Function at 0x180009008
Capabilities:
Create process on windows
Get keyboard layout

Disassembly:
push rbx
sub rsp, 0x60
mov ebx, edx
test edx, edx
je 0x180009021
mov eax, 0x461160bc
mov dword [0x180101cc4], eax
jmp 0x180009027
mov eax, dword [0x180101cc4]
cmp eax, 0xfae92e27
jne 0x1800091d6
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetLastInputInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetOverlappedResultEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetMenuContextHelpId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolThreadMinimum]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapValidate]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetClipCursor]
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterClassExW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
lea rdx, str.7p3ZV7KKq89s8H2ZTW1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadDescription]
and qword [rsp + 0x48], 0
xor r9d, r9d
and qword [rsp + 0x40], 0
xor r8d, r8d
and qword [rsp + 0x38], 0
xor edx, edx
and qword [rsp + 0x30], 0
xor ecx, ecx
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadDescription]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapQueryInformation]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FoldStringW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsDialogMessageW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentConsoleFontEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetMenuItemInfoW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsBadCodePtr]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AllocateUserPhysicalPages]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PowerClearRequest]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlCaptureStackBackTrace]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphoreWhenCallbackReturns]
cmp ebx, 1
jne 0x180009208
mov ecx, 0x252
lea rax, [0x180008aac]
mov dword [rsp + 0x58], ecx
add rax, rcx
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.18000d660
mov eax, 1
add rsp, 0x60
pop rbx
ret