Function at 0x18004c260
Capabilities:
Create thread
Encode data using base64
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x7b0]
sub rsp, 0x8b0
mov rax, qword [0x180089b10]
xor rax, rsp
mov qword [rbp + 0x7a0], rax
mov r14, r8
mov dword [rsp + 0x70], edx
mov rsi, rcx
movdqa xmm0, xmmword [0x18007f320]
movdqa xmmword [rbp + 0x1f0], xmm0
mov byte [rbp + 0x1e0], 0
movdqa xmm1, xmm0
movdqa xmmword [rbp + 0x210], xmm0
mov byte [rbp + 0x200], 0
movdqa xmmword [rbp + 0x230], xmm0
mov byte [rbp + 0x220], 0
movdqa xmmword [rbp + 0x2c0], xmm0
mov byte [rbp + 0x2b0], 0
movdqa xmmword [rbp + 0x2e0], xmm0
mov byte [rbp + 0x2d0], 0
xor r13d, r13d
mov qword [rbp + 0x60], r13
mov word [rbp + 0x68], r13w
movdqu xmmword [rbp + 0x7a], xmm0
mov byte [rbp + 0x6a], r13b
mov qword [rbp + 0x30], r13
mov word [rbp + 0x38], r13w
movdqu xmmword [rbp + 0x4a], xmm0
mov byte [rbp + 0x3a], r13b
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], r13
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], r13
mov qword [rbp + 0x90], r13
mov qword [rbp + 0x98], r13
mov qword [rbp + 0xa0], r13
lea ecx, [r13 + 0x30]
call fcn.18006f6f0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x98], rax
mov qword [rbp + 0xa8], r13
xorps xmm2, xmm2
movsd qword [rbp + 0xb0], xmm2
mov qword [rbp + 0xb8], r13
mov edx, 1
mov dword [rbp + 0xc0], edx
mov qword [rbp + 0xc8], r13
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xe0], xmm1
movdqa xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], r13
mov qword [rbp + 0x108], 0xffffffffffffffff
mov dword [rbp + 0x110], r13d
xor eax, eax
movups xmmword [rbp + 0x118], xmm0
movups xmmword [rbp + 0x128], xmm0
movups xmmword [rbp + 0x138], xmm0
movups xmmword [rbp + 0x148], xmm0
mov qword [rbp + 0x158], rax
movdqa xmm0, xmmword [0x18007f320]
movdqa xmmword [rbp + 0x170], xmm0
mov byte [rbp + 0x160], al
mov word [rbp + 0x180], r13w
mov dword [rbp + 0x184], r13d
mov qword [rbp + 0x188], r13
xorps xmm0, xmm0
movaps xmmword [rbp + 0x190], xmm0
movsd qword [rbp + 0x1a0], xmm2
mov byte [rbp + 0x1a8], al
mov qword [rbp + 0x1ac], r13
mov r8d, dword [rsp + 0x70]
lea eax, [r8 + 0xe]
lea r9, [0x180000000]
cmp r8d, eax
jae 0x18004c617
lea ebx, [r8 - 0x54]
lea edi, [rdx + 0xd]
mov r12d, 0x756b
movabs r15, 0x70004f00690068
cmp ebx, 0x1a
ja case.0x18004c485.1
mov ecx, dword [r9 + rbx*4 + 0x4d7e4]
add rcx, r9
jmp rcx
movzx eax, word [0x18007c222]
mov word [rbp + 0x300], ax
movzx eax, byte [0x18007c224]
mov byte [rbp + 0x302], al
mov byte [rbp + 0x303], 0
jmp case.0x18004c485.1
mov word [rbp + 0x34a], r13w
mov r8d, 4
lea rdx, [0x18007c26a]
lea rcx, [rbp + 0x34a]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov edx, 1
lea r9, [0x180000000]
jmp case.0x18004c485.1
mov r8d, 2
lea rdx, [0x18007c2aa]
lea rcx, [rbp + 0x300]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
movzx eax, word [0x18007c2d0]
mov word [rbp + 0x308], ax
movzx eax, byte [0x18007c2d2]
mov byte [rbp + 0x30a], al
mov edx, 1
lea r9, [0x180000000]
jmp case.0x18004c485.1
mov byte [rbp + 0x311], 0
