx, rax
test rax, rax
je 0x18004ae75
mov rax, qword [rax]
call qword [rax + ILCombine]
add rax, 0x18
mov qword [rbp - 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.msvcrt.dll_rand]
lea r8d, [rax + 0x3000]
mov ecx, dword [0x18016a77c]
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
mov r9d, dword [0x18016b49c]
lea rdx, str._u__d__d__d__u
lea rcx, [rbp - 0x60]
call fcn.18000cf30
xor eax, eax
mov qword [rsp + 0x78], rax
mov rbx, qword [rbp - 0x60]
cmp dword [rbp - 0x74], eax
je 0x18004aa2b
lea edx, [rax + 0x28]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x18004a97f
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov rcx, rdi
test eax, eax
jne 0x18004a9ca
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor esi, esi
mov edi, esi
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x18004a99e
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, edi
mov rcx, qword [rbp + 0x320]
xor rcx, rsp
call fcn.1800782d0
mov rbx, qword [rsp + 0x478]
add rsp, 0x430
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r9d, 1
xor r8d, r8d
mov edx, r9d
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x18004a9e5
mov rcx, rdi
jmp 0x18004a979
and dword [rbp - 0x10], 0
mov qword [rbp - 0x18], rdi
mov dword [rbp - 0x20], ILCombine
mov qword [rsp + 0x28], rbx
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
xor r9d, r9d
lea r8d, [r9 + 4]
lea rdx, [rbp - 0x20]
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x78], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0x78]
jmp 0x18004aa64
mov dword [rbp - 8], ILCombine
mov qword [rbp], rax
mov dword [rbp + 8], 1
mov qword [rsp + 0x28], rbx
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
xor r9d, r9d
lea r8d, [r9 + 4]
lea rdx, [rbp - 8]
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x78], rax
test rax, rax
je 0x18004a97f
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
jne 0x18004aaa2
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18004a97f
mov r8, qword [rsp + 0x70]
xor edx, edx
mov rcx, rdi
call sub.msvcrt.dll_memset
mov eax, dword [rsp + 0x70]
mov dword [rdi], eax
xor r8d, r8d
mov r9d, r8d
mov qword [rbp - 0x70], r8
test r12, r12
je 0x18004aade
lea r9, [r13 + 0x1678]
add r9, rdi
mov qword [rbp - 0x70], r9
mov rax, r12
shl rax, 2
mov dword [r9], eax
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x10], r8
je 0x18004ab18
mov dword [rdi + 0x1650], 1
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x10]
lea rdx, [rdi + 0x10]
movzx eax, word [rcx]
mov word [rdx], ax
lea rcx, [rcx + 2]
lea rdx, [rdx + 2]
test ax, ax
jne 0x18004ab00
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x18], r8
je 0x18004ab74
mov dword [rdi + 0x1654], 1
mov r8, r14
cmp r14, r15
jb 0x18004ab54
mov rax, qword [rsp + 0x60]
mov rdx, qword [rax + 0x18]
add rdx, 0x800
lea r8, [r14*2 - 0x800]
lea rcx, [r9 + 4]
call sub.msvcrt.dll_memcpy
mov r8, r15
mov rax, qword [rsp + 0x60]
add r8, r8
lea rcx, [rdi + 0x218]
mov rdx, qword [rax + 0x18]
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0x60]
xor r8d, r8d
cmp qword [rax + 0x20], r8
je 0x18004abd6
mov dword [rdi + 0x1658], 1
mov r14, rsi
cmp rsi, r15
jb 0x18004abb8
mov r14, r15
mov rax, qword [rsp + 0x60]
mov rdx, qword [rax + 0x20]
add rdx, 0x800
lea r8, [rsi*2 - 0x800]
mov rcx, qword [rbp - 0x70]
add rcx, 4
lea rcx, [rcx + r12*2]
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0x60]
