Function at 0x180009c40
Capabilities:
Enumerate gui resources
Get common file path
Log keystrokes
Terminate process

Disassembly:
push rbx
sub rsp, 0x190
cmp edx, 1
jne 0x180009e6f
mov dword [rsp + 0x38], 0x21b
lea rax, [0x180009120]
add rax, 0x21b
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.18000fdf0
mov dword [rsp + 0x38], 0x129
lea rax, [0x180009830]
add rax, 0x129
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.180012190
xor ecx, ecx
call fcn.18008b19c
mov ecx, eax
call fcn.180087d94
mov dword [rsp + 0x38], 0x1ce
lea rbx, [0x1800095a0]
lea rax, [rbx + 0x1ce]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0xb0]
movaps xmm0, xmmword [rsp + 0x30]
lea rcx, [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.180012310
mov dword [rsp + 0x38], 0x1ec
lea rdx, [rsp + 0x40]
add rbx, 0x1ec
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.180012310
mov dword [rsp + 0x38], 0x231
lea rax, [0x180009690]
add rax, 0x231
lea r9, [rsp + 0x120]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x40]
movaps xmm0, xmmword [rsp + 0x30]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.180012490
mov dword [rsp + 0x38], 0x29a
lea rax, [0x180004020]
add rax, 0x29a
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.18000fdf0
cmp dword [0x18010ccf0], 0x85dded6e
jne 0x180009e61
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindClose]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov r9d, dword [rsp + 0x1a8]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputAttribute]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetApplicationRecoveryCallback]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryThreadProfiling]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutexWhenCallbackReturns]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsBadCodePtr]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadGroupAffinity]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov eax, 1
add rsp, 0x190
pop rbx
ret
cmp edx, 2
je 0x180009e61
cmp edx, 3
jne 0x180009f87
cmp dword [0x18010ccf0], 0x87e0851d
jne 0x180009e61
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetComputerNameExW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AllocateUserPhysicalPagesNuma]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetCaretPos]
xor ecx, ecx
call qword [sym.imp.USER32.dll_HideCaret]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebx, ebx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MoveWindow]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FatalAppExitW]
lea rcx, [0x180125ff8]
call qword [sym.imp.KERNEL32.dll_IsValidLocaleName]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenEventW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMessageW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LookupIconIdFromDirectory]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryProcessCycleTime]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSymbolicLinkTransactedW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeDisconnect]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetClassLongW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetProcessRestrictionExemption]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDesktopsW]
mov eax, 1
add rsp, 0x190
pop rbx
ret
test edx, edx
jne 0x180009e61
mov r8d, 0x6e08
nop word [rax + rax]
inc r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
jne 0x180009fa0
lea edx, [r8 + 0x282f]
mov eax, 0x10a9
sub eax, edx
mov ecx, 0x9d9c
sub ecx, eax
add edx, ecx
sub ecx, edx
add eax, ecx
lea r10d, [rcx + 0x145ad]
add r10d, eax
lea r8d, [rax + 0x6887]
lea eax, [r10 + rdx*2]
lea r11d, [rax*2 + 0xf55]
lea r9d, [r10 + r10]
sub r9d, r11d
sub r9d, 0x1971
inc r11d
test r11b, 1
jne 0x18000a000
add r11d, r9d
lea r10d, [r10*2 - 0xa87e]
sub r10d, r9d
mov eax, 0x55555556
imul r8d
sub r9d, r10d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
je 0x18000a05a
nop dword [rax]
nop word [rax + rax]
inc r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
jne 0x18000a040
sub r8d, 0xb66
mov ecx, r8d
and ecx, 0x80000003
jge 0x18000a073
dec ecx
or ecx, 0xfffffffc
inc ecx
test ecx, ecx
mov edx, 0xffffe83a
lea ecx, [r9 - 0xade]
mov eax, 0xffffe654
cmove eax, edx
lea r9d, [rcx + 0x33bd]
add eax, r8d
lea r9d, [r9 + r11]
lea r11d, [r11*2 - 0x2104]
lea r8d, [rax + rcx]
add eax, r10d
mov ecx, 0x2777
lea r10d, [rax*2 + 0x2206]
mov eax, 0x55555556
imul r10d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov edx, r10d
sub edx, eax
mov eax, 0x6881
cmove ecx, eax
mov eax, 0xffffe227
sub ecx, r9d
add ecx, r8d
mov r8d, 0x2029
add ecx, r10d
sub eax, ecx
sub eax, r11d
add r11d, 0x141b
add r9d, eax
mov eax, 0xffffdf1f
test edx, edx
cmove eax, r8d
mov r8d, 0x1e11
sub ecx, eax
mov eax, 0x522
sub ecx, r11d
sub ecx, r10d
lea ebx, [rcx*2 - 0x1e11]
sub eax, ebx
add r9d, eax
mov eax, 0xded
sub eax, r9d
add r11d, eax
add r9d, 0x2003
nop dword [rax]
nop word [rax + rax]
inc r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
jne 0x18000a140
add r9d, r11d
mov eax, 0x55555556
sub r11d, r9d
sub r9d, 0x17aa
imul r9d
lea r10d, [r11 + 0x2733]
mov r11d, 0x2bc0
mov eax, edx
sub ebx, r10d
shr eax, 0x1f
sub r11d, r9d
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r9d, ecx
je 0x18000a19d
test r9d, r9d
jle 0x18000a19d
add r9d, 0x19f0
lea edx, [rbx - 0x738]
mov eax, 0xffffed17
sub eax, edx
mov ecx, 0xffffffcb
add r11d, eax
mov eax, 0xffffec27
sub eax, r11d
add r10d, eax
lea eax, [r8 + r8]
sub ecx, eax
lea eax, [r8 + r9*2]
add edx, ecx
cmp eax, 0xfffc6864
jne 0x18000a1fa
sub r10d, edx
cmp r10d, 0x176e7f
jne 0x18000a1fa
cmp r11d, 0x1713a4
jne 0x18000a1fa
cmp edx, 0xffeaa3b1
jne 0x18000a1fa
cmp r8d, 0x1e12
je 0x180009e61
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]