jmp case.0x18004c485.1
mov word [rbp + 0x35a], r13w
jmp case.0x18004c485.1
mov r8d, 4
lea rdx, [0x18007c32e]
lea rcx, [rbp + 0x311]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov edx, 1
lea r9, [0x180000000]
jmp case.0x18004c485.1
mov r8d, 3
lea rdx, [0x18007c34a]
lea rcx, [rbp + 0x30b]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov edx, 1
lea r9, [0x180000000]
jmp case.0x18004c485.1
mov word [rbp + 0x303], 0x66
jmp case.0x18004c485.1
mov byte [rbp + 0x30b], 0
jmp case.0x18004c485.1
mov word [rbp + 0x304], r12w
mov byte [rbp + 0x306], 0
jmp case.0x18004c485.1
mov qword [rbp + 0x352], r15
jmp case.0x18004c485.1
movzx eax, word [0x18007c474]
mov word [rbp + 0x30e], ax
movzx eax, byte [0x18007c476]
mov byte [rbp + 0x310], al
jmp case.0x18004c485.1
mov byte [rbp + 0x315], 0
mov r8, rdx
lea rdx, [0x18007c492]
lea rcx, [rbp + 0x348]
jmp 0x18004c4ca
movsxd rax, dword [rsi]
mov dword [r14 + rax*4 + 0x1b4], r13d
inc ebx
sub rdi, 1
jne 0x18004c471
mov r8d, dword [rsp + 0x70]
mov edi, r8d
mov dword [rsp + 0x74], r8d
lea ebx, [r8 + 0xd]
mov dword [rsp + 0x64], ebx
cmp r8d, ebx
jae 0x18004cc25
lea ebx, [r8 - 0x62]
mov dword [rsp + 0x68], ebx
mov r8d, 0x1bb
mov r11d, 0x4f
movabs r10, 0x72007500630063
mov r15, qword [rbp + 0x2f0]
mov r12d, dword [rbp - 0x7c]
mov r13d, dword [rbp - 0x7c]
mov r14d, dword [rbp - 0x7c]
movzx esi, byte [rsp + 0x61]
movzx eax, byte [rsp + 0x61]
mov byte [rsp + 0x60], al
mov ecx, dword [rbp - 0x78]
mov dword [rbp - 0x70], ecx
mov rax, qword [rbp - 0x60]
mov qword [rsp + 0x78], rax
mov eax, dword [rsp + 0x64]
mov edx, 0x65
cmp ebx, 0xc
ja case.default.0x18004c697
mov ecx, dword [r9 + rbx*4 + 0x4d850]
add rcx, r9
jmp rcx
lea r9, [rbp - 0x50]
mov r8d, edx
xor edx, edx
xor ecx, ecx
call fcn.1800119f0
mov r8d, 0x1bb
movabs r10, 0x72007500630063
mov r11d, 0x4f
mov eax, dword [rsp + 0x64]
movzx edx, byte [rsp + 0x60]
mov r9, qword [rsp + 0x78]
inc edi
mov dword [rsp + 0x74], edi
inc ebx
mov dword [rsp + 0x68], ebx
cmp edi, eax
jae 0x18004cc41
lea r9, [0x180000000]
jmp 0x18004c682
xor ecx, ecx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
lea rax, [0x180088608]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x1f
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call fcn.18001e6f0
test al, al
jne 0x18004ca8e
mov ebx, 0x1f
mov dword [rbp - 0x80], ebx
cmp ebx, 0x1f
ja case.0x18004c752.6
mov eax, ebx
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0x4d884]
add rcx, rdx
jmp rcx
movabs rax, 0x69007500700063
mov qword [rbp + 0x380], rax
jmp case.0x18004c752.6
xor eax, eax
mov word [rbp + 0x394], ax
lea r8d, [rax + 3]
lea rdx, [0x18007c4f4]
lea rcx, [rbp + 0x394]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp case.0x18004c752.6
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.dbghelp.dll_SymInitialize]
mov dword [rbp - 0x6c], eax
jmp case.0x18004c752.6
xor eax, eax
mov word [rbp + 0x388], ax
jmp case.0x18004c752.6
mov eax, 0x64
jmp 0x18004ca69
xor eax, eax
mov word [rbp + 0x3a2], ax
lea r8d, [rax + 4]
lea rdx, [0x18007c560]