lea r8, [r14 + r14]
lea rcx, [rdi + 0xa18]
mov rdx, qword [rax + 0x20]
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0x60]
xor esi, esi
cmp qword [rax + 0x28], rsi
je 0x18004ac10
mov dword [rdi + 0x165c], 1
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x28]
lea rdx, [rdi + 0x1218]
movzx eax, word [rcx]
mov word [rdx], ax
lea rcx, [rcx + 2]
lea rdx, [rdx + 2]
test ax, ax
jne 0x18004abf8
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x48], rsi
je 0x18004ac48
mov dword [rdi + 0x1660], 1
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x48]
lea rdx, [rdi + 0x1434]
movzx eax, word [rcx]
mov word [rdx], ax
lea rcx, [rcx + 2]
lea rdx, [rdx + 2]
test ax, ax
jne 0x18004ac30
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 8]
mov qword [rdi + 8], rax
mov rax, qword [rsp + 0x60]
mov ecx, dword [rax + 0x30]
mov dword [rdi + 0x1420], ecx
mov rax, qword [rsp + 0x60]
mov ecx, dword [rax + 4]
mov dword [rdi + 4], ecx
mov rax, qword [rsp + 0x60]
mov ecx, dword [rax + 0x58]
mov dword [rdi + 0x1644], ecx
mov rax, qword [rsp + 0x60]
mov rdx, qword [rax + 0x40]
test rdx, rdx
je 0x18004aca5
lea rcx, [rdi + 0x1674]
mov r8, r13
call sub.msvcrt.dll_memcpy
mov dword [rdi + 0x1670], r13d
mov dword [rdi + 0x166c], 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [rbp - 0x78], esi
je 0x18004acd5
lea rdx, str.Program_manager
lea rcx, str.Progman
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x18004acd5
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
xor edx, edx
mov r8d, 0x80
lea rcx, [rbp + 0x90]
call sub.msvcrt.dll_memset
mov rax, qword [rsp + 0x70]
mov r9, rbx
lea rdx, str.__s__s__u
lea rcx, [rbp + 0x90]
mov qword [rsp + 0x20], rax
cmp dword [rbp - 0x68], esi
lea r8, [0x1800913b8]
jne 0x18004ad17
lea r8, [0x1800913d8]
call qword [sym.imp.USER32.dll_wsprintfW]
mov dword [rbp + 0x20], 0x68
xor edx, edx
lea r8d, [rdx + 0x60]
lea rcx, [rbp + 0x28]
call sub.msvcrt.dll_memset
xor eax, eax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov edi, esi
mov dword [rbp - 0x70], esi
xor r8d, r8d
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x110]
cmp dword [rbp - 0x74], esi
jne 0x18004ad92
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
call fcn.180049f94
mov edi, dword [rbp - 0x70]
jmp 0x18004ade3
mov dword [rsp + 0x50], esi
lea rax, [rbp - 0x58]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
call fcn.18004b1a4
mov ecx, esi
test eax, eax
sete cl
mov dword [rsp + 0x68], ecx
test eax, eax
je 0x18004ade9
lea r9, [rbp - 0x58]
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x110]
call fcn.18004bbb8
mov dword [rsp + 0x68], eax
mov ecx, eax
lea rax, [rsp + 0x78]
mov qword [rbp - 0x40], rax
lea rax, [rsp + 0x70]
mov qword [rbp - 0x38], rax
lea rax, [rsp + 0x60]
mov qword [rbp - 0x30], rax
lea rax, [rsp + 0x68]
mov qword [rbp - 0x28], rax
test ecx, ecx
je 0x18004ae43
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x18004ae2b
mov edx, 0x7530
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x18004ae43
jmp 0x18004ae3a
test edi, edi
je 0x18004ae52
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x40]
call fcn.18004ae80
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x18004ae52
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x18004ae61
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [rsp + 0x68]
jmp 0x18004a983
mov ecx, 0x80004005
call fcn.18000a540
int3