Function at 0x18000aba0
Capabilities:
Create thread
Print debug messages

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
jne 0x18000a314
lea rcx, str.pycPlus_DLL_PROCESS_ATTACH__ul_reason_for_call
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [0x180054518]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x180054898]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.180009c30
lea r11, [rsp + 0x48]
mov qword [rsp + 0x28], r11
lea r8, [0x1800098e0]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180009ef2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1800012e0
cmp dword [0x180054dac], 0
mov qword [0x180054890], rbx
jne 0x180009f16
call fcn.180003840
mov dword [0x180054dac], 1
lea rdx, str.TASKMGR.EXE
lea rcx, [0x180054dc0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x18000a2ec
lea rdx, str.TASKMGR.EXE.MUI
lea rcx, [0x180054dc0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x18000a2ec
cmp dword [0x180054dac], 0
jne 0x180009f66
call fcn.180003840
mov dword [0x180054dac], 1
lea rdx, str.QQPLAYER.EXE
lea rcx, [0x180054dc0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x180009fa4
call fcn.180009a90
lea r8, str.ApplyMess
xor edx, edx
mov ecx, 0xf001f
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
test rax, rax
je 0x180009fa4
mov rcx, rax
call fcn.180004d70
call fcn.180003560
call fcn.18000f460
cmp dword [0x180054dac], 0
jne 0x180009fc6
call fcn.180003840
mov dword [0x180054dac], 1
lea rdx, str.SPLWOW64.EXE
lea rcx, [0x180054dc0]
call qword [sym.imp.MSVCR100.dll__stricmp]
test eax, eax
je 0x18000a082
lea rdx, [0x180008d30]
lea rcx, [0x180057660]
call fcn.180011cc0
lea rdx, [0x180005890]
lea rcx, [0x1800576f8]
call fcn.180011cc0
call fcn.180003d50
test eax, eax
jne 0x18000a082
call fcn.180003bc0
test eax, eax
jne 0x18000a082
call fcn.180003ed0
test eax, eax
jne 0x18000a082
call fcn.180003f50
test eax, eax
jne 0x18000a082
lea rdx, [0x1800060d0]
lea rcx, [0x180057758]
call fcn.180011cc0
lea rdx, [0x180005bd0]
lea rcx, [0x180057788]
call fcn.180011cc0
lea rdx, [0x180005df0]
lea rcx, [0x1800576d0]
mov dword [0x180054db8], 1
call fcn.180011cc0
lea rdx, [0x1800058f0]
lea rcx, [0x1800576b8]
call fcn.180011cc0
lea rdx, [0x180008f30]
lea rcx, [0x180057840]
call fcn.180011cc0
lea rdx, [0x1800090c0]
lea rcx, [0x180057648]
call fcn.180011cc0
lea rdx, [0x1800066b0]
lea rcx, [0x180057668]
call fcn.180011cc0
mov ecx, 1
call fcn.18000a4e0
test eax, eax
je 0x18000a10c
cmp dword [0x180054dac], 0
jne 0x18000a0e1
call fcn.180003840
mov dword [0x180054dac], 1
lea rdx, str.QQMUSIC.EXE
lea rcx, [0x180054dc0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x18000a10c
lea rdx, [0x180005630]
lea rcx, [0x180057790]
call fcn.180011cc0
lea rdx, [0x180007a80]
lea rcx, [0x180057728]
call fcn.180011cc0
lea rdx, [0x180008260]
lea rcx, [0x180057608]
call fcn.180011cc0
lea rdx, [0x180009430]
lea rcx, [0x1800577f0]
call fcn.180011cc0
lea rdx, [0x180009330]
lea rcx, [0x1800577e8]
call fcn.180011cc0
lea rdx, [0x180008960]
lea rcx, [0x180057760]
call fcn.180011cc0
lea rdx, [0x1800063d0]
lea rcx, [0x1800576c8]
call fcn.180011cc0
lea rdx, [0x1800065c0]
lea rcx, [0x1800577b0]
call fcn.180011cc0
call fcn.180003d50
test eax, eax
jne 0x18000a2c1
cmp dword [0x180054dac], eax
jne 0x18000a1b5
call fcn.180003840
mov dword [0x180054dac], 1
lea rdx, str.QQPLAYER.EXE
lea rcx, [0x180054dc0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x18000a1f1
xor ecx, ecx
call qword [0x180021490]
test eax, eax
je 0x18000a1df
call qword [sym.imp.USER32.dll_EmptyClipboard]
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleIsCurrentClipboard]
test eax, eax
je 0x18000a1f1
call qword [sym.imp.ole32.dll_OleFlushClipboard]
lea rdx, [0x180008c10]
lea rcx, [0x1800577f8]
call fcn.180011cc0
lea rdx, [0x180009e60]
lea rcx, [0x180057708]
call fcn.180011cc0
lea rdx, [0x180008c30]
lea rcx, [0x180057640]
call fcn.180011cc0
lea rdx, [0x180009e40]
lea rcx, [0x180057670]
call fcn.180011cc0
lea rdx, [0x180009e60]
lea rcx, [0x180057768]
call fcn.180011cc0
call fcn.180003e40
test eax, eax
jne 0x18000a27f
lea rdx, [0x180008c70]
lea rcx, [0x1800576a8]
call fcn.180011cc0
lea rdx, [0x180008ce0]
lea rcx, [0x180057808]
call fcn.180011cc0
lea rdx, [0x180008c70]
lea rcx, [0x1800576a8]
call fcn.180011cc0
cmp dword [0x180054dbc], 0
jne 0x18000a2c1
lea rdx, [0x180009420]
lea rcx, [0x1800576a0]
call fcn.180011cc0
lea rdx, [0x180009420]
lea rcx, [0x1800576d8]
call fcn.180011cc0
call fcn.180003d50
test eax, eax
je 0x18000a4c7
lea rdx, [0x1800058b0]
lea rcx, [0x180057600]
call fcn.180011cc0
mov eax, 1
add rsp, 0x30
pop rbx
ret
call fcn.180009520
call fcn.180009680
lea rdx, [0x180008180]
lea rcx, [0x1800577d8]
call fcn.180011cc0
mov eax, 1
add rsp, 0x30
pop rbx
ret
test edx, edx
jne 0x18000a4c7
lea rcx, str.pycPlus_DLL_PROCESS_DETACH__ul_reason_for_call
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call fcn.180003de0
test eax, eax
jne 0x18000a4c7
lea rcx, [0x180057660]
call fcn.180012130
lea rcx, [0x1800576f8]
call fcn.180012130
call fcn.180003cf0
test eax, eax
jne 0x18000a399
call fcn.180003d50
test eax, eax
jne 0x18000a399
lea rcx, [0x180057758]
call fcn.180012130
lea rcx, [0x180057788]
call fcn.180012130
cmp dword [0x180054db8], 0
je 0x18000a399
lea rcx, [0x1800576d0]
call fcn.180012130
lea rcx, [0x1800576b8]
call fcn.180012130
lea rcx, [0x180057840]
call fcn.180012130
lea rcx, [0x180057648]
call fcn.180012130
lea rcx, [0x180057668]
call fcn.180012130
lea rcx, [0x180057790]
call fcn.180012130
lea rcx, [0x180057728]
call fcn.180012130
lea rcx, [0x180057608]
call fcn.180012130
lea rcx, [0x180057760]
call fcn.180012130
lea rcx, [0x1800576c8]
call fcn.180012130
lea rcx, [0x1800577b0]
call fcn.180012130
call fcn.180003d50
test eax, eax
jne 0x18000a462
lea rcx, [0x180057708]
call fcn.180012130
lea rcx, [0x180057640]
call fcn.180012130
lea rcx, [0x180057670]
call fcn.180012130
lea rcx, [0x1800577f8]
call fcn.180012130
lea rcx, [0x180057768]
call fcn.180012130
lea rcx, [0x1800576a8]
call fcn.180012130
lea rcx, [0x180057808]
call fcn.180012130
lea rcx, [0x1800577f0]
call fcn.180012130
lea rcx, [0x1800577e8]
call fcn.180012130
cmp dword [0x180054dbc], 0
jne 0x18000a49b
lea rcx, [0x1800576a0]
call fcn.180012130
lea rcx, [0x1800576d8]
call fcn.180012130
mov rcx, qword [0x180054ec8]
test rcx, rcx
je 0x18000a4ad
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x180054518]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x180054898]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, 1
add rsp, 0x30
pop rbx
ret
push rbx
sub rsp, 0x180
mov rax, qword [0x180028020]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbx, rcx
cmp edx, 1
jne 0x18000a9c0
lea rcx, str.pycPlus_DLL_PROCESS_ATTACH__ul_reason_for_call
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [0x180054518]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x180054898]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.180009c30
lea r11, [rsp + 0x30]
mov qword [rsp + 0x28], r11
lea r8, [0x1800098e0]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x18000a5f7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x12b
mov byte [rsp + 0x40], 0
call sub.MSVCR100.dll_memset
lea r8, str.Rmsex__6493:OfficeEntryMainForWin8__DLL_PROCESS_ATTACH
lea rcx, [rsp + 0x40]
mov edx, 0x12c
call entry0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call fcn.1800012e0
cmp dword [0x180054dac], 0
mov qword [0x180054890], rbx
jne 0x18000a653
call fcn.180003840
mov dword [0x180054dac], 1
lea rdx, str.TASKMGR.EXE
lea rcx, [0x180054dc0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x18000a99e
lea rdx, str.TASKMGR.EXE.MUI
lea rcx, [0x180054dc0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x18000a99e
cmp dword [0x180054dac], 0
jne 0x18000a6a3
call fcn.180003840
mov dword [0x180054dac], 1
lea rdx, str.QQPLAYER.EXE
lea rcx, [0x180054dc0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x18000a6e1
call fcn.180009a90
lea r8, str.ApplyMess
xor edx, edx
mov ecx, 0xf001f
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
test rax, rax
je 0x18000a6e1
mov rcx, rax
call fcn.180004d70
call fcn.180003560
call fcn.18000f460
cmp dword [0x180054dac], 0
jne 0x18000a703
call fcn.180003840
mov dword [0x180054dac], 1
lea rdx, str.SPLWOW64.EXE
lea rcx, [0x180054dc0]
call qword [sym.imp.MSVCR100.dll__stricmp]
test eax, eax
je 0x18000a78b
lea rdx, [0x180008d30]
lea rcx, [0x180057660]
call fcn.180011cc0
lea rdx, [0x180005890]
lea rcx, [0x1800576f8]
call fcn.180011cc0
call fcn.180003d50
test eax, eax
jne 0x18000a78b
call fcn.180003bc0
test eax, eax
jne 0x18000a78b
call fcn.180003ed0
test eax, eax
jne 0x18000a78b
call fcn.180003f50
test eax, eax
jne 0x18000a78b
lea rdx, [0x1800060d0]
lea rcx, [0x180057758]
call fcn.180011cc0
lea rdx, [0x180005bd0]
lea rcx, [0x180057788]
call fcn.180011cc0
lea rdx, [0x180008f30]
lea rcx, [0x180057840]
call fcn.180011cc0
lea rdx, [0x1800090c0]
lea rcx, [0x180057648]
call fcn.180011cc0
lea rdx, [0x180007170]
lea rcx, [0x180057668]
call fcn.180011cc0
lea rdx, [0x180007a80]
lea rcx, [0x180057728]
call fcn.180011cc0
lea rdx, [0x180008260]
lea rcx, [0x180057608]
call fcn.180011cc0
lea rdx, [0x180009430]
lea rcx, [0x1800577f0]
call fcn.180011cc0
lea rdx, [0x180009330]
lea rcx, [0x1800577e8]
call fcn.180011cc0
lea rdx, [0x180008960]
lea rcx, [0x180057760]
call fcn.180011cc0
lea rdx, [0x1800063d0]
lea rcx, [0x1800576c8]
call fcn.180011cc0
lea rdx, [0x1800065c0]
lea rcx, [0x1800577b0]
call fcn.180011cc0
call fcn.180003d50
test eax, eax
jne 0x18000a979
cmp dword [0x180054dac], eax
jne 0x18000a86d
call fcn.180003840
mov dword [0x180054dac], 1
lea rdx, str.QQPLAYER.EXE
lea rcx, [0x180054dc0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x18000a8a9
xor ecx, ecx
call qword [0x180021490]
test eax, eax
je 0x18000a897
call qword [sym.imp.USER32.dll_EmptyClipboard]
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleIsCurrentClipboard]
test eax, eax
je 0x18000a8a9
call qword [sym.imp.ole32.dll_OleFlushClipboard]
lea rdx, [0x180009e60]
lea rcx, [0x180057708]
call fcn.180011cc0
lea rdx, [0x180008c30]
lea rcx, [0x180057640]
call fcn.180011cc0
lea rdx, [0x180009e40]
lea rcx, [0x180057670]
call fcn.180011cc0
lea rdx, [0x180008c10]
lea rcx, [0x1800577f8]
call fcn.180011cc0
lea rdx, [0x180009e60]
lea rcx, [0x180057768]
call fcn.180011cc0
call fcn.180003e40
test eax, eax
jne 0x18000a937
lea rdx, [0x180008c70]
lea rcx, [0x1800576a8]
call fcn.180011cc0
lea rdx, [0x180008ce0]
lea rcx, [0x180057808]
call fcn.180011cc0
lea rdx, [0x180008c70]
lea rcx, [0x1800576a8]
call fcn.180011cc0
cmp dword [0x180054dbc], 0
jne 0x18000a979
lea rdx, [0x180009420]
lea rcx, [0x1800576a0]
call fcn.180011cc0
lea rdx, [0x180009420]
lea rcx, [0x1800576d8]
call fcn.180011cc0
call fcn.180003d50
test eax, eax
je 0x18000ab76
lea rdx, [0x1800058b0]
lea rcx, [0x180057600]
call fcn.180011cc0
jmp 0x18000ab76
call fcn.180009520
call fcn.180009680
lea rdx, [0x180008180]
lea rcx, [0x1800577d8]
call fcn.180011cc0
jmp 0x18000ab76
test edx, edx
jne 0x18000ab76
lea rcx, str.pycPlus_DLL_PROCESS_DETACH__ul_reason_for_call
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call fcn.180003de0
test eax, eax
jne 0x18000ab76
lea rcx, [0x180057660]
call fcn.180012130
lea rcx, [0x1800576f8]
call fcn.180012130
call fcn.180003cf0
test eax, eax
jne 0x18000aa24
call fcn.180003d50
test eax, eax
jne 0x18000aa24
lea rcx, [0x180057758]
call fcn.180012130
lea rcx, [0x180057788]
call fcn.180012130
lea rcx, [0x180057840]
call fcn.180012130
lea rcx, [0x180057648]
call fcn.180012130
lea rcx, [0x180057668]
call fcn.180012130
lea rcx, [0x180057790]
call fcn.180012130
lea rcx, [0x180057728]
call fcn.180012130
lea rcx, [0x180057608]
call fcn.180012130
lea rcx, [0x180057760]
call fcn.180012130
lea rcx, [0x1800576c8]
call fcn.180012130
lea rcx, [0x1800577b0]
call fcn.180012130
call fcn.180003d50
test eax, eax
jne 0x18000aaed
lea rcx, [0x180057708]
call fcn.180012130
lea rcx, [0x180057640]
call fcn.180012130
lea rcx, [0x180057670]
call fcn.180012130
lea rcx, [0x1800577f8]
call fcn.180012130
lea rcx, [0x180057768]
call fcn.180012130
lea rcx, [0x1800576a8]
call fcn.180012130
lea rcx, [0x180057808]
call fcn.180012130
lea rcx, [0x1800577f0]
call fcn.180012130
lea rcx, [0x1800577e8]
call fcn.180012130
lea rcx, [0x180057708]
call fcn.180012130
lea rcx, [0x180057640]
call fcn.180012130
lea rcx, [0x180057670]
call fcn.180012130
cmp dword [0x180054dbc], 0
jne 0x18000ab4a
lea rcx, [0x1800576a0]
call fcn.180012130
lea rcx, [0x1800576d8]
call fcn.180012130
mov rcx, qword [0x180054ec8]
test rcx, rcx
je 0x18000ab5c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x180054518]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x180054898]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, 1
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.18001eef0
add rsp, 0x180
pop rbx
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
call fcn.180003c60
test eax, eax
je 0x18000abd9
call fcn.180003c60
test eax, eax
je 0x18000abf3
lea rdx, [0x180054ed0]
lea rcx, [0x18002221c]
call qword [sym.imp.MSVCR100.dll__stricmp]
test eax, eax
jne 0x18000abf3
mov ecx, 2
call fcn.18000a4e0
test eax, eax
jne 0x18000ac5b
lea ecx, [rax + 3]
call fcn.18000a4e0
test eax, eax
jne 0x18000ac5b
call fcn.180003c60
test eax, eax
je 0x18000ac2d
call fcn.180003c60
test eax, eax
je 0x18000ac1d
lea rdx, [0x180054ed0]
lea rcx, [0x18002221c]
call qword [sym.imp.MSVCR100.dll__stricmp]
test eax, eax
je 0x18000ac2d
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x180054dc0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [0x180054ed0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, ebx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x180009e80
lea rcx, [0x180054dc0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [0x180054ed0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, ebx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x18000a570