Function at 0x180007250
Capabilities:
Connect pipe
Create directory
Create mailslot
Create pipe
Delete directory
Get common file path
Get geographical location
Get memory capacity
Get uefi variable
Identify system language via api
Move file
Read .ini file
Set console window title

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
cmp dword [0x18007bda4], 0x3d401d93
jne 0x1800073b2
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadSelectorEntry]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolWait]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolWait]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileIoOverlappedRange]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleHistoryInfo]
mov eax, dword [rsp + 0x8c]
mov dword [rsp + 0x78], eax
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x78]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputAttribute]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityUpdateMode]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
mov dword [rsp + 0x54], 0
jmp 0x1800073c7
mov eax, dword [rsp + 0x54]
add eax, 8
mov dword [rsp + 0x54], eax
mov eax, dword [0x18007bdac]
cmp dword [rsp + 0x54], eax
jae 0x180007ec0
mov eax, dword [rsp + 0x54]
mov rcx, qword [rsp + 0xb8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
cmp dword [0x18007bda4], 0x43094116
jne 0x1800074f0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueueEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForThreadpoolWaitCallbacks]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleSelectionInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumberEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolTimer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteSynchronizationBarrier]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryTransactedW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeServerProcessId]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UpdateResourceW]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockFileEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemTimes]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
xor eax, eax
mov dword [rsp + 0x7c], eax
xor ecx, ecx
xor eax, eax
mov edx, dword [rsp + 0x7c]
lock cmpxchg dword [rcx], edx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
xor r9d, r9d
xor r8d, r8d
lea rdx, str.eiYWHtIKhKnZqTMBHkZutJuqLKIy
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumDateFormatsExEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InterlockedFlushSList]
mov eax, dword [rsp + 0x54]
mov rcx, qword [rsp + 0xb8]
lea rax, [rcx + rax + 4]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x64], 0
cmp dword [0x18007bda4], 0xdcc5d34
jne 0x180007713
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlUnwind]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUILanguageInfo]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceLanguagesW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDevicePowerState]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPreferredUILanguages]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rax, str.oENEziJmvohLwkJGoxAi
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.eTnnRlOEdIiaduSWmgD
call qword [sym.imp.KERNEL32.dll_GetDurationFormatEx]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetTapePosition]
call qword [sym.imp.KERNEL32.dll_FlushProcessWriteBuffers]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WakeConditionVariable]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rax, str.jxpGXJsNerEgPPppZJVZH
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, str.tqpneIySPVXlpUODYmYX
xor edx, edx
lea rcx, str.FEhXybzrZQxDfHU
call qword [sym.imp.KERNEL32.dll_CompareStringEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommTimeouts]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
call qword [sym.imp.KERNEL32.dll_UnregisterApplicationRestart]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x80], eax
mov edx, dword [rsp + 0x80]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.mrcapjwlNyRGjlWBjqUQkOyqrWaF
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x60], 4
mov dword [rsp + 0x50], 0
mov eax, dword [rsp + 0x60]
lea eax, [rax*4 + 0x1f]
mov dword [rsp + 0x50], eax
jmp 0x18000773e
mov eax, dword [rsp + 0x50]
dec eax
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0xffffffff
je 0x180007ebb
mov rax, qword [rsp + 0x68]
mov eax, dword [rax]
mov dword [rsp + 0x64], eax
mov rax, qword [rsp + 0x68]
mov eax, dword [rax]
shl eax, 6
mov dword [rsp + 0x58], eax
mov eax, dword [0x18007bda4]
mov ecx, 0x8c5b691f
cmp rax, rcx
jne 0x180007891
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TerminateJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryUnbiasedInterruptTime]
call qword [sym.imp.KERNEL32.dll_IsThreadAFiber]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolWait]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumUILanguagesW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommMask]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameW]
call qword [sym.imp.KERNEL32.dll_GetErrorMode]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemGeoID]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiberEx]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenFileById]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpool]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryDepthSList]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_StartThreadpoolIo]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProfileStringW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
mov rax, qword [rsp + 0x68]
mov eax, dword [rax]
shr eax, 8
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x58]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x84], eax
xor edx, edx
mov eax, dword [rsp + 0x50]
div dword [rsp + 0x60]
mov eax, edx
mov eax, eax
mov edx, eax
mov rcx, qword [rsp + 0xb0]
call fcn.180009a30
mov ecx, dword [rsp + 0x84]
add ecx, dword [rax]
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [0x18007bda4]
mov ecx, 0xdf349f95
cmp rax, rcx
jne 0x180007ac5
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryTransactedW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CommConfigDialogW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSizeEx]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProfileStringW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroupMembers]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalFlags]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Beep]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessDEPPolicy]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.yEoryQxFNfHavbrsNzfeSoP
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStringScripts]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolThreadMinimum]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalProcessorInformation]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeSRWLock]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemPreferredUILanguages]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStructW]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsBadWritePtr]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.TAiWYTljTjRMijzhSoRN
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStringTypeA]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleProcessList]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CheckTokenMembershipEx]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov rax, qword [rsp + 0x68]
mov eax, dword [rax]
add eax, dword [rsp + 0x58]
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x5c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [0x18007bda4]
mov ecx, 0xa0d42026
cmp rax, rcx
jne 0x180007d1d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolTimer]
lea rdx, str.DiuVJWFDrRWMKOvQpUZmBvORE
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStructW]
call qword [sym.imp.KERNEL32.dll_CreateTimerQueue]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.pjjNRMPBaMlfNnBnH
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadGroupAffinity]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileCompletionNotificationModes]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, str.nwqzegLJCJKCHxZTdmEZMpuDzO
xor r8d, r8d
lea rdx, str.SBNFCTOJRxpeMHtDqt
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoExEx]
mov dword [rsp + 0x20], 0
lea r9, str.ZrHyBMzPfOUXSIF
xor r8d, r8d
lea rdx, str.AwoERcWtOQRsXHtTReYPqRfSDH
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerifyScripts]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadSelectorEntry]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapSize]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingNumaW]
call qword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockFileEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileIoOverlappedRange]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rax, qword [rsp + 0x70]
mov ecx, dword [rsp + 0x58]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x70]
mov dword [rcx], eax
mov rax, qword [rsp + 0x70]
mov eax, dword [rax]
mov dword [rsp + 0x88], eax
mov eax, dword [0x18007bda4]
mov ecx, 0xf6d40a7e
cmp rax, rcx
jne 0x180007e9d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RequestWakeupLatency]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PowerSetRequest]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryDepthSList]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.SHBeYTmQkBIXqss
xor edx, edx
lea rcx, str.OJIBLPxfTYQFkyjqwaKDFMQOf
call qword [sym.imp.KERNEL32.dll_GetCurrencyFormatEx]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProfileStringW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTime]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SearchPathW]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddScopedPolicyIDAce]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalSize]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SubmitThreadpoolWork]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMailslotW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TrySubmitThreadpoolCallback]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferInfoEx]
mov rax, qword [rsp + 0x68]
mov ecx, dword [rsp + 0x88]
mov dword [rax], ecx
mov rax, qword [rsp + 0x70]
mov ecx, dword [rsp + 0x64]
mov dword [rax], ecx
jmp 0x180007734
jmp 0x1800073bc
add rsp, 0xa8
ret