lea rcx, [rbp + 0x3a2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp case.0x18004c752.6
xor eax, eax
mov word [rbp + 0x38a], ax
lea r8d, [rax + 2]
lea rdx, [0x18007c5dc]
lea rcx, [rbp + 0x38a]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp case.0x18004c752.6
mov dword [rbp + 0x39a], 0x5f0038
jmp case.0x18004c752.6
xor eax, eax
mov ecx, eax
movzx eax, byte [rsp + 0x61]
cmp dword [rbp - 0x6c], ecx
cmovne ecx, eax
mov byte [rsp + 0x61], cl
jmp case.0x18004c752.6
mov r15, 0xffffffffffffffff
jmp case.0x18004c752.6
mov dword [rbp + 0x39e], 0x630065
jmp case.0x18004c752.6
mov eax, dword [0x18007c6c8]
mov dword [rbp + 0x38e], eax
movzx eax, word [0x18007c6cc]
mov word [rbp + 0x392], ax
jmp case.0x18004c752.6
cmp byte [rsp + 0x61], 0
je case.0x18004c752.6
xor r8d, r8d
mov ebx, r8d
lea edi, [r8 + 0x10]
cmp ebx, 0xf
ja case.default.0x18004c895
mov eax, ebx
mov ecx, dword [rdx + rax*4 + 0x4d904]
add rcx, rdx
jmp rcx
mov dword [rbp + 0x250], 0x58
mov r12d, r8d
jmp case.default.0x18004c895
mov rcx, r15
call qword [sym.imp.dbghelp.dll_SymCleanup]
lea rdx, [0x180000000]
xor r8d, r8d
jmp case.default.0x18004c895
mov dword [rbp + 0x2f6], 0x3f6d65
jmp case.default.0x18004c895
lea rax, [rbp + 0x338]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
mov r9d, r12d
mov r8d, dword [rbp - 0x68]
mov edx, dword [rbp - 0x78]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.SHELL32.dll_SHChangeNotifyRegister]
mov r14d, eax
lea r8, [rbp + 0x250]
lea rdx, [rbp + 0x2f0]
mov rcx, r15
call qword [sym.imp.dbghelp.dll_SymFromName]
lea rdx, [0x180000000]
xor r8d, r8d
jmp case.default.0x18004c895
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x250], xmm0
movups xmmword [rbp + 0x260], xmm0
movups xmmword [rbp + 0x270], xmm0
movups xmmword [rbp + 0x280], xmm0
movups xmmword [rbp + 0x290], xmm0
mov qword [rbp + 0x2a0], rax
mov dword [rbp - 0x68], 0x2381f
jmp case.default.0x18004c895
test sil, sil
je case.default.0x18004c895
mov ecx, r14d
call qword [sym.imp.SHELL32.dll_SHChangeNotifyDeregister]
lea rdx, [0x180000000]
xor r8d, r8d
jmp case.default.0x18004c895
mov eax, 0x63
mov word [rbp + 0x2f3], ax
mov eax, 0x4d6b
mov word [rbp + 0x2f4], ax
jmp case.default.0x18004c895
mov eax, 0x7473
mov word [rbp + 0x2f0], ax
jmp case.default.0x18004c895
mov dword [rbp - 0x78], 1
jmp case.default.0x18004c895
mov sil, 1
mov qword [rbp - 0x60], r8
jmp case.default.0x18004c895
mov ecx, r8d
movzx eax, sil
test r14d, r14d
cmovne ecx, eax
movzx esi, cl
jmp case.default.0x18004c895
xor eax, eax
mov qword [rbp + 0x338], rax
mov dword [rbp + 0x340], eax
jmp case.default.0x18004c895
mov eax, 0x61
mov word [rbp + 0x2f2], ax
jmp case.default.0x18004c895
mov eax, 0x65
mov word [rbp + 0x2fe], ax
jmp case.default.0x18004c895
mov dword [rbp + 0x2f9], 0x69537972
mov eax, 0x7a
mov word [rbp + 0x2fd], ax
jmp case.default.0x18004c895
mov r13d, 1
mov dword [rbp + 0x2a0], 0x7d0
inc ebx
sub rdi, 1
jne 0x18004c880
mov ebx, dword [rbp - 0x80]
jmp case.0x18004c752.6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x4000000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
jmp case.0x18004c752.6
xor eax, eax
mov word [rbp + 0x3ac], ax
jmp case.0x18004c752.6
mov eax, 0x64
mov word [rbp + 0x388], ax
jmp case.0x18004c752.6
mov byte [rsp + 0x61], 1
jmp case.0x18004c752.6
xor eax, eax
mov word [rbp + 0x3aa], ax
dec ebx
mov dword [rbp - 0x80], ebx
lea eax, [rbx + 0x100]
cmp eax, 0xff
ja 0x18004c736
mov ebx, dword [rsp + 0x68]
mov edi, dword [rsp + 0x74]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
jmp 0x18004c6a9
xor eax, eax
mov word [rbp + 0x378], ax
jmp 0x18004c6bf
mov dl, 1
mov byte [rsp + 0x60], dl
mov eax, dword [rsp + 0x64]
jmp 0x18004c6c8
lea r8, [rbp + 0x1e0]
mov edx, reloc.SHELL32.dll_SHSetFolderPathW
lea rcx, [rbp + 0x2b0]
call fcn.18000ebe0
mov eax, 0x1bb
mov word [rsp + 0x68], ax
lea r9, [0x180088668]
mov r8d, 0x62
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x60]
call fcn.180025110
jmp 0x18004c6a9
mov ecx, 0x20008
mov dword [rbp - 0x70], ecx
mov word [rsp + 0x68], r8w
lea r9, [rbp + 0x30]
lea r8, [0x180088688]
lea rdx, [rsp + 0x68]
mov ecx, 0x32
call fcn.18003e3c0
jmp 0x18004c6a9
movsd xmm0, qword [0x18007c72c]
movsd qword [rbp + 0x35a], xmm0
movzx eax, word [0x18007c734]
mov word [rbp + 0x362], ax
xor eax, eax
mov word [rbp + 0x364], ax
jmp 0x18004c6bf
mov r9, 0xffffffffffffffff
mov qword [rsp + 0x78], r9
mov eax, dword [rsp + 0x64]
movzx edx, byte [rsp + 0x60]
jmp 0x18004c6cd
movsd xmm0, qword [0x18007c774]
movsd qword [rbp + 0x36e], xmm0
movzx eax, word [0x18007c77c]
mov word [rbp + 0x376], ax
jmp 0x18004c6bf
mov dword [rbp + 0x364], 0x4f
jmp 0x18004c6bf
mov word [rbp + 0x240], r8w
xor r8d, r8d
lea rdx, [rbp + 0x220]
mov ecx, 0xd0
call fcn.180017a80
jmp 0x18004c6a9
mov qword [rbp + 0x366], r10
jmp 0x18004c6bf
lea rax, [rbp + 0x300]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x18004cbe0
lea rdx, [rbp + 0x300]
lea rcx, [rbp + 0x1e0]
call fcn.180020ed0
mov r8d, 1
lea rdx, [0x18007c78c]
lea rcx, [rbp + 0x200]
call fcn.180020ed0
jmp 0x18004c6a9
mov esi, 1
jmp 0x18004d131
movzx edx, byte [rsp + 0x61]
mov byte [rsp + 0x60], dl
mov r10d, dword [rbp - 0x78]
mov dword [rbp - 0x70], r10d
mov r9, qword [rbp - 0x60]
mov qword [rsp + 0x78], r9
jmp 0x18004cc4a
mov r8d, dword [rsp + 0x70]
mov r10d, dword [rbp - 0x70]
lea ecx, [r8 + 0x8bc]
mov dword [rsp + 0x64], ecx
mov ebx, dword [rbp - 0x7c]
cmp r8d, ecx
jae 0x18004d12f
movzx ecx, word [rsp + 0x68]
mov dword [rsp + 0x68], ecx
movzx esi, byte [rsp + 0x61]
mov dword [rsp + 0x74], esi
mov r14, qword [rbp + 0x2f0]
mov r13, qword [rbp]
mov r15, qword [rbp + 0x2f0]
mov r12, qword [rbp + 0x2f0]
mov eax, dword [rsp + 0x64]
mov r11d, 0x3b
lea rdi, [0x18000a850]
cmp r8d, 0x46a
ja 0x18004d441
je 0x18004d424
cmp r8d, 0x266
ja 0x18004ce1c
je 0x18004cdd2
cmp r8d, 0x62
je 0x18004cdc0
cmp r8d, 0x10e
je 0x18004cd37
cmp r8d, 0x1ba
jne 0x18004d58d
mov eax, dword [0x1800886b0]
mov dword [rbp - 0x78], eax
lea r9, [rbp - 0x78]
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov ecx, 0x115
call fcn.180053810
lea rax, [rbp - 0x50]
mov qword [rbp + 0x10], rax
mov eax, dword [0x1800886b0]
mov dword [rbp + 0x18], eax
mov eax, dword [0x1800886b4]
mov dword [rbp + 0x1c], eax
movaps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x20], xmm0
mov eax, dword [rsp + 0x64]
mov r8d, dword [rsp + 0x70]
movzx edx, byte [rsp + 0x60]
jmp 0x18004d58d
lea rax, [rbp + 0x60]
mov qword [rbp - 0x78], rax
mov rax, qword [rbp - 0x48]
cmp rax, qword [rbp - 0x40]
je 0x18004cd5e
lea rcx, [rbp + 0x60]
mov qword [rax], rcx
mov rdx, qword [rbp - 0x48]
add rdx, 8
mov qword [rbp - 0x48], rdx
jmp 0x18004cd78
lea r8, [rbp - 0x78]
mov rdx, qword [rbp - 0x48]
lea rcx, [rbp - 0x50]
call fcn.1800012c0
mov rdx, qword [rbp - 0x48]
mov r8d, dword [rsp + 0x70]
lea rax, [rbp + 0x30]
mov qword [rbp - 0x78], rax
cmp rdx, qword [rbp - 0x40]
je 0x18004cda0
lea rax, [rbp + 0x30]
mov qword [rdx], rax
add qword [rbp - 0x48], 8
mov eax, dword [rsp + 0x64]
movzx edx, byte [rsp + 0x60]
jmp 0x18004d58d
lea r8, [rbp - 0x78]
lea rcx, [rbp - 0x50]
call fcn.1800012c0
mov eax, dword [rsp + 0x64]
mov r8d, dword [rsp + 0x70]
movzx edx, byte [rsp + 0x60]
jmp 0x18004d58d
mov dword [rbp - 0x7c], 0x104
xor ecx, ecx
mov qword [rbp - 0x58], rcx
jmp 0x18004d58d
lea r8, [rbp - 0x58]
mov edx, r10d
mov rcx, r9
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rbp - 0x6c], eax
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x20]
lea r8, [0x1800146f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x60], rax
mov eax, dword [rsp + 0x64]
mov r8d, dword [rsp + 0x70]
movzx edx, byte [rsp + 0x60]
jmp 0x18004d58d
cmp r8d, 0x312
je 0x18004ce77
cmp r8d, 0x3be
jne 0x18004d58d
mov qword [rbp - 0x78], rdi
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x112
lea r9, [rbp - 0x78]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180043f00
mov eax, dword [rsp + 0x64]
mov r8d, dword [rsp + 0x70]
movzx edx, byte [rsp + 0x60]
jmp 0x18004d58d
mov rax, qword [rbp - 0x60]
test rax, rax
jne 0x18004d408
mov edi, reloc.SHELL32.dll_ILFree
mov dword [rbp - 0x80], edi
nop dword [rax]
cmp edi, 0x48f
ja 0x18004d025
je 0x18004d019
cmp edi, 0x267
ja 0x18004cf5f
je 0x18004cf53
mov eax, edi
sub eax, 0x9b
je 0x18004cf45
sub eax, 0x5c
je 0x18004cf25
sub eax, 0x5c
je 0x18004cf05
sub eax, 0x5c
je 0x18004cef9
cmp eax, 0x5c
jne 0x18004d3ec
movzx eax, word [0x18007c795]
mov word [rbp + 0x31f], ax
movzx eax, byte [0x18007c797]
mov byte [rbp + 0x321], al
jmp 0x18004d3ec
mov byte [rbp + 0x31f], 0
jmp 0x18004d3ec
movzx eax, word [0x18007c7e4]
mov word [rbp + 0x31c], ax
movzx eax, byte [0x18007c7e6]
mov byte [rbp + 0x31e], al
jmp 0x18004d3ec
movzx eax, word [0x18007c819]
mov word [rbp + 0x319], ax
movzx eax, byte [0x18007c81b]
mov byte [rbp + 0x31b], al
jmp 0x18004d3ec
mov word [rbp + 0x318], 0x75
jmp 0x18004d3ec
mov byte [rbp + 0x322], 0
jmp 0x18004d3ec
mov eax, edi
sub eax, 0x2c3
je 0x18004cff2
sub eax, 0x5c
je 0x18004cfd3
sub eax, 0x5c
je 0x18004cfc4
sub eax, 0x5c
je 0x18004cfa4
cmp eax, 0x5c
jne 0x18004d3ec
movzx eax, word [0x18007c7b3]
mov word [rbp + 0x331], ax
movzx eax, byte [0x18007c7b5]
mov byte [rbp + 0x333], al
jmp 0x18004d3ec
movzx eax, word [0x18007c878]
mov word [rbp + 0x32e], ax
movzx eax, byte [0x18007c87a]
mov byte [rbp + 0x330], al
jmp 0x18004d3ec
mov dword [rbp + 0x32a], 0x69736976
jmp 0x18004d3ec
mov r8d, 5
lea rdx, [0x18007c7bf]
lea rcx, [rbp + 0x318]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x18004d3e8
movzx eax, word [0x18007c848]
mov word [rbp + 0x322], ax
movzx eax, byte [0x18007c84a]
mov byte [rbp + 0x324], al
mov byte [rbp + 0x325], 0
jmp 0x18004d3ec
mov byte [rbp + 0x334], 0
jmp 0x18004d3ec
cmp edi, 0x713
ja 0x18004d107
je 0x18004d0d8
mov eax, edi
sub eax, 0x4eb
je 0x18004d095
sub eax, 0x5c
je 0x18004d088
sub eax, 0x5c
je 0x18004d077
sub eax, 0x5c
je 0x18004d064
cmp eax, 0x5c
jne 0x18004d3ec
mov dword [rbp - 0x68], 1
jmp 0x18004d3ec
xor eax, eax
mov r14d, eax
mov ecx, pe_nt_image_headers64
mov dword [rsp + 0x68], ecx
jmp 0x18004d3ec
mov sil, 1
mov dword [rsp + 0x74], esi
mov byte [rsp + 0x61], sil
jmp 0x18004d3ec
mov word [rbp + 0x342], r11w
jmp 0x18004d3ec
movsd xmm0, qword [str.return_po]
movsd qword [rbp + 0x338], xmm0
movzx eax, word [0x18007c890]
mov word [rbp + 0x340], ax
lea rcx, [rbp + 0x338]
dec rcx
nop dword [rax]
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x18004d0c0
movzx eax, word [0x180076e10]
mov word [rcx], ax
jmp 0x18004d3e8
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x1c0], xmm0
mov qword [rbp + 0x1d0], rax
mov dword [rbp + 0x1d8], eax
mov r8d, dword [rbp - 0x68]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov r14, rax
jmp 0x18004d3e8
mov eax, edi
sub eax, 0x76f
je 0x18004d3a8
sub eax, 0x5c
je 0x18004d2bd
sub eax, 0x5c
je 0x18004d1cd
cmp eax, 0x5c
jne 0x18004d3ec
mov esi, ebx
lea rcx, [rbp + 0x108]
call fcn.180003340
mov rbx, qword [rbp + 0xf0]
test rbx, rbx
je 0x18004d5b4
mov rdi, qword [rbp + 0xf8]
cmp rbx, rdi
je 0x18004d178
nop dword [rax]
mov rcx, rbx
call fcn.18001e1d0
add rbx, 0x20
cmp rbx, rdi
jne 0x18004d160
mov rbx, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0x100]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x18004d1ab
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004d5f2
mov rcx, rbx
call fcn.18006f72c
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xf0], xmm0
xor r14d, r14d
mov qword [rbp + 0x100], r14
jmp 0x18004d5b7
movzx ecx, byte [rsp + 0x61]
test cl, cl
je 0x18004d27d
mov edi, 0x33
movsxd rsi, dword [rsp + 0x68]
mov eax, edi
sub eax, 0x33
je 0x18004d287
cmp eax, 1
jne 0x18004d26b
test cl, cl
je 0x18004d26b
mov ebx, 0xa2
nop dword [rax]
cmp ebx, 0xa2
je 0x18004d24f
cmp ebx, 0x1d1c
je 0x18004d22c
cmp ebx, 0x3996
jne 0x18004d258
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18004d258
mov r8d, 9
lea rax, [rbp + 0x2f0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 8]
xor edx, edx
mov rcx, r15
call qword [sym.imp.dbghelp.dll_ImageDirectoryEntryToDataEx]
jmp 0x18004d258
xor eax, eax
mov qword [rbp + 0x2f0], rax
add ebx, 0x1c7a
cmp ebx, 0x556e
jbe 0x18004d200
movzx ecx, byte [rsp + 0x61]
inc edi
cmp edi, 0x35
jb 0x18004d1e4
mov esi, dword [rsp + 0x74]
mov edi, dword [rbp - 0x80]
mov ebx, 1
jmp 0x18004d3e8
movsx rax, si
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
test rax, rax
jne 0x18004d266
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor cl, cl
mov byte [rsp + 0x61], cl
jmp 0x18004d26b
xor eax, eax
mov ecx, eax
movzx eax, byte [rsp + 0x61]
test r13, r13
cmovne ecx, eax
mov byte [rsp + 0x61], cl
test sil, sil
je 0x18004d3e8
mov esi, 0x3d
mov r13d, dword [rsp + 0x74]
cmp esi, 0x3d
je 0x18004d340
cmp esi, 0x20a5
jne 0x18004d389
test r13b, r13b
je 0x18004d389
mov edi, 0x113
cmp edi, 0x113
je 0x18004d317
cmp edi, 0x4b32
jne 0x18004d330
mov rcx, r14
jmp 0x18004d32a
lea rdx, [rbp + 0x1c0]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add edi, 0x4a1f
cmp edi, 0x943e
jbe 0x18004d302
jmp 0x18004d389
mov r8d, 0xf01ff
lea rdx, [rbp + 0x318]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov r12, rax
test rax, rax
jne 0x18004d389
mov edi, 0x39
mov ecx, edi
sub ecx, 0x39
je 0x18004d374
cmp ecx, 1
jne 0x18004d37d
xor r13b, r13b
jmp 0x18004d37d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
inc edi
cmp edi, 0x3b
jb 0x18004d363
mov dword [rsp + 0x74], r13d
add esi, 0x2068
cmp esi, 0x40d0
jbe 0x18004d2e3
mov r13, qword [rbp]
mov esi, dword [rsp + 0x74]
mov edi, dword [rbp - 0x80]
jmp 0x18004d3e8
movsx eax, cx
lea rcx, [rbp + 0x338]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor edx, edx
lea rcx, [rdx - 1]
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r13, rax
mov qword [rbp], rax
movzx esi, sil
test r14, r14
mov eax, 0
cmove esi, eax
mov dword [rsp + 0x74], esi
mov ecx, dword [rsp + 0x68]
add edi, 0x5c
mov dword [rbp - 0x80], edi
cmp edi, 0x8df
mov r11d, 0x3b
jb 0x18004ce90
mov rax, qword [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x64]
mov r8d, dword [rsp + 0x70]
movzx edx, byte [rsp + 0x60]
jmp 0x18004d58d
xor eax, eax
mov ecx, eax
movzx eax, dl
cmp dword [rbp - 0x6c], ecx
cmovne ecx, eax
movzx edx, cl
mov byte [rsp + 0x60], cl
mov eax, dword [rsp + 0x64]
jmp 0x18004d58d
cmp r8d, 0x71a
ja 0x18004d571
je 0x18004d540
cmp r8d, 0x516
je 0x18004d513
cmp r8d, 0x5c2
je 0x18004d4e5
cmp r8d, 0x66e
jne 0x18004d58d
test dl, dl
je 0x18004d58d
mov edi, 0x60
mov eax, edi
sub eax, 0x60
je 0x18004d4c1
sub eax, 1
je 0x18004d4b9
sub eax, 1
je 0x18004d4aa
cmp eax, 1
jne 0x18004d4d0
test dl, dl
je 0x18004d4d0
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18004d4cb
cmp qword [rbp - 0x58], 0xffffffffffffffff
jne 0x18004d4d0
xor dl, dl
mov byte [rsp + 0x60], dl
jmp 0x18004d4d0
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x18004d4cb
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
movzx edx, byte [rsp + 0x60]
inc edi
cmp edi, 0x64
jb 0x18004d484
mov eax, dword [rsp + 0x64]
mov r8d, dword [rsp + 0x70]
jmp 0x18004d58d
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 0xce
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1800616b0
mov eax, dword [rsp + 0x64]
mov r8d, dword [rsp + 0x70]
movzx edx, byte [rsp + 0x60]
jmp 0x18004d58d
mov r9d, 0x68
lea r8, [rbp - 0x50]
lea rdx, [rbp + 0x90]
lea rcx, [0x180088600]
call fcn.180022f10
mov eax, dword [rsp + 0x64]
mov r8d, dword [rsp + 0x70]
movzx edx, byte [rsp + 0x60]
jmp 0x18004d58d
xor eax, eax
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp + 0x348]
mov edx, dword [rbp - 0x7c]
lea rcx, [rbp + 0x590]
call qword [sym.imp.SHELL32.dll_PathMakeUniqueName]
mov eax, dword [rsp + 0x64]
mov r8d, dword [rsp + 0x70]
movzx edx, byte [rsp + 0x60]
jmp 0x18004d58d
cmp r8d, 0x7c6
je 0x18004d589
cmp r8d, 0x872
je 0x18004d12f
jmp 0x18004d58d
xor ecx, ecx
mov ebx, ecx
add r8d, 0xac
mov dword [rsp + 0x70], r8d
cmp r8d, eax
jae 0x18004d12f
mov ecx, dword [rsp + 0x68]
mov r9, qword [rsp + 0x78]
mov r10d, dword [rbp - 0x70]
jmp 0x18004cc90
xor r14d, r14d
mov rcx, qword [rbp + 0xd8]
test rcx, rcx
je 0x18004d610
mov rdx, qword [rbp + 0xe8]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004d5f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18004d5f9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18006f72c
mov qword [rbp + 0xd8], r14
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xe0], xmm0
lea rcx, [rbp + 0x98]
call fcn.180003270
nop
mov rbx, qword [rbp - 0x38]
test rbx, rbx
je 0x18004d6a7
mov rdi, qword [rbp - 0x30]
cmp rbx, rdi
je 0x18004d648
mov rcx, rbx
call fcn.180002b80
add rbx, 0x28
cmp rbx, rdi
jne 0x18004d633
mov rbx, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x28]
sub rcx, rbx
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rax, rbx
cmp rdx, 0x1000
jb 0x18004d693
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004d6e4
mov rcx, rbx
call fcn.18006f72c
mov qword [rbp - 0x38], r14
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x18004d6fc
mov rax, qword [rbp - 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004d6eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18004d6eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18006f72c
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r14
mov rdx, qword [rbp + 0x52]
cmp rdx, 0x10
jb 0x18004d73a
inc rdx
mov rcx, qword [rbp + 0x3a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004d735
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18004d735
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18006f72c
movdqa xmm0, xmmword [0x18007f320]
movdqu xmmword [rbp + 0x4a], xmm0
mov byte [rbp + 0x3a], 0
mov rdx, qword [rbp + 0x82]
cmp rdx, 0x10
jb 0x18004d78c
inc rdx
mov rcx, qword [rbp + 0x6a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004d787
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18004d787
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18006f72c
movdqa xmm0, xmmword [0x18007f320]
movdqu xmmword [rbp + 0x7a], xmm0
mov byte [rbp + 0x6a], 0
lea rcx, [rbp + 0x2b0]
call fcn.180002ee0
nop
lea rcx, [rbp + 0x1e0]
call fcn.180002f90
mov eax, esi
mov rcx, qword [rbp + 0x7a0]
xor rcx, rsp
call fcn.18006fee0
mov rbx, qword [rsp + 0x8f8]
add rsp, 0x8b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret