Function at 0x180006880
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x18006f040]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
call fcn.180031300
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.180031820
mov edi, dword [0x180072678]
mov ebx, dword [0x180072468]
test edi, edi
jne 0x1800068df
test ebx, ebx
je 0x180006dc2
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0x208
call fcn.180058370
test edi, edi
je 0x18000690a
lea rdx, [rbp - 0x60]
lea rcx, str.chrome.dll
call fcn.180006690
mov ebx, dword [0x180072468]
test ebx, ebx
je 0x18000691e
lea rdx, [rbp - 0x60]
lea rcx, str.msedge.dll
call fcn.180006690
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.ChromeMain
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0x180072678], 0
mov r15, rax
je 0x180006ae5
xorps xmm0, xmm0
mov dword [rsp + 0x68], 0x56415741
xorps xmm1, xmm1
mov dword [rsp + 0x6c], 0x54415541
mov r8d, 0x18
mov dword [rsp + 0x70], 0x53555756
lea rdx, str.Extensions.UninstallType
mov dword [rsp + 0x74], 0x38ec8148
lea rcx, [rbp - 0x80]
movups xmmword [rbp - 0x80], xmm0
movdqu xmmword [rbp - 0x70], xmm1
call fcn.1800047e0
lea rdx, [rbp - 0x80]
mov rcx, r14
call fcn.1800063d0
mov rdx, qword [rbp - 0x68]
mov rbx, rax
cmp rdx, 0xf
jbe 0x1800069da
mov rcx, qword [rbp - 0x80]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800069d5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006e80
call fcn.18002e220
movdqa xmm0, xmmword [0x180066bc0]
lea r9, [rsp + 0x68]
mov r8, r15
mov byte [rbp - 0x80], 0
mov rdx, rbx
mov dword [rsp + 0x20], 0x10
mov rcx, r14
movdqu xmmword [rbp - 0x70], xmm0
call fcn.1800064b0
mov rdi, rax
mov qword [0x180072450], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x18
lea r8, [rsp + 0x48]
mov rcx, rax
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov rcx, qword [rsp + 0x48]
mov esi, dword [rsp + 0x50]
sub rdi, rcx
add rsi, 0xffffffffffffffcd
mov dword [rbp - 0x80], 0x56415741
mov dword [rbp - 0x7c], 0x48535756
mov dword [rbp - 0x78], 0x4420ec83
mov dword [rbp - 0x74], 0x894cce89
mov dword [rbp - 0x70], 0xd68949c7
mov dword [rbp - 0x6c], 0x31cb8948
mov word [rbp - 0x68], 0xe8c9
mov dword [rsp + 0x68], 0x6174c084
mov dword [rsp + 0x6c], 0xf88b8b48
mov dword [rsp + 0x70], 0x48000001
mov dword [rsp + 0x74], 0xb841fa89
mov dword [rsp + 0x78], 0x1f
mov byte [rsp + 0x7c], 0xe8
cmp rdi, rsi
jae 0x180006adc
lea rbx, [rdi + rcx]
mov r8d, 0x1a
lea rdx, [rbp - 0x80]
mov rcx, rbx
call fcn.1800587b0
test eax, eax
jne 0x180006ad1
lea rcx, [rbx + 0x1e]
mov r8d, 0x15
lea rdx, [rsp + 0x68]
call fcn.1800587b0
test eax, eax
je 0x180006ade
inc rdi
inc rbx
cmp rdi, rsi
jb 0x180006aa3
xor ebx, ebx
mov qword [0x180072448], rbx
cmp dword [0x180072468], 0
je 0x180006d6b
mov dword [rsp + 0x30], 0xec834856
mov dword [rsp + 0x34], 0xd6894820
mov qword [rsp + 0x38], 0xffffffffe8d18948
mov dword [rsp + 0x40], 0x1b0c189
mov byte [rsp + 0x44], 0x83
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x18
lea r8, [rsp + 0x48]
mov rcx, rax
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov r11d, dword [rsp + 0x50]
mov r10, r15
mov rbx, qword [rsp + 0x48]
sub r11, 0x40
sub r10, rbx
cmp r10, r11
jae 0x180006ba0
lea rax, [rsp + 0x30]
mov r9, r10
sub r9, rax
add r9, rbx
nop dword [rax]
xor r8d, r8d
lea rax, [rsp + 0x30]
xor edx, edx
nop word [rax + rax]
movzx ecx, byte [rax]
cmp byte [r9 + rax], cl
je 0x180006b7e
cmp cl, 0xff
jne 0x180006b8b
inc r8d
inc edx
inc rax
cmp edx, 0x15
jb 0x180006b70
cmp r8d, 0x15
je 0x180006e71
inc r10
inc r9
cmp r10, r11
jb 0x180006b60
xor eax, eax
xorps xmm0, xmm0
mov qword [0x180072440], rax
xorps xmm1, xmm1
mov dword [rsp + 0x68], 0x56415741
mov r8d, 0x18
mov dword [rsp + 0x6c], 0x54415541
lea rdx, str.Extensions.UninstallType
mov dword [rsp + 0x70], 0x53555756
lea rcx, [rbp - 0x80]
mov word [rsp + 0x74], 0x8148
movups xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x76], 0xec
movdqu xmmword [rbp - 0x70], xmm1
call fcn.1800047e0
lea rdx, [rbp - 0x80]
mov rcx, r14
call fcn.1800063d0
mov rdx, qword [rbp - 0x68]
mov rbx, rax
cmp rdx, 0xf
jbe 0x180006c3c
mov rcx, qword [rbp - 0x80]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006c37
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006e7a
call fcn.18002e220
movdqa xmm0, xmmword [0x180066bc0]
lea r9, [rsp + 0x68]
mov r8, r15
mov byte [rbp - 0x80], 0
mov rdx, rbx
mov dword [rsp + 0x20], 0xf
mov rcx, r14
movdqu xmmword [rbp - 0x70], xmm0
call fcn.1800064b0
mov rbx, rax
mov qword [0x180072450], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x18
lea r8, [rbp - 0x80]
mov rcx, rax
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov rcx, qword [rbp - 0x80]
mov edx, dword [rbp - 0x78]
sub rbx, rcx
add rdx, 0xffffffffffffffe1
mov dword [rsp + 0x48], 0x56415741
mov dword [rsp + 0x4c], 0x48535756
mov dword [rsp + 0x50], 0x4420ec83
mov dword [rsp + 0x54], 0x894ccf89
mov dword [rsp + 0x58], 0xd68949c3
mov dword [rsp + 0x5c], 0xe8ce8948
mov word [rsp + 0x60], 0x8b48
mov dword [rsp + 0x68], 0xfc98548
mov dword [rsp + 0x6c], 0x9e84
mov dword [rsp + 0x70], 0x18b4800
mov dword [rsp + 0x74], 0x40408b48
mov word [rsp + 0x78], 0x15ff
cmp rbx, rdx
jae 0x180006d62
mov r8, qword [rsp + 0x50]
lea rax, [rbx + rcx]
mov rcx, qword [rsp + 0x58]
mov r9, qword [rsp + 0x48]
movzx esi, word [rsp + 0x60]
movzx r10d, word [rsp + 0x78]
mov r11, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x68]
cmp qword [rax], r9
jne 0x180006d57
cmp qword [rax + 8], r8
jne 0x180006d57
cmp qword [rax + 0x10], rcx
jne 0x180006d57
cmp word [rax + 0x1c], si
jne 0x180006d57
cmp byte [rax + 0x1e], 0xd
jne 0x180006d57
cmp qword [rax + 0x23], rdi
jne 0x180006d57
cmp qword [rax + 0x2b], r11
jne 0x180006d57
cmp word [rax + 0x33], r10w
je 0x180006d64
inc rbx
inc rax
cmp rbx, rdx
jb 0x180006d27
xor eax, eax
mov qword [0x180072448], rax
cmp qword [0x180072450], 0
je 0x180006d88
lea rdx, [0x1800065c0]
lea rcx, [0x180072450]
call fcn.180030b00
cmp qword [0x180072448], 0
je 0x180006da5
lea rdx, [0x180006320]
lea rcx, [0x180072448]
call fcn.180030b00
cmp qword [0x180072440], 0
je 0x180006dc2
lea rdx, [method.std::codecvt_wchar_t__char__struct__Mbstatet_.virtual_24]
lea rcx, [0x180072440]
call fcn.180030b00
cmp dword [0x18007267c], 0
je 0x180006e2f
lea rcx, str.Kernelbase.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.CreateProcessA
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessW
mov rcx, rbx
mov qword [0x180072460], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180005560]
mov qword [0x180072458], rax
lea rcx, [0x180072460]
call fcn.180030b00
lea rdx, [0x180005610]
lea rcx, [0x180072458]
call fcn.180030b00
call fcn.180031370
test eax, eax
je 0x180006e45
lea rcx, str.error_..._DetourTransactionCommit
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.18002e200
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
lea rax, [r10 + rbx]
jmp 0x180006ba2
call fcn.18003da5c
int3
call fcn.18003da5c
int3