Function at 0x18001b040
Capabilities:
Create thread
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 8], ecx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov r14d, r9d
mov r15, r8
mov r12, rdx
mov r13d, ecx
mov qword [rsp + 0x48], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [rax + 0x1e]
xor eax, eax
mov qword [rsp + 0x50], rax
mov ecx, 0x1000a
call fcn.180053ad4
mov rsi, rax
mov ecx, 0x2000a
call fcn.180053ad4
mov rbx, rax
test rsi, rsi
je 0x18001b167
test rax, rax
je 0x18001b167
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r12
mov r9d, r13d
lea r8, str._MBAE_DSI__Unloading_stale_injection_for_process__d._Stale_Module:0x_p__Krn32_Module:_0x_p__X86:__d
mov edx, 0xffff
mov rcx, rax
call fcn.180053a4c
test eax, eax
jle 0x18001b150
xor eax, eax
mov word [rbx + 0x1fffe], ax
lea rdx, [rax - 2]
mov rcx, rbx
call fcn.180053398
lea r8, [rax + 1]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.180054798
test eax, eax
je 0x18001b127
mov r8d, edi
mov rdx, rbx
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.180053f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
lea r9, str._UnloadLibaryOfProcess
mov edx, 0xd9
mov r8d, 3
lea rcx, str...DelStaleInjections.cpp
call fcn.180001b40
jmp 0x18001b180
mov edx, edi
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x18001b17a
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test rsi, rsi
je 0x18001b18d
mov rcx, rsi
call fcn.180053a94
test rbx, rbx
je 0x18001b19b
mov rcx, rbx
call fcn.180053a94
nop
mov ecx, 1
call fcn.18001bf70
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [rax + 0x1e]
xor eax, eax
mov qword [rsp + 0x50], rax
mov ecx, 0x1000a
call fcn.180053ad4
mov rdi, rax
mov ecx, 0x2000a
call fcn.180053ad4
mov rbx, rax
test rdi, rdi
je 0x18001b295
test rax, rax
je 0x18001b295
mov dword [rsp + 0x20], r14d
mov r9d, r13d
lea r8, str._MBAE_DSI__Enable_debug_privilege_of_process__d_result:__d
mov edx, 0xffff
mov rcx, rax
call fcn.180053a4c
test eax, eax
jle 0x18001b27e
xor eax, eax
mov word [rbx + 0x1fffe], ax
lea rdx, [rax - 2]
mov rcx, rbx
call fcn.180053398
lea r8, [rax + 1]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.180054798
test eax, eax
je 0x18001b255
mov r8d, esi
mov rdx, rbx
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.180053f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
lea r9, str._UnloadLibaryOfProcess
mov edx, 0xde
mov r8d, 3
lea rcx, str...DelStaleInjections.cpp
call fcn.180001b40
jmp 0x18001b2ae
mov edx, esi
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x18001b2a8
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test rdi, rdi
je 0x18001b2bb
mov rcx, rdi
call fcn.180053a94
test rbx, rbx
je 0x18001b2c8
mov rcx, rbx
call fcn.180053a94
mov r8d, r13d
xor edx, edx
mov ecx, 0x103a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
mov qword [rsp + 0x48], rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x18001b5ee
xor ebx, ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [0x18008ca48]
mov rdx, r15
mov rcx, rax
call fcn.180007640
mov r15, rax
call fcn.18001bef0
test eax, eax
jne 0x18001b454
call fcn.180006f70
cmp eax, 0x100
ja 0x18001b454
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [rax + 0x1e]
mov qword [rsp + 0x58], rbx
mov ecx, 0x1000a
call fcn.180053ad4
mov rsi, rax
mov ecx, 0x2000a
call fcn.180053ad4
mov rbx, rax
test rsi, rsi
je 0x18001b414
test rax, rax
je 0x18001b414
mov qword [rsp + 0x20], r12
mov r9d, r13d
lea r8, str._MBAE_DSI__Setting_LoadCount..._Remote_process:__d__Stale_module:_0x_p
mov edx, 0xffff
mov rcx, rax
call fcn.180053a4c
test eax, eax
jle 0x18001b3fd
xor eax, eax
mov word [rbx + 0x1fffe], ax
lea rdx, [rax - 2]
mov rcx, rbx
call fcn.180053398
lea r8, [rax + 1]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.180054798
test eax, eax
je 0x18001b3d4
mov r8d, edi
mov rdx, rbx
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.180053f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
lea r9, str._UnloadLibaryOfProcess
mov edx, 0xed
mov r8d, 3
lea rcx, str...DelStaleInjections.cpp
call fcn.180001b40
jmp 0x18001b42d
mov edx, edi
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x18001b427
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test rsi, rsi
je 0x18001b43a
mov rcx, rsi
call fcn.180053a94
test rbx, rbx
je 0x18001b447
mov rcx, rbx
call fcn.180053a94
mov rdx, r12
mov rcx, r14
call fcn.1800072d0
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [rax + 0x1e]
mov qword [rsp + 0x60], rbx
mov ecx, 0x1000a
call fcn.180053ad4
mov rsi, rax
mov ecx, 0x2000a
call fcn.180053ad4
mov rbx, rax
test rsi, rsi
je 0x18001b544
test rax, rax
je 0x18001b544
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
mov r9d, r13d
lea r8, str._MBAE_DSI__Creating_remote_thread._Remote_process:__d__FreeLibrary_pointer:_0x_p__Stale_module:_0x_p
mov edx, 0xffff
mov rcx, rax
call fcn.180053a4c
test eax, eax
jle 0x18001b52d
xor eax, eax
mov word [rbx + 0x1fffe], ax
lea rdx, [rax - 2]
mov rcx, rbx
call fcn.180053398
lea r8, [rax + 1]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.180054798
test eax, eax
je 0x18001b504
mov r8d, edi
mov rdx, rbx
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.180053f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
lea r9, str._UnloadLibaryOfProcess
mov edx, 0xf4
mov r8d, 3
lea rcx, str...DelStaleInjections.cpp
call fcn.180001b40
jmp 0x18001b55d
mov edx, edi
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x18001b557
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test rsi, rsi
je 0x18001b56a
mov rcx, rsi
call fcn.180053a94
test rbx, rbx
je 0x18001b577
mov rcx, rbx
call fcn.180053a94
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
mov r9, r15
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rdi, rax
mov ebx, dword [0x1800a7590]
mov ecx, dword [0x1800a427c]
cmp ebx, ecx
jae 0x18001b5b8
mov rcx, qword [0x1800a7588]
mov qword [rcx + rbx*8], rax
jmp 0x18001b5de
add ecx, 0x32
mov dword [0x1800a427c], ecx
mov edx, ecx
shl rdx, 3
mov rcx, qword [0x1800a7588]
call fcn.180055d44
mov qword [0x1800a7588], rax
mov qword [rax + rbx*8], rdi
inc ebx
mov dword [0x1800a7590], ebx
xor r15d, r15d
jmp 0x18001b715
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [rax + 0x1e]
xor r15d, r15d
mov qword [rsp + 0x68], r15
mov ecx, 0x1000a
call fcn.180053ad4
mov rsi, rax
mov ecx, 0x2000a
call fcn.180053ad4
mov rbx, rax
test rsi, rsi
je 0x18001b6e1
test rax, rax
je 0x18001b6e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov dword [rsp + 0x20], r13d
lea r8, str._MBAE_DSI__Error_0x_X___Opening_proceess__d
mov edx, 0xffff
mov rcx, rbx
call fcn.180053a4c
test eax, eax
jle 0x18001b6ca
mov word [rbx + 0x1fffe], r15w
lea rdx, [r15 - 2]
mov rcx, rbx
call fcn.180053398
lea r8, [rax + 1]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
mov rdx, rsi
lea rcx, [rsp + 0x68]
call fcn.180054798
test eax, eax
je 0x18001b6a1
mov r8d, edi
mov rdx, rbx
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.180053f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
lea r9, str._UnloadLibaryOfProcess
mov edx, 0xfc
mov r8d, 3
lea rcx, str...DelStaleInjections.cpp
call fcn.180001b40
jmp 0x18001b6fa
mov edx, edi
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x18001b6f4
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test rsi, rsi
je 0x18001b707
mov rcx, rsi
call fcn.180053a94
test rbx, rbx
je 0x18001b715
mov rcx, rbx
call fcn.180053a94
nop
test r14, r14
je 0x18001b723
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call fcn.18001bf70
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [rax + 0x1e]
mov qword [rsp + 0x40], r15
mov ecx, 0x1000a
call fcn.180053ad4
mov rdi, rax
mov ecx, 0x2000a
call fcn.180053ad4
mov rbx, rax
test rdi, rdi
je 0x18001b81a
test rax, rax
je 0x18001b81a
mov dword [rsp + 0x20], r14d
mov r9d, r13d
lea r8, str._MBAE_DSI__Disable_debug_privilege_of_process__d_result:__d
mov edx, 0xffff
mov rcx, rax
call fcn.180053a4c
test eax, eax
jle 0x18001b803
mov word [rbx + 0x1fffe], r15w
mov rdx, 0xfffffffffffffffe
mov rcx, rbx
call fcn.180053398
lea r8, [rax + 1]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.180054798
test eax, eax
je 0x18001b7da
mov r8d, esi
mov rdx, rbx
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.180053f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
lea r9, str._UnloadLibaryOfProcess
mov edx, 0x106
mov r8d, 3
lea rcx, str...DelStaleInjections.cpp
call fcn.180001b40
jmp 0x18001b833
mov edx, esi
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x18001b82d
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test rdi, rdi
je 0x18001b840
mov rcx, rdi
call fcn.180053a94
test rbx, rbx
je 0x18001b84d
mov rcx, rbx
call fcn.180053a94
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret