Function at 0x18004e450
Capabilities:
Enumerate gui resources
Get file size
Read file via mapping
Terminate process

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5d8]
sub rsp, 0x6d8
xor edi, edi
mov r11, rcx
lea ecx, [rdx + 0xe]
mov r10, r9
mov dword [rsp + 0x58], ecx
mov r13, r8
mov eax, edx
lea r9d, [rdi + 1]
cmp edx, ecx
jae 0x18004ea5e
mov r12, qword [rsp + 0x78]
add edx, 0xffffff13
mov r9d, dword [rbp + 0x628]
mov esi, dword [rbp + 0x628]
mov r14d, dword [rbp + 0x628]
mov ebx, dword [rbp + 0x628]
mov r15d, dword [rbp + 0x628]
mov qword [rsp + 0x78], r12
mov rax, qword [rsp + 0x78]
mov r8, qword [rsp + 0x78]
mov qword [rbp - 0x78], rax
mov eax, ecx
mov dword [rsp + 0x50], edx
mov dword [rsp + 0x54], r9d
mov qword [rsp + 0x60], r8
lea rcx, [0x180000000]
cmp edx, 0x48
ja case.default.0x18004e512
movzx eax, byte [rcx + rdx + 0x4ee34]
mov ecx, dword [rcx + rax*4 + 0x4edf8]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
movsx eax, byte [r13]
lea r8, [rsp + 0x70]
xor r9d, r9d
mov dword [rbp + 0x540], eax
mov rdx, r10
mov dword [rsp + 0x70], 0x200
lea rcx, [rbp + 0x1e0]
mov dword [rsp + 0x20], 0x157
call fcn.1800108e0
mov ecx, 0xfffffefc
lea rdx, [rbp - 0x20]
call qword [0x1800ce8f0]
mov r11, qword [rbp + 0x620]
mov r10, qword [rbp + 0x638]
mov r8, qword [rsp + 0x60]
mov r9d, dword [rsp + 0x54]
mov edx, dword [rsp + 0x50]
mov eax, dword [rsp + 0x58]
inc edx
mov dword [rsp + 0x50], edx
lea ecx, [rdx + 0xed]
cmp ecx, eax
jb 0x18004e4ed
mov rdx, qword [rsp + 0x78]
mov r9d, 1
mov eax, dword [rbp + 0x628]
mov rbx, qword [rsp + 0x68]
mov esi, eax
imul ecx, eax, 0x1d4
mov dword [rsp + 0x50], ecx
cmp eax, ecx
ja 0x18004edde
mov r14, qword [rbp - 0x80]
mov eax, ecx
mov r15d, dword [rbp + 0x628]
mov r13, qword [rbp - 0x80]
mov r12, qword [rbp - 0x80]
nop dword [rax + rax]
cmp esi, 0x2853
ja 0x18004eb76
je 0x18004eb3f
cmp esi, 0x125
ja 0x18004eaed
je 0x18004eae1
mov eax, esi
sub eax, 0xed
je 0x18004eaca
sub eax, 0x1c
je 0x18004ea8a
cmp eax, 0xe
jne 0x18004ed1a
movups xmm0, xmmword [str.rnel32.]
mov eax, dword [0x18009b0ac]
lea rcx, [rbp - 0x60]
mov dword [rbp - 0x60], eax
sub rcx, 2
movups xmmword [rbp - 0x5c], xmm0
nop
cmp word [rcx + 2], di
lea rcx, [rcx + 2]
jne 0x18004e630
mov eax, dword [0x18009a574]
mov dword [rcx], eax
jmp 0x18004ed1a
test r12, r12
je 0x18004e88f
mov edx, edi
mov r8d, edi
mov r9, rdi
cmp qword [r10], rdx
jbe 0x18004e563
mov r10d, 0x118
nop word [rax + rax]
mov eax, r10d
sub eax, 0x118
je 0x18004e762
sub eax, 1
je 0x18004e744
sub eax, 1
je 0x18004e724
sub eax, 1
je 0x18004e6f3
cmp eax, 1
jne 0x18004e782
mov rcx, qword [r13]
movsxd rax, r8d
cmp rax, rcx
jae 0x18004e6bd
mov eax, ebx
inc r8d
shr eax, 0x10
mov byte [r9 + r12], al
inc r9
mov rcx, qword [r13]
movsxd rax, r8d
cmp rax, rcx
jae 0x18004e6d8
mov eax, ebx
inc r8d
shr eax, 8
mov byte [r9 + r12], al
inc r9
mov rcx, qword [r13]
movsxd rax, r8d
cmp rax, rcx
jae 0x18004e782
inc r8d
mov byte [r9 + r12], bl
inc r9
jmp 0x18004e782
movsxd rax, edx
movsx rcx, byte [rax + r11]
cmp cl, 0x3d
jne 0x18004e704
mov eax, edi
jmp 0x18004e70f
mov rax, qword [0x1800be150]
movsx eax, byte [rcx + rax]
mov ebx, r14d
shl ebx, 6
add ebx, esi
shl ebx, 6
add ebx, r15d
shl ebx, 6
add ebx, eax
jmp 0x18004e780
movsxd rax, edx
movsx rcx, byte [rax + r11]
cmp cl, 0x3d
jne 0x18004e736
mov r15d, edi
jmp 0x18004e780
mov rax, qword [0x1800be150]
movsx r15d, byte [rcx + rax]
jmp 0x18004e780
movsxd rax, edx
movsx rcx, byte [rax + r11]
cmp cl, 0x3d
jne 0x18004e755
mov esi, edi
jmp 0x18004e780
mov rax, qword [0x1800be150]
movsx esi, byte [rcx + rax]
jmp 0x18004e780
movsxd rax, edx
movsx rcx, byte [rax + r11]
cmp cl, 0x3d
jne 0x18004e774
mov r14d, edi
jmp 0x18004e780
mov rax, qword [0x1800be150]
movsx r14d, byte [rcx + rax]
inc edx
inc r10d
cmp r10d, 0x11d
jb 0x18004e670
mov r10, qword [rbp + 0x638]
movsxd rax, edx
cmp rax, qword [r10]
jb 0x18004e661
jmp 0x18004e563
cmp qword [0x1800be150], rdi
jne 0x18004e7e8
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor edx, edx
lea rcx, [rbp - 0x38]
mov r8d, 0xcb
call fcn.180018500
mov r11, qword [rbp + 0x620]
mov edx, dword [rsp + 0x50]
mov r10, qword [rbp + 0x638]
mov r8, qword [rsp + 0x60]
mov r9d, dword [rsp + 0x54]
mov rax, qword [r10]
test al, 3
jne 0x18004e88f
shr rax, 2
lea rcx, [rax + rax*2]
mov qword [r13], rcx
mov rax, qword [r10]
cmp byte [rax + r11 - 1], 0x3d
jne case.0x18004e512.14
lea rax, [rcx - 1]
mov qword [r13], rax
jmp case.0x18004e512.14
cmp r9d, 0xffffffff
je 0x18004e9d4
test r9d, r9d
je 0x18004e9a2
cmp dword [r10], edi
mov r8d, 2
mov rcx, qword [rsp + 0x60]
mov eax, 4
cmovne r8d, eax
mov qword [rsp + 0x28], rdi
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbp - 0x78], rax
test rax, rax
jne 0x18004e555
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 2
mov ebx, eax
call fcn.180074020
lea rdx, str.Re_allocated_trace_buffer_from__d__0x_08x_to__d_bytes__0x_08x
jmp 0x18004e9ed
cmp qword [rsp + 0x68], rdi
jne case.0x18004e512.14
mov rax, rdi
jmp 0x18004ede1
mov eax, dword [r10]
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov rcx, r11
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea edx, [rax + rax*2]
shl edx, 0x1e
lea r8d, [r9 + 1]
bts edx, 0x1f
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r11, qword [rbp + 0x620]
mov r8, rax
mov r10, qword [rbp + 0x638]
mov qword [rsp + 0x60], rax
jmp 0x18004e568
mov eax, 0x4f
lea rdx, str.penP
lea rcx, [rbp - 0x6f]
mov word [rbp - 0x70], ax
lea r8d, [rax - 0x4a]
call fcn.180071f50
mov eax, dword [str.roces]
mov dword [rbp - 0x6b], eax
movzx eax, word [0x18009b03c]
mov word [rbp - 0x67], ax
jmp 0x18004e555
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x68], rax
jmp 0x18004e555
cmp r8, 0xffffffffffffffff
je 0x18004ea11
xor edx, edx
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r11, qword [rbp + 0x620]
mov r9d, eax
mov r10, qword [rbp + 0x638]
mov r8, qword [rsp + 0x60]
mov dword [rsp + 0x54], eax
jmp 0x18004e56d
mov eax, 0x73
mov word [rbp - 0x66], ax
jmp case.0x18004e512.14
mov eax, dword [r11]
mov dword [rbp + 0x53c], eax
jmp case.0x18004e512.14
mov rax, qword [r10]
cmp byte [rax + r11 - 2], 0x3d
jne 0x18004e98c
dec qword [r13]
mov rcx, qword [r13]
call fcn.18007218c
mov r12, rax
mov qword [rsp + 0x78], rax
jmp 0x18004e555
mov ecx, 2
call fcn.180074020
mov r8, qword [rbp + 0x620]
lea rdx, str.proccessOperatorNameForSPN
mov rcx, rax
call fcn.18006ab80
mov dword [rsp + 0x68], 1
mov rax, qword [rsp + 0x68]
jmp 0x18004ede1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 2
mov ebx, eax
call fcn.180074020
lea rdx, str.cannot_get_size_of_file__s._GetFileSize_err_d_n
mov r8, qword [rbp + 0x620]
mov rcx, rax
mov r9d, ebx
call fcn.18006ab80
mov dword [rsp + 0x68], 1
mov rax, qword [rsp + 0x68]
jmp 0x18004ede1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 2
mov ebx, eax
call fcn.180074020
lea rdx, str.cannot_open_file__s._CreateFile_err_d_n
jmp 0x18004e9ed
mov rax, qword [r11]
movsx rdx, word [r10]
mov rcx, qword [rax]
mov rax, qword [rcx + rdx*8 - 8]
mov ecx, dword [rax]
mov dword [rsp + 0x68], ecx
mov rax, qword [rsp + 0x68]
jmp 0x18004ede1
mov rcx, qword [rsp + 0x68]
mov rdx, r10
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x18004ede1
mov ecx, dword [rbp + 0x628]
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x78], rdx
mov r8, qword [rsp + 0x78]
mov dword [rsp + 0x54], ecx
mov rcx, qword [rsp + 0x78]
mov qword [rbp - 0x78], rcx
mov qword [rsp + 0x60], r8
jmp 0x18004e59a
cmp dword [r10], edi
mov edx, 4
mov rcx, qword [rbp - 0x78]
mov eax, 2
cmovne edx, eax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r12, rax
test rax, rax
je 0x18004ed49
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18004ed0e
mov rcx, r11
call fcn.180072184
mov r11, rdi
mov qword [rbp + 0x620], rdi
jmp 0x18004ed15
mov word [0x1800ce8f8], di
jmp 0x18004ed1e
cmp esi, 0x2241
je 0x18004eb28
cmp esi, 0x264d
jne 0x18004ed1e
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x630]
mov r9d, dword [rsp + 0x54]
mov qword [rax], r12
mov rax, qword [rbp + 0x640]
mov dword [rax], r9d
jmp 0x18004ed0e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x87
call fcn.18003f4e0
