Function at 0x180007f80
Capabilities:
Allocate or change rwx memory
Resume thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x2f]
sub rsp, 0xa0
mov rbx, qword [0x180029098]
xor esi, esi
mov rax, r9
mov r14, rdx
mov rdi, rcx
test rbx, rbx
jne 0x180007ff7
lea ecx, [rsi + 0x30]
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov rbx, rax
test rax, rax
je 0x180007fe9
lea edx, [rsi + 1]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x28], rsi
mov qword [rax + 0x20], rsi
mov dword [rax + 0x10], esi
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx], rax
jmp 0x180007fec
mov rbx, rsi
mov rax, qword [rbp + 0x77]
mov qword [0x180029098], rbx
mov rbx, qword [rbx + 8]
cmp dword [rbx], 0x504c5547
je 0x180008016
mov eax, reloc.ODBC32.dll_SQLFetch
add rsp, 0xa0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov qword [rbp - 9], rax
mov eax, dword [rbp + 0x7f]
mov qword [rbp - 0x19], rsi
mov dword [rbp - 0x11], esi
mov dword [rbp - 1], eax
mov rax, qword [rbx + 0x28]
mov qword [rbp + 7], rax
mov eax, dword [rbx + 0x30]
lea rdx, [rbp - 0x31]
mov rcx, rdi
mov qword [rbp - 0x31], rsi
mov dword [rbp + 0xf], eax
call fcn.180008a90
test eax, eax
jne 0x180008360
mov r9d, 0x1000
mov qword [rsp + 0xd0], r12
xor edx, edx
mov rcx, rdi
mov r8d, r9d
mov qword [rsp + 0x98], r13
mov qword [rsp + 0x90], r15
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
xor edx, edx
mov r9d, 0x1000
mov rcx, rdi
lea r8d, [rdx + 0x30]
mov r15, rax
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
movsxd r8, dword [rbp - 1]
xor edx, edx
mov r9d, 0x1000
mov rcx, rdi
mov dword [rsp + 0x20], 4
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
movsxd r8, dword [rbp + 0xf]
xor edx, edx
mov r9d, 0x1000
mov rcx, rdi
mov r13, rax
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r12, rax
test r15, r15
je 0x1800082ce
test rsi, rsi
je 0x1800082ce
test r13, r13
je 0x1800082ce
test rax, rax
je 0x1800082ce
lea r8, [0x180008370]
mov qword [rbp - 9], r13
mov qword [rbp + 7], rax
cmp byte [r8], 0xe9
jne 0x180008128
mov ecx, dword [r8 + 1]
add r8, rcx
add r8, 5
lea rax, [rbp - 0x39]
mov r9d, 0x1000
mov rdx, r15
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1800082ce
lea rax, [rbp - 0x39]
lea r8, [rbp - 0x19]
mov r9d, 0x30
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1800082ce
movsxd r9, dword [rbp + 0x7f]
mov r8, qword [rbp + 0x77]
lea rax, [rbp - 0x39]
mov rdx, r13
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1800082ce
movsxd r9, dword [rbx + 0x30]
mov r8, qword [rbx + 0x28]
lea rax, [rbp - 0x39]
mov rdx, r12
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1800082ce
mov rbx, qword [rbp - 0x31]
mov eax, esi
mov ecx, r15d
shr eax, 8
sub ecx, ebx
mov r9d, 0x40
mov byte [rbp - 0x27], al
sub ecx, 0xa
mov eax, esi
shr eax, 0x10
mov dword [rbp - 0x41], ecx
mov byte [rbp - 0x23], cl
mov byte [rbp - 0x26], al
mov eax, esi
lea r8d, [r9 - 0x30]
shr eax, 0x18
mov rdx, rbx
mov byte [rbp - 0x29], 0x68
mov byte [rbp - 0x25], al
mov eax, ecx
mov byte [rbp - 0x28], sil
shr eax, 8
mov byte [rbp - 0x24], pe_nt_image_headers64
mov byte [rbp - 0x1f], 0xc3
mov byte [rbp - 0x22], al
mov eax, ecx
shr ecx, 0x18
shr eax, 0x10
mov byte [rbp - 0x20], cl
mov rcx, rdi
mov byte [rbp - 0x21], al
lea rax, [rbp - 0x41]
mov qword [rbp - 0x39], SQLNumResultCols
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1800082ce
lea rax, [rbp - 0x39]
lea r8, [rbp - 0x29]
mov r9d, SQLNumResultCols
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1800082ce
mov r9d, dword [rbp - 0x41]
lea rax, [rbp - 0x41]
mov r8d, SQLNumResultCols
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1800082ce
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
je 0x1800082ce
or edx, 0xffffffff
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp - 0x3d]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x1800082b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1800082b8
mov ebx, dword [rbp - 0x3d]
mov rcx, qword [rbp + 0x6f]
movsxd rax, ebx
mov qword [rcx], rax
cmp ebx, 0x10000
jl 0x1800082d6
xor ebx, ebx
jmp 0x1800082d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test r15, r15
je 0x1800082f0
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r15, qword [rsp + 0x90]
test rsi, rsi
je 0x180008312
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test r13, r13
je 0x180008330
test ebx, ebx
je 0x180008330
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r13
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r13, qword [rsp + 0x98]
test r12, r12
je 0x180008356
test ebx, ebx
je 0x180008356
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r12, qword [rsp + 0xd0]
mov eax, ebx
add rsp, 0xa0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret