Function at 0x18003ff37
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x1800b1840
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x9e8
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x1aa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0xa08]
mov rax, qword [0x1801091a8]
xor rax, rbp
mov qword [rbp + 0x998], rax
lea rcx, [0x18011c332]
call fcn.1800414cc
lea rcx, [0x18010c498]
call fcn.18004124c
test eax, eax
je 0x1800b18b0
lea rcx, [0x1800f2478]
call fcn.18003f50a
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1800b1887
mov r8b, 1
lea rdx, [0x18010c498]
lea rcx, [rbp + 8]
call fcn.1800413fa
nop
mov qword [rbp + 0x38], 0
lea r8, [rbp + 0x38]
mov edx, dword [rbp + 0x9c0]
lea rcx, [0x18010c450]
call fcn.180040b08
movzx eax, al
test eax, eax
jne 0x1800b2081
mov ecx, dword [rbp + 0x9c0]
call sym.QtAccEnabler.dll_IsMatch
test eax, eax
jne 0x1800b191c
mov qword [rbp + 0x7e8], 0
lea rcx, [rbp + 8]
call fcn.180040a13
mov rax, qword [rbp + 0x7e8]
jmp 0x1800b2105
mov edx, 8
lea rcx, [rbp + 0x58]
call fcn.180040d88
mov r8d, dword [rbp + 0x9c0]
xor edx, edx
mov ecx, 0xc3a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdx, rax
lea rcx, [rbp + 0x58]
call fcn.180040ff4
nop
lea rcx, [rbp + 0x58]
call fcn.180040a4f
test rax, rax
jne 0x1800b198f
mov eax, dword [0x180109194]
add eax, 0x12
lea rcx, [0x1800f2438]
mov qword [rsp + 0x20], rcx
lea r9, str.GetBackendWorkChannel
mov r8d, eax
lea rdx, str.D:code_rdp.all_shadowbot.nativehelperQtAccEnablerQtHelper.cpp
mov ecx, 2
call fcn.180041832
cmp eax, 1
jne 0x1800b198f
int3
xor eax, eax
test eax, eax
jne 0x1800b194b
lea rcx, [rbp + 0x58]
call fcn.180040a4f
test rax, rax
jne 0x1800b19cd
mov qword [rbp + 0x808], 0
lea rcx, [rbp + 0x58]
call fcn.18003fff0
nop
lea rcx, [rbp + 8]
call fcn.180040a13
mov rax, qword [rbp + 0x808]
jmp 0x1800b2105
lea rcx, [rbp + 0x58]
call fcn.180040a4f
lea rdx, [rbp + 0x78]
mov rcx, rax
call fcn.1800410a3
test eax, eax
jne 0x1800b202c
mov ecx, dword [rbp + 0x9c0]
call fcn.18003f5f0
test eax, eax
je 0x1800b1a05
mov dword [rbp + 0x994], 0x67
jmp 0x1800b1a0f
mov dword [rbp + 0x994], 0x68
mov eax, dword [rbp + 0x994]
mov dword [rbp + 0xa4], eax
call fcn.18003fe0b
lea r9, [rbp + 0xc4]
mov r8d, 0xa
mov edx, dword [rbp + 0xa4]
mov rcx, rax
call fcn.180040608
mov qword [rbp + 0xe8], rax
cmp qword [rbp + 0xe8], 0
jne 0x1800b1a82
mov eax, dword [0x180109194]
add eax, 0x32
lea rcx, str.pcbData
mov qword [rsp + 0x20], rcx
lea r9, str.GetBackendWorkChannel
mov r8d, eax
lea rdx, str.D:code_rdp.all_shadowbot.nativehelperQtAccEnablerQtHelper.cpp
mov ecx, 2
call fcn.180041832
cmp eax, 1
jne 0x1800b1a82
int3
xor eax, eax
test eax, eax
jne 0x1800b1a42
cmp qword [rbp + 0xe8], 0
jne 0x1800b1ad0
xor r8d, r8d
mov edx, 0x10
lea rcx, [0x1800f24d0]
call fcn.180040293
mov qword [rbp + 0x828], 0
lea rcx, [rbp + 0x58]
call fcn.18003fff0
nop
lea rcx, [rbp + 8]
call fcn.180040a13
mov rax, qword [rbp + 0x828]
jmp 0x1800b2105
mov edx, 8
lea rcx, [rbp + 0x108]
call fcn.180040df1
call fcn.180041247
mov rdx, rax
lea rcx, [rbp + 0x108]
call fcn.1800410cb
nop
lea rcx, [rbp + 0x108]
call fcn.180040842
mov ecx, dword [rbp + 0xc4]
mov r8, rax
mov edx, ecx
mov rcx, qword [rbp + 0xe8]
call fcn.180040eb4
test eax, eax
je 0x1800b1b68
xor r8d, r8d
mov edx, 0x10
lea rcx, [0x1800f24f0]
call fcn.180040293
mov qword [rbp + 0x848], 0
lea rcx, [rbp + 0x108]
call fcn.1800402b1
nop
lea rcx, [rbp + 0x58]
call fcn.18003fff0
nop
lea rcx, [rbp + 8]
call fcn.180040a13
mov rax, qword [rbp + 0x848]
jmp 0x1800b2105
lea rcx, [rbp + 0x108]
call fcn.180040842
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.1800412c4
mov qword [rbp + 0x148], rax
mov qword [rbp + 0x168], 0
mov dword [rbp + 0x184], 0x1000
mov dword [rbp + 0x1a4], 1
lea rcx, [rbp + 0x148]
call fcn.180040ae0
cmp dword [rbp + 0x1a4], 0
jne 0x1800b1c09
xor r8d, r8d
mov edx, 0x10
lea rcx, [0x1800f2510]
call fcn.180040293
mov qword [rbp + 0x868], 0
lea rcx, [rbp + 0x108]
call fcn.1800402b1
nop
lea rcx, [rbp + 0x58]
call fcn.18003fff0
nop
lea rcx, [rbp + 8]
call fcn.180040a13
mov rax, qword [rbp + 0x868]
jmp 0x1800b2105
lea rcx, [rbp + 0x58]
call fcn.180040a4f
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x1c8], rax
cmp qword [rbp + 0x1c8], 0
jne 0x1800b1c76
mov qword [rbp + 0x888], 0
lea rcx, [rbp + 0x108]
call fcn.1800402b1
nop
lea rcx, [rbp + 0x58]
call fcn.18003fff0
nop
lea rcx, [rbp + 8]
call fcn.180040a13
mov rax, qword [rbp + 0x888]
jmp 0x1800b2105
lea rcx, [rbp + 0x58]
call fcn.180040a4f
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x1c8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1800b1cd9
mov qword [rbp + 0x8a8], 0
lea rcx, [rbp + 0x108]
call fcn.1800402b1
nop
lea rcx, [rbp + 0x58]
call fcn.18003fff0
nop
lea rcx, [rbp + 8]
call fcn.180040a13
mov rax, qword [rbp + 0x8a8]
jmp 0x1800b2105
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.ucrtbased.dll_free]
mov qword [rbp + 0x168], 0
mov eax, 2
imul rax, rax, 0
mov qword [rbp + 0x8c8], rax
cmp qword [rbp + 0x8c8], 0x208
jae 0x1800b1d10
jmp 0x1800b1d15
call fcn.180040a77
xor eax, eax
mov rcx, qword [rbp + 0x8c8]
mov word [rbp + rcx + 0x220], ax
mov r8d, 0x104
lea rdx, [rbp + 0x220]
mov ecx, dword [rbp + 0x9c0]
call fcn.180041337
lea rcx, [rbp + 0x220]
call fcn.18003f1e5
mov dword [rbp + 0x444], eax
cmp dword [rbp + 0x444], 0
je 0x1800b1e16
lea rcx, [rbp + 0x58]
call fcn.180040a4f
mov dword [rsp + 0x20], 1
lea r9, [rbp + 0x1e8]
lea r8, str.BaseThreadInitThunk
lea rdx, [0x1800cfb58]
mov rcx, rax
call fcn.18004038d
mov dword [rbp + 0x464], eax
cmp dword [rbp + 0x464], 0
jne 0x1800b1dd0
mov eax, dword [0x180109194]
add eax, 0x72
lea rcx, str.bRestored
mov qword [rsp + 0x20], rcx
lea r9, str.GetBackendWorkChannel
mov r8d, eax
lea rdx, str.D:code_rdp.all_shadowbot.nativehelperQtAccEnablerQtHelper.cpp
mov ecx, 2
call fcn.180041832
cmp eax, 1
jne 0x1800b1dd0
int3
xor eax, eax
test eax, eax
jne 0x1800b1d91
cmp dword [rbp + 0x464], 0
jne 0x1800b1e16
mov qword [rbp + 0x8e8], 0
lea rcx, [rbp + 0x108]
call fcn.1800402b1
nop
lea rcx, [rbp + 0x58]
call fcn.18003fff0
nop
lea rcx, [rbp + 8]
call fcn.180040a13
mov rax, qword [rbp + 0x8e8]
jmp 0x1800b2105
lea rcx, [rbp + 0x58]
call fcn.180040a4f
lea rcx, [rbp + 0x484]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0x1c8]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.18003f3ac
mov qword [rbp + 0x4a8], rax
cmp qword [rbp + 0x4a8], 0
jne 0x1800b1e97
mov eax, dword [0x180109194]
add eax, 0x7b
lea rcx, str.thread
mov qword [rsp + 0x20], rcx
lea r9, str.GetBackendWorkChannel
mov r8d, eax
lea rdx, str.D:code_rdp.all_shadowbot.nativehelperQtAccEnablerQtHelper.cpp
mov ecx, 2
call fcn.180041832
cmp eax, 1
jne 0x1800b1e97
int3
xor eax, eax
test eax, eax
jne 0x1800b1e57
cmp qword [rbp + 0x4a8], 0
jne 0x1800b1ede
mov qword [rbp + 0x908], 0
lea rcx, [rbp + 0x108]
call fcn.1800402b1
nop
lea rcx, [rbp + 0x58]
call fcn.18003fff0
nop
lea rcx, [rbp + 8]
call fcn.180040a13
mov rax, qword [rbp + 0x908]
jmp 0x1800b2105
mov edx, 0x2710
mov rcx, qword [rbp + 0x4a8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1800b1f13
mov r9d, 0x30
lea r8, [0x1800d20b8]
lea rdx, [0x1800f2530]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rbp + 0x4a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x4a8], 0
lea rcx, [rbp + 0x58]
call fcn.180040a4f
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rbp + 0x1c8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov qword [rbp + 0x1c8], 0
cmp dword [rbp + 0x444], 0
je 0x1800b2020
lea rcx, [rbp + 0x58]
call fcn.180040a4f
mov dword [rsp + 0x20], 0
lea r9, [rbp + 0x1e8]
lea r8, str.BaseThreadInitThunk
lea rdx, [0x1800cfb58]
mov rcx, rax
call fcn.18004038d
mov dword [rbp + 0x4c4], eax
cmp dword [rbp + 0x4c4], 0
jne 0x1800b1fda
mov eax, dword [0x180109194]
add eax, 0x8e
lea rcx, str.bRestored
mov qword [rsp + 0x20], rcx
lea r9, str.GetBackendWorkChannel
mov r8d, eax
lea rdx, str.D:code_rdp.all_shadowbot.nativehelperQtAccEnablerQtHelper.cpp
mov ecx, 2
call fcn.180041832
cmp eax, 1
jne 0x1800b1fda
int3
xor eax, eax
test eax, eax
jne 0x1800b1f99
cmp dword [rbp + 0x4c4], 0
jne 0x1800b2020
mov qword [rbp + 0x928], 0
lea rcx, [rbp + 0x108]
call fcn.1800402b1
nop
lea rcx, [rbp + 0x58]
call fcn.18003fff0
nop
lea rcx, [rbp + 8]
call fcn.180040a13
mov rax, qword [rbp + 0x928]
jmp 0x1800b2105
lea rcx, [rbp + 0x108]
call fcn.1800402b1
lea rcx, [rbp + 0x58]
call fcn.180040a4f
lea rdx, [rbp + 0x78]
mov rcx, rax
call fcn.1800410a3
test eax, eax
je 0x1800b2078
mov ecx, 1
call fcn.18003f172
mov qword [rbp + 0x948], rax
mov rax, qword [rbp + 0x948]
mov qword [rbp + 0x38], rax
lea r8, [rbp + 0x38]
mov edx, dword [rbp + 0x9c0]
lea rcx, [0x18010c450]
call fcn.18003f681
nop
lea rcx, [rbp + 0x58]
call fcn.18003fff0
cmp qword [rbp + 0x38], 0
jne 0x1800b20c0
mov eax, dword [0x180109194]
add eax, 0xa4
lea rcx, str.pBackendWorkChannel
mov qword [rsp + 0x20], rcx
lea r9, str.GetBackendWorkChannel
mov r8d, eax
lea rdx, str.D:code_rdp.all_shadowbot.nativehelperQtAccEnablerQtHelper.cpp
mov ecx, 2
call fcn.180041832
cmp eax, 1
jne 0x1800b20c0
int3
xor eax, eax
test eax, eax
jne 0x1800b2081
cmp qword [rbp + 0x38], 0
jne 0x1800b20ea
mov qword [rbp + 0x968], 0
lea rcx, [rbp + 8]
call fcn.180040a13
mov rax, qword [rbp + 0x968]
jmp 0x1800b2105
mov rax, qword [rbp + 0x38]
mov qword [rbp + 0x988], rax
lea rcx, [rbp + 8]
call fcn.180040a13
mov rax, qword [rbp + 0x988]
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, reloc.WS2_32.dll_inet_addr
call fcn.180040eaa
mov rax, rdi
mov rcx, qword [rbp + 0x998]
xor rcx, rbp
call fcn.18004016c
lea rsp, [rbp + 0x9a8]
pop rdi
pop rbp
ret