Function at 0x18000add0
Capabilities:
Check for debugger via api
Create thread
Enumerate files on windows
Enumerate gui resources
Enumerate system firmware tables
Get disk information
Get disk size
Get keyboard layout
Get uefi variable
Move file
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xe0
mov edi, 1
xor r14d, r14d
test edx, edx
jne 0x18000afd0
lea rcx, [0x1800f63d8]
call qword [sym.imp.KERNEL32.dll_AddDllDirectory]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileNameW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, [0x1800f6400]
xor edx, edx
lea rcx, [0x1800f6440]
call qword [sym.imp.KERNEL32.dll_LCMapStringEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenEventW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemFileCacheSize]
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call qword [sym.imp.KERNEL32.dll_GetACP]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolTimer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalProcessorInformation]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemFirmwareTables]
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1800f6468]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumTimeFormatsEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PurgeComm]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSizeEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceInitialize]
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolCleanupGroup]
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
lea r9, [0x1800f64a0]
xor r8d, r8d
lea rdx, [0x1800f64c8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindStringOrdinal]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalFlags]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryThreadpoolStackInformation]
jmp 0x18000b47b
cmp edx, edi
jne 0x18000b47b
cmp dword [0x1800de740], 0xd0932413
jne 0x18000b17b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryUnbiasedInterruptTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeServerSessionId]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommMask]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LCMapStringW]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUILanguageInfo]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x1800f64f0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileNameTransactedW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BackupRead]
xor r8d, r8d
lea rdx, [0x1800f6530]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsValidNLSVersion]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalFlags]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
lea rcx, [0x1800f6570]
call qword [sym.imp.KERNEL32.dll_IsValidLocaleName]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalSize]
mov edx, dword [rbp + 0x6f]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenEventW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockFileEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSectionWhenCallbackReturns]
lea rax, [0x180009d24]
mov ecx, 0x1c3
add rax, rcx
mov qword [rbp - 0x39], rax
mov dword [rbp - 0x31], ecx
movaps xmm0, xmmword [rbp - 0x39]
movdqa xmmword [rbp - 0x39], xmm0
lea rcx, [rbp - 0x39]
call fcn.18000f404
lea rax, [0x180006370]
mov ecx, 0x1cb
add rax, rcx
mov qword [rbp - 0x39], rax
mov dword [rbp - 0x31], ecx
movaps xmm0, xmmword [rbp - 0x39]
movdqa xmmword [rbp - 0x39], xmm0
lea rcx, [rbp - 0x39]
call fcn.18000f404
lea rbx, [0x180007984]
add rbx, 0x249
xor eax, eax
mov qword [rbp - 0x19], rax
xorps xmm0, xmm0
movdqa xmmword [rbp - 9], xmm0
mov qword [rbp + 7], r14
mov qword [rbp + 0xf], r14
mov qword [rbp + 0x17], r14
lea ecx, [rax + 0x10]
call fcn.18004eb94
mov qword [rax + 8], r14
mov qword [rbp - 9], rax
lea rcx, [rbp - 9]
mov qword [rax], rcx
mov word [rbp + 0x27], r14w
mov qword [rbp + 0x2d], r14
mov qword [rbp + 0x35], r14
xor eax, eax
mov word [rbp + 0x2a], ax
mov byte [rbp + 0x2c], al
mov word [rbp + 0x2d], ax
mov byte [rbp + 0x2f], al
mov word [rbp + 0x30], ax
mov byte [rbp + 0x32], al
mov word [rbp + 0x33], ax
mov byte [rbp + 0x35], al
mov word [rbp + 0x36], ax
mov byte [rbp + 0x38], al
mov word [rbp + 0x39], ax
mov byte [rbp + 0x3b], al
mov dword [rbp + 0x23], r14d
mov dword [rbp - 0xd], r14d
mov r8b, dil
lea rdx, [rbp - 0x45]
lea rcx, [rbp - 0x19]
call fcn.180015818
lea rax, [rbp - 0x19]
mov qword [rbp + 0x7f], rax
lea rdx, [rbp + 0x7f]
call fcn.18001643c
mov byte [rbp + 0x6f], r14b
mov r8b, dil
lea rdx, [rbp + 0x6f]
lea rcx, [rbp - 0x19]
call fcn.1800162ec
mov byte [rbp + 0x7f], r14b
mov r8b, dil
lea rdx, [rbp + 0x7f]
lea rcx, [rbp - 0x19]
call fcn.18001635c
mov byte [rbp - 0x49], r14b
mov r8b, dil
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x19]
call fcn.1800163cc
mov byte [rbp - 0x48], r14b
mov r8b, dil
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x19]
call fcn.1800162ec
mov byte [rbp - 0x47], r14b
mov r8b, dil
lea rdx, [rbp - 0x47]
lea rcx, [rbp - 0x19]
call fcn.18001635c
mov byte [rbp - 0x46], r14b
mov r8b, dil
lea rdx, [rbp - 0x46]
lea rcx, [rbp - 0x19]
call fcn.180016638
mov qword [rbp - 0x39], rbx
mov dword [rbp - 0x31], 0x249
mov eax, dword [rbp - 0x2d]
mov dword [rbp - 0x2d], eax
mov r8b, dil
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x19]
call fcn.1800166a8
mov edi, dword [rbp - 0x15]
lea rcx, [rbp - 9]
call fcn.180011c40
cmp dword [0x1800de740], 0xb9da03db
jne 0x18000b47b
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryThreadpoolStackInformation]
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetRawInputData]
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CheckMenuRadioItem]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AllocateUserPhysicalPagesNuma]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LogicalToPhysicalPoint]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddResourceAttributeAce]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ModifyMenuW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
mov edx, dword [rbp + 0x6f]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
call qword [sym.imp.KERNEL32.dll_GetOEMCP]
mov word [rsp + 0x20], r14w
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceTypesExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryProcessCycleTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiberEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CharToOemBuffW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsCharAlphaNumericW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeSynchronizationBarrier]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommBreak]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnableMouseInPointer]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov eax, edi
mov rbx, qword [rsp + 0x100]
add rsp, 0xe0
pop r14
pop rdi
pop rbp
ret