Function at 0x18000af00
Capabilities:
Create pipe
Create thread
Enumerate gui resources
Get common file path
Get disk information
Identify system language via api
Log keystrokes via polling
Print debug messages
Read .ini file
Set uefi variable

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x100]
sub rsp, 0x200
xor r15d, r15d
cmp edx, 2
jne 0x18000b0fb
cmp dword [0x1800e90f8], 0x791a2a08
jne 0x18000bb5c
xor ecx, ecx
call qword [sym.imp.USER32.dll_DrawMenuBar]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_wvsprintfW]
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetUserObjectSecurity]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], r15
lea rax, [0x180101330]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x180101360]
call qword [sym.imp.KERNEL32.dll_GetDurationFormatEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUserPreferredUILanguages]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetCursorPos]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FrameRect]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetWindowLongW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemLanguageGroupsW]
xor ecx, ecx
xor edx, edx
call qword [sym.imp.USER32.dll_VkKeyScanExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleOriginalTitleW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLocalTime]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolTimerEx]
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateDialogParamW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetProcessRestrictionExemption]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
call qword [sym.imp.USER32.dll_ReleaseCapture]
jmp 0x18000bb5c
cmp edx, 1
jne 0x18000bb5c
lea r8, [0x1801013a0]
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
mov qword [rbp + 0x148], rax
xor ecx, ecx
test rax, rax
je 0x18000b30b
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x18000a350]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x48], rax
test rax, rax
je 0x18000b247
mov dword [rbp + 0x138], 0xffffffff
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rax, 0x1e0
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x68], 0x1e0
xor eax, eax
mov word [rsp + 0x40], ax
mov byte [rsp + 0x42], al
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
mov ecx, InitCommonControls
call fcn.180064838
mov qword [rax + 8], r15
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x48]
mov qword [rax], rcx
mov word [rsp + 0x78], r15w
mov qword [rsp + 0x7e], r15
mov qword [rbp - 0x7a], r15
xor eax, eax
mov word [rsp + 0x7b], ax
mov byte [rsp + 0x7d], al
mov word [rsp + 0x7e], ax
mov byte [rbp - 0x80], al
mov word [rbp - 0x7f], ax
mov byte [rbp - 0x7d], al
mov word [rbp - 0x7c], ax
mov byte [rbp - 0x7a], al
mov word [rbp - 0x79], ax
mov byte [rbp - 0x77], al
mov word [rbp - 0x76], ax
mov byte [rbp - 0x74], al
mov dword [rsp + 0x44], r15d
mov dword [rsp + 0x74], r15d
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x70], xmm0
lea r9, [rbp + 0x138]
lea r8, [rbp - 0x48]
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x40]
call fcn.180013890
nop
lea rcx, [rsp + 0x48]
call fcn.180017330
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x48], r15
mov edx, InitCommonControls
call fcn.18006474c
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
add rax, 0x20f
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x68], 0x20f
xor eax, eax
mov word [rsp + 0x40], ax
mov byte [rsp + 0x42], al
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
mov ecx, InitCommonControls
call fcn.180064838
mov qword [rax + 8], r15
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x48]
mov qword [rax], rcx
mov word [rsp + 0x78], 0
mov qword [rsp + 0x7e], r15
mov qword [rbp - 0x7a], r15
xor eax, eax
mov word [rsp + 0x7b], ax
mov byte [rsp + 0x7d], al
mov word [rsp + 0x7e], ax
mov byte [rbp - 0x80], al
mov word [rbp - 0x7f], ax
mov byte [rbp - 0x7d], al
mov word [rbp - 0x7c], ax
mov byte [rbp - 0x7a], al
mov word [rbp - 0x79], ax
mov byte [rbp - 0x77], al
mov word [rbp - 0x76], ax
mov byte [rbp - 0x74], al
mov dword [rsp + 0x44], r15d
mov dword [rsp + 0x74], r15d
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x70], xmm0
lea r8, [rbp + 0x148]
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x40]
call fcn.180015c50
nop
jmp 0x18000b7e1
lea r8, [0x1801013a0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rbp + 0x148], rax
test rax, rax
je 0x18000b7ff
xorps xmm0, xmm0
movups xmmword [rbp + 0x64], xmm0
movups xmmword [rbp + 0x74], xmm0
movups xmmword [rbp + 0x84], xmm0
movups xmmword [rbp + 0x94], xmm0
movups xmmword [rbp + 0xa4], xmm0
movups xmmword [rbp + 0xb4], xmm0
movups xmmword [rbp + 0xc4], xmm0
movups xmmword [rbp + 0xd4], xmm0
movups xmmword [rbp + 0xe4], xmm0
mov dword [rbp + 0x60], 0x94
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x18000b722
lea r9, [rbp - 0x5b]
mov ecx, dword [rbp + 0x68]
nop word [rax + rax]
dec r9
mov eax, 0xcccccccd
mul ecx
shr edx, 3
movzx eax, dl
shl al, 2
lea r8d, [rax + rdx]
add r8b, r8b
sub cl, r8b
add cl, 0x30
mov byte [r9], cl
mov ecx, edx
test edx, edx
jne 0x18000b390
lea r8, [rbp - 0x5b]
mov rdx, r9
lea rcx, [rbp + 0x40]
call fcn.180018400
nop
lea r9, [rbp - 0x5b]
mov r8d, dword [rbp + 0x64]
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x18000b3d2
lea r8, [rbp - 0x5b]
mov rdx, r9
lea rcx, [rbp - 0x40]
call fcn.180018400
nop
mov r8, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
sub rax, r8
mov r14d, reloc.COMCTL32.dll_InitCommonControls
lea rsi, [0x1801013c8]
cmp rax, r14
jb 0x18000b4a5
lea rax, [r8 + 0x11]
mov qword [rbp - 0x30], rax
lea rbx, [rbp - 0x40]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x40]
lea rax, [0x1801013d9]
cmp rax, rbx
jbe 0x18000b469
lea rax, [rbx + r8]
cmp rsi, rax
ja 0x18000b469
cmp rbx, rsi
ja 0x18000b461
mov rdi, r15
jmp 0x18000b46c
mov rdi, rbx
sub rdi, rsi
jmp 0x18000b46c
mov rdi, r14
lea rcx, [rbx + 0x11]
inc r8
mov rdx, rbx
call fcn.180088520
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.180088520
lea rcx, [rbx + rdi]
sub r14, rdi
lea rdx, [rsi + 0x11]
add rdx, rdi
mov r8, r14
call fcn.180088520
lea rax, [rbp - 0x40]
jmp 0x18000b4bb
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rsi
mov rdx, r14
lea rcx, [rbp - 0x40]
call fcn.180019300
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x10], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], InitCommonControls
mov byte [rax], 0
mov r8d, 1
lea rdx, [0x1801013c0]
lea rcx, [rbp - 0x20]
call fcn.18000ffd0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], InitCommonControls
mov byte [rax], 0
lea r9, [rbp + 0x40]
lea r8, [rbp - 0x70]
lea rcx, [rbp + 0x20]
call fcn.180017130
nop
mov r8d, 1
lea rdx, [0x180101298]
lea rcx, [rbp + 0x20]
call fcn.18000ffd0
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x10], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], InitCommonControls
mov byte [rax], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x18000b5ac
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b5a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000bb7e
call fcn.18006474c
movdqa xmm0, xmmword [0x1801014a0]
movdqu xmmword [rbp + 0x30], xmm0
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x18000b600
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b5f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000bb84
call fcn.18006474c
movdqa xmm0, xmmword [0x1801014a0]
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x18000b643
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b636
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000bb8a
call fcn.18006474c
movdqa xmm0, xmmword [0x1801014a0]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x18000b68f
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b682
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000bb90
call fcn.18006474c
movdqa xmm0, xmmword [0x1801014a0]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x18000b6d3
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b6ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000bb96
call fcn.18006474c
lea rcx, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x18000b722
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b71d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000bb78
call fcn.18006474c
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
add rax, 0x24a
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x68], 0x24a
xor eax, eax
mov word [rsp + 0x40], ax
mov byte [rsp + 0x42], al
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
mov ecx, InitCommonControls
call fcn.180064838
mov qword [rax + 8], r15
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x48]
mov qword [rax], rcx
mov word [rsp + 0x78], 0
mov qword [rsp + 0x7e], r15
mov qword [rbp - 0x7a], r15
xor eax, eax
mov word [rsp + 0x7b], ax
mov byte [rsp + 0x7d], al
mov word [rsp + 0x7e], ax
mov byte [rbp - 0x80], al
mov word [rbp - 0x7f], ax
mov byte [rbp - 0x7d], al
mov word [rbp - 0x7c], ax
mov byte [rbp - 0x7a], al
mov word [rbp - 0x79], ax
mov byte [rbp - 0x77], al
mov word [rbp - 0x76], ax
mov byte [rbp - 0x74], al
mov dword [rsp + 0x44], r15d
mov dword [rsp + 0x74], r15d
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x70], xmm0
lea r8, [rbp + 0x148]
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x40]
call fcn.180015c50
nop
lea rcx, [rsp + 0x48]
call fcn.180017330
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x48], r15
mov edx, InitCommonControls
call fcn.18006474c
lea rax, [0x180008c70]
add rax, 0x29b
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x68], 0x29b
xor eax, eax
mov word [rsp + 0x40], ax
mov byte [rsp + 0x42], al
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
mov ecx, InitCommonControls
call fcn.180064838
mov qword [rax + 8], r15
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x48]
mov qword [rax], rcx
mov word [rsp + 0x78], 0
mov qword [rsp + 0x7e], r15
mov qword [rbp - 0x7a], r15
xor eax, eax
mov word [rsp + 0x7b], ax
mov byte [rsp + 0x7d], al
mov word [rsp + 0x7e], ax
mov byte [rbp - 0x80], al
mov word [rbp - 0x7f], ax
mov byte [rbp - 0x7d], al
mov word [rbp - 0x7c], ax
mov byte [rbp - 0x7a], al
mov word [rbp - 0x79], ax
mov byte [rbp - 0x77], al
mov word [rbp - 0x76], ax
mov byte [rbp - 0x74], al
mov dword [rsp + 0x44], r15d
mov dword [rsp + 0x74], r15d
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x70], xmm0
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x40]
call fcn.1800136b0
nop
lea rcx, [rsp + 0x48]
call fcn.180017330
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x48], r15
mov edx, InitCommonControls
call fcn.18006474c
cmp dword [0x1800e90f8], 0xf8028b8
jne 0x18000ba1e
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadGroupAffinity]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CompareStringW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsValidCodePage]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCompressedFileSizeTransactedW]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolWork]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCurrentConsoleFontEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTime]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProfileSectionW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumberEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CheckTokenCapability]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapSize]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMemoryErrorHandlingCapabilities]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
lea rax, [0x180008420]
add rax, 0x1bd
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x68], 0x1bd
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x70], xmm0
lea rcx, [rbp - 0x70]
call fcn.1800113e0
cmp dword [0x1800e90f8], 0xc7bf6244
jne 0x18000bb5c
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
call qword [sym.imp.KERNEL32.dll_FlushProcessWriteBuffers]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleFontSize]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClosePrivateNamespace]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadGroupAffinity]
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetOverlappedResultEx]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1801013e0]
call qword [sym.imp.KERNEL32.dll_OpenFile]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMaskEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFiber]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleOriginalTitleW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommTimeouts]
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProfileStringW]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreatePipe]
mov eax, 1
mov rbx, qword [rsp + 0x230]
add rsp, 0x200
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.18006f970
nop
call fcn.18006f970
nop
call fcn.18006f970
nop
call fcn.18006f970
nop
call fcn.18006f970
nop
call fcn.18006f970
int3