Function at 0x180001ca0
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x160
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x150], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
lea rdx, str._d:_6829
lea rcx, [rsp + 0x20]
call fcn.180002130
lea r8, [rsp + 0x20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
lea rcx, str.wpcap.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x180001fe3
lea rcx, str.packet.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x180001fe3
mov qword [rsp + 0x170], rsi
lea rdx, [rsp + 0x40]
mov r8d, 0x104
mov qword [rsp + 0x178], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor esi, esi
mov ebx, 1
mov edi, esi
xor eax, eax
lock cmpxchg dword [0x180025198], ebx
je 0x180001d69
cmp rdi, 0x20
jae 0x180001d52
xor ecx, ecx
jmp 0x180001d54
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rdi
xor eax, eax
lock cmpxchg dword [0x180025198], ebx
jne 0x180001d48
cmp qword [0x1800251a0], rsi
jne 0x180001d86
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [0x1800251a0], rax
mov eax, esi
lea rcx, str.ntdll.dll
xchg dword [0x180025198], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180001dcb
lea rdx, str.NtUserQueryWindow
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180001dcb
lea r8, [0x180025160]
mov rcx, rax
lea rdx, [0x1800011f0]
call fcn.1800031f0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180001e08
lea rdx, str.NtUserGetForegroundWindow
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180001e08
lea r8, [0x180025170]
mov rcx, rax
lea rdx, [0x1800012d0]
call fcn.1800031f0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180001e45
lea rdx, str.NtOpenProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180001e45
lea r8, [0x180025190]
mov rcx, rax
lea rdx, [0x180001a80]
call fcn.1800031f0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180001e82
lea rdx, str.NtQuerySystemInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180001e82
lea r8, [0x180025178]
mov rcx, rax
lea rdx, [0x1800018b0]
call fcn.1800031f0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180001ebf
lea rdx, str.NtQueryDirectoryFile
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180001ebf
lea r8, [0x180025168]
mov rcx, rax
lea rdx, [0x1800013b0]
call fcn.1800031f0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180001efc
lea rdx, str.NtQueryDirectoryFileEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180001efc
lea r8, [0x180025168]
mov rcx, rax
lea rdx, [0x1800013b0]
call fcn.1800031f0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180001f39
lea rdx, str.NtEnumerateValueKey
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180001f39
lea r8, [0x180025180]
mov rcx, rax
lea rdx, [0x180001bc0]
call fcn.1800031f0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180001f76
lea rdx, str.NtDeleteValueKey
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180001f76
lea r8, [0x180025188]
mov rcx, rax
lea rdx, [0x180001b50]
call fcn.1800031f0
mov rdi, rsi
xor eax, eax
lock cmpxchg dword [0x180025198], ebx
je 0x180001fa6
cmp rdi, 0x20
jae 0x180001f8f
xor ecx, ecx
jmp 0x180001f91
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rdi
xor eax, eax
lock cmpxchg dword [0x180025198], ebx
jne 0x180001f85
cmp qword [0x1800251a0], rsi
mov rdi, qword [rsp + 0x178]
je 0x180001fbc
call fcn.1800030b0
xchg dword [0x180025198], esi
mov rsi, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180003a00
add rsp, 0x160
pop rbx
ret
mov ecx, 1
call fcn.1800075a0
int3