jmp 0x18004ed0e
mov r8, r9
mov dword [rbp - 0x4c], 0x6c
lea rdx, [0x180095d20]
lea rcx, [rbp - 0x60]
call fcn.1800711ec
lea r9, [rbp - 0x70]
mov edx, 0xe5
lea r8, [rbp - 0x60]
xor ecx, ecx
call fcn.1800588e0
mov qword [rbp - 0x80], rax
jmp 0x18004ed0e
cmp esi, 0x64e9
ja 0x18004ebde
je 0x18004edde
cmp esi, 0x4395
je 0x18004ebd1
cmp esi, 0x4b91
je 0x18004ed84
cmp esi, 0x4f8f
jne 0x18004ed1e
mov rax, qword [r11]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x70], rax
mov ecx, 0x42
mov word [rsp + 0x58], r9w
mov r15d, edi
call fcn.180018420
movsxd r13, eax
jmp 0x18004ed0e
mov rbx, rdx
mov qword [rsp + 0x68], rdx
jmp 0x18004ed1e
cmp esi, 0x76cb
je 0x18004ecce
cmp esi, 0x9e07
jne 0x18004ed1e
test r14, r14
je 0x18004ed8f
test r15d, r15d
je 0x18004ec4e
mov rdx, r13
lea rcx, [0x180047d70]
call qword [sym.imp.USER32.dll_EnumWindows]
mov edx, 0x1f4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x18004ecc3
mov rax, qword [rbp + 0x620]
mov r15d, 1
mov dword [rsp + 0x70], 0xffffffff
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
jmp 0x18004ec94
mov edx, r9d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x18004ec78
mov rax, qword [rbp + 0x620]
mov dword [rsp + 0x70], edi
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
jmp 0x18004ec94
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
mov rax, qword [rbp + 0x620]
mov rax, qword [rax]
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rdi
lea r9, [rsp + 0x70]
mov qword [rsp + 0x38], rdi
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov qword [rsp + 0x28], rdi
xor edx, edx
mov dword [rsp + 0x20], 0x28
call fcn.180036ed0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18004ed0e
mov eax, 2
lea r8, [rsp + 0x58]
mov word [rsp + 0x58], ax
lea rdx, [rsp + 0x70]
mov rax, qword [r11]
mov ecx, 0x42
mov qword [rsp + 0x70], rax
call fcn.180018420
cmp eax, 1
mov r15d, edi
mov r8d, r13d
mov ecx, 0x100001
sete r15b
xor edx, edx
call qword [rbp - 0x80]
mov r14, rax
mov r11, qword [rbp + 0x620]
mov r8, qword [rsp + 0x60]
mov eax, dword [rsp + 0x50]
mov ecx, dword [rbp + 0x628]
lea ecx, [rcx + rcx*8]
lea esi, [rsi + rcx*4]
cmp esi, eax
ja 0x18004edde
mov rdx, qword [rsp + 0x78]
mov r9d, 1
mov r10, qword [rbp + 0x638]
jmp 0x18004e5d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 2
mov ebx, eax
call fcn.180074020
mov r8, qword [rbp + 0x620]
lea rdx, str.AntiMalwareInstallation::HandleNotifyDevice__:_Error:__1_
mov rcx, rax
mov r9d, ebx
call fcn.18006ab80
mov eax, 1
mov dword [rsp + 0x68], eax
mov rax, qword [rsp + 0x68]
jmp 0x18004ede1
mov dword [rsp + 0x68], edi
mov rax, qword [rsp + 0x68]
jmp 0x18004ede1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x40], rdi
lea r9, [rbp + 0x628]
mov dword [rbp + 0x628], eax
lea rcx, [rbp - 0x38]
mov rax, qword [rbp + 0x620]
xor r8d, r8d
mov qword [rsp + 0x38], rdi
xor edx, edx
mov rax, qword [rax]
mov qword [rbp - 0x80], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x28
call fcn.180036ed0
mov rax, rbx
add rsp, 0x6d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret