Function at 0x18000b230
Capabilities:
Create pipe
Create thread
Get common file path
Get system information on windows
Print debug messages
Terminate process
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x110]
sub rsp, 0x210
xor r15d, r15d
cmp edx, 2
jne 0x18000b43c
cmp dword [0x1800e9518], 0xc0438ef9
jne 0x18000bf5a
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CloseWindow]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumClipboardFormats]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
xor edx, edx
lea rcx, [0x1801014b0]
call qword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_InSendMessageEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumberOfConsoleInputEvents]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplayDevicesW]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateCursor]
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ChangeDisplaySettingsExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalSize]
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MoveWindow]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DrawFocusRect]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveSecureMemoryCacheCallback]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMenuContextHelpId]
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CheckNameLegalDOS8Dot3W]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetLayeredWindowAttributes]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
call qword [sym.imp.KERNEL32.dll_GetThreadErrorMode]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CheckRadioButton]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_UserHandleGrantAccess]
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetWaitableTimerEx]
jmp 0x18000bf5a
cmp edx, 1
jne 0x18000bf5a
lea r8, [0x1801014e8]
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
mov qword [rbp + 0x158], rax
xor ecx, ecx
test rax, rax
je 0x18000b640
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x18000a620]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x38], rax
test rax, rax
je 0x18000b582
mov dword [rbp + 0x148], 0xffffffff
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rax, 0x29f
mov qword [rbp - 0x60], rax
mov dword [rbp - 0x58], 0x29f
xor eax, eax
mov word [rsp + 0x50], ax
mov byte [rsp + 0x52], al
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov ecx, InitCommonControls
call fcn.1800680a8
mov qword [rax + 8], r15
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x58]
mov qword [rax], rcx
mov word [rbp - 0x78], r15w
mov qword [rbp - 0x72], r15
mov qword [rbp - 0x6a], r15
xor eax, eax
mov word [rbp - 0x75], ax
mov byte [rbp - 0x73], al
mov word [rbp - 0x72], ax
mov byte [rbp - 0x70], al
mov word [rbp - 0x6f], ax
mov byte [rbp - 0x6d], al
mov word [rbp - 0x6c], ax
mov byte [rbp - 0x6a], al
mov word [rbp - 0x69], ax
mov byte [rbp - 0x67], al
mov word [rbp - 0x66], ax
mov byte [rbp - 0x64], al
mov dword [rsp + 0x54], r15d
mov dword [rbp - 0x7c], r15d
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
lea r9, [rbp + 0x148]
lea r8, [rbp - 0x38]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x50]
call fcn.180013b70
nop
lea rcx, [rsp + 0x58]
call fcn.180016da0
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x58], r15
mov edx, InitCommonControls
call fcn.180067fbc
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
add rax, 0x161
mov qword [rbp - 0x60], rax
mov dword [rbp - 0x58], 0x161
xor eax, eax
mov word [rsp + 0x50], ax
mov byte [rsp + 0x52], al
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov ecx, InitCommonControls
call fcn.1800680a8
mov qword [rax + 8], r15
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x58]
mov qword [rax], rcx
mov word [rbp - 0x78], 0
mov qword [rbp - 0x72], r15
mov qword [rbp - 0x6a], r15
xor eax, eax
mov word [rbp - 0x75], ax
mov byte [rbp - 0x73], al
mov word [rbp - 0x72], ax
mov byte [rbp - 0x70], al
mov word [rbp - 0x6f], ax
mov byte [rbp - 0x6d], al
mov word [rbp - 0x6c], ax
mov byte [rbp - 0x6a], al
mov word [rbp - 0x69], ax
mov byte [rbp - 0x67], al
mov word [rbp - 0x66], ax
mov byte [rbp - 0x64], al
mov dword [rsp + 0x54], r15d
mov dword [rbp - 0x7c], r15d
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
lea r8, [rbp + 0x158]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x50]
call fcn.1800159a0
nop
jmp 0x18000bb0b
lea r8, [0x1801014e8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rbp + 0x158], rax
test rax, rax
je 0x18000bb29
xorps xmm0, xmm0
movups xmmword [rbp + 0x74], xmm0
movups xmmword [rbp + 0x84], xmm0
movups xmmword [rbp + 0x94], xmm0
movups xmmword [rbp + 0xa4], xmm0
movups xmmword [rbp + 0xb4], xmm0
movups xmmword [rbp + 0xc4], xmm0
movups xmmword [rbp + 0xd4], xmm0
movups xmmword [rbp + 0xe4], xmm0
movups xmmword [rbp + 0xf4], xmm0
mov dword [rbp + 0x70], 0x94
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x18000ba52
lea r9, [rbp - 0x4b]
mov ecx, dword [rbp + 0x78]
nop
dec r9
mov eax, 0xcccccccd
mul ecx
shr edx, 3
movzx eax, dl
shl al, 2
lea r8d, [rax + rdx]
add r8b, r8b
sub cl, r8b
add cl, 0x30
mov byte [r9], cl
mov ecx, edx
test edx, edx
jne 0x18000b6c0
lea r8, [rbp - 0x4b]
mov rdx, r9
lea rcx, [rbp + 0x50]
call fcn.180017d90
nop
lea r9, [rbp - 0x4b]
mov r8d, dword [rbp + 0x74]
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x18000b702
lea r8, [rbp - 0x4b]
mov rdx, r9
lea rcx, [rbp - 0x30]
call fcn.180017d90
nop
mov r8, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
sub rax, r8
mov r14d, reloc.COMCTL32.dll_InitCommonControls
lea rsi, [0x180101500]
cmp rax, r14
jb 0x18000b7d5
lea rax, [r8 + 0x11]
mov qword [rbp - 0x20], rax
lea rbx, [rbp - 0x30]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x30]
lea rax, [0x180101511]
cmp rax, rbx
jbe 0x18000b799
lea rax, [rbx + r8]
cmp rsi, rax
ja 0x18000b799
cmp rbx, rsi
ja 0x18000b791
mov rdi, r15
jmp 0x18000b79c
mov rdi, rbx
sub rdi, rsi
jmp 0x18000b79c
mov rdi, r14
lea rcx, [rbx + 0x11]
inc r8
mov rdx, rbx
call fcn.18008bd90
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.18008bd90
lea rcx, [rbx + rdi]
sub r14, rdi
lea rdx, [rsi + 0x11]
add rdx, rdi
mov r8, r14
call fcn.18008bd90
lea rax, [rbp - 0x30]
jmp 0x18000b7eb
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rsi
mov rdx, r14
lea rcx, [rbp - 0x30]
call fcn.180018c90
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], InitCommonControls
mov byte [rax], 0
mov r8d, 1
lea rdx, [0x1801014fc]
lea rcx, [rbp - 0x10]
call fcn.1800103e0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], InitCommonControls
mov byte [rax], 0
lea r9, [rbp + 0x50]
lea r8, [rbp - 0x60]
lea rcx, [rbp + 0x30]
call fcn.180016ba0
nop
mov r8d, 1
lea rdx, [0x1801013ec]
lea rcx, [rbp + 0x30]
call fcn.1800103e0
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], InitCommonControls
mov byte [rax], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x18000b8dc
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b8d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000bf7c
call fcn.180067fbc
movdqa xmm0, xmmword [0x180101660]
movdqu xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x18000b930
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b923
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000bf82
call fcn.180067fbc
movdqa xmm0, xmmword [0x180101660]
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x18000b973
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b966
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000bf88
call fcn.180067fbc
movdqa xmm0, xmmword [0x180101660]
movdqu xmmword [rbp], xmm0
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x18000b9bf
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b9b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000bf8e
call fcn.180067fbc
movdqa xmm0, xmmword [0x180101660]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x18000ba03
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b9fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000bf94
call fcn.180067fbc
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0xf
cmova rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x18000ba52
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ba4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000bf76
call fcn.180067fbc
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
add rax, 0x281
mov qword [rbp - 0x60], rax
mov dword [rbp - 0x58], 0x281
xor eax, eax
mov word [rsp + 0x50], ax
mov byte [rsp + 0x52], al
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov ecx, InitCommonControls
call fcn.1800680a8
mov qword [rax + 8], r15
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x58]
mov qword [rax], rcx
mov word [rbp - 0x78], 0
mov qword [rbp - 0x72], r15
mov qword [rbp - 0x6a], r15
xor eax, eax
mov word [rbp - 0x75], ax
mov byte [rbp - 0x73], al
mov word [rbp - 0x72], ax
mov byte [rbp - 0x70], al
mov word [rbp - 0x6f], ax
mov byte [rbp - 0x6d], al
mov word [rbp - 0x6c], ax
mov byte [rbp - 0x6a], al
mov word [rbp - 0x69], ax
mov byte [rbp - 0x67], al
mov word [rbp - 0x66], ax
mov byte [rbp - 0x64], al
mov dword [rsp + 0x54], r15d
mov dword [rbp - 0x7c], r15d
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
lea r8, [rbp + 0x158]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x50]
call fcn.1800159a0
nop
lea rcx, [rsp + 0x58]
call fcn.180016da0
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x58], r15
mov edx, InitCommonControls
call fcn.180067fbc
lea rax, [0x180009180]
add rax, 0x161
mov qword [rbp - 0x60], rax
mov dword [rbp - 0x58], 0x161
xor eax, eax
mov word [rsp + 0x50], ax
mov byte [rsp + 0x52], al
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov ecx, InitCommonControls
call fcn.1800680a8
mov qword [rax + 8], r15
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x58]
mov qword [rax], rcx
mov word [rbp - 0x78], 0
mov qword [rbp - 0x72], r15
mov qword [rbp - 0x6a], r15
xor eax, eax
mov word [rbp - 0x75], ax
mov byte [rbp - 0x73], al
mov word [rbp - 0x72], ax
mov byte [rbp - 0x70], al
mov word [rbp - 0x6f], ax
mov byte [rbp - 0x6d], al
mov word [rbp - 0x6c], ax
mov byte [rbp - 0x6a], al
mov word [rbp - 0x69], ax
mov byte [rbp - 0x67], al
mov word [rbp - 0x66], ax
mov byte [rbp - 0x64], al
mov dword [rsp + 0x54], r15d
mov dword [rbp - 0x7c], r15d
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x50]
call fcn.1800139c0
nop
lea rcx, [rsp + 0x58]
call fcn.180016da0
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x58], r15
mov edx, InitCommonControls
call fcn.180067fbc
cmp dword [0x1800e9518], 0x1318018f
jne 0x18000bdd6
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingNumaW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
mov word [rsp + 0x28], r15w
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemGeoID]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
lea rax, [0x180101518]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [0x180101540]
xor edx, edx
lea rcx, [0x180101580]
call qword [sym.imp.KERNEL32.dll_FindNLSStringEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolWait]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, [0x1801015a8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStringTypeA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferInfoEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTime]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrefetchVirtualMemory]
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadGroupAffinity]
mov edx, dword [rbp + 0x148]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForThreadpoolWorkCallbacks]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
lea rax, [0x180008910]
add rax, 0x1fe
mov qword [rbp - 0x60], rax
mov dword [rbp - 0x58], 0x1fe
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
lea rcx, [rbp - 0x60]
call fcn.1800116c0
cmp dword [0x1800e9518], 0xfea7cac7
jne 0x18000bf5a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelThreadpoolIo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStringTypeExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumberEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddVectoredContinueHandler]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPreferredUILanguages]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveSecureMemoryCacheCallback]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsAlloc]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumDateFormatsExW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreatePipe]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PowerSetRequest]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSearchPathMode]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
mov qword [rsp + 0x20], r15
mov r9d, dword [rbp + 0x148]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenFileById]
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetTapePosition]
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
call qword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
mov eax, 1
mov rbx, qword [rsp + 0x240]
add rsp, 0x210
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1800731e0
nop
call fcn.1800731e0
nop
call fcn.1800731e0
nop
call fcn.1800731e0
nop
call fcn.1800731e0
nop
call fcn.1800731e0
int3