Function at 0x180005fa0
Capabilities:
Create mailslot
Create pipe
Get hostname
Get system information on windows
Monitor clipboard content

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
call fcn.180050c80
mov r8d, dword [0x1800d7b50]
mov ebx, eax
mov eax, 0x51eb851f
xor edi, edi
imul ebx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub ebx, ecx
inc ebx
cmp r8d, 0xc0a4e6e7
jne 0x18000615b
xor ecx, ecx
call qword [sym.imp.USER32.dll_AddClipboardFormatListener]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryDepthSList]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreatePipe]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_UserHandleGrantAccess]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDCEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueue]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeServerSessionId]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMemoryErrorHandlingCapabilities]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpool]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientSessionId]
lea r9, str.DX4b47Ud8XF4A4FYiiCHLlQ
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov dword [rsp + 0x20], edi
lea rdx, str.nV6cMB87VGrIw61E7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoExEx]
mov qword [rsp + 0x48], rdi
lea rax, str.ryTpzN7M8DICwOuv867EpTIM6
mov qword [rsp + 0x40], rdi
lea r8, str.VLltnXX6u1H25uGX7Udt38
mov qword [rsp + 0x38], rdi
lea rcx, str.BGjZ6gMtUaBLqE2SyK8Nm3D
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FindNLSStringEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetDlgItemInt]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReOpenFile]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadKeyboardLayoutW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeKeepStringHandle]
mov r8d, dword [0x1800d7b50]
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp ebx, ecx
jne 0x180006290
cmp r8d, 0x6123aa14
jne 0x18000626a
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SleepConditionVariableCS]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DebugActiveProcess]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemPowerState]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AttachConsole]
lea rax, str.kVHwXS8qHs25KLf4
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rdi
lea rcx, str.7rVb3JIkW3w988k9I3et372d
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetDurationFormatEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryIdleProcessorCycleTime]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTimeFormatW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov edx, dword [rsp + 0x78]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
lea rcx, [rsp + 0x50]
test bl, 1
jne 0x180006327
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [rsp + 0x58], 0x17f
add rax, 0x17f
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.18000e1d0
mov qword [rsp + 0x80], rax
lea r9, [rsp + 0x78]
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r8, [rsp + 0x70]
mov dword [rsp + 0x58], 0x188
lea rdx, [rsp + 0x80]
add rax, 0x188
mov dword [rsp + 0x70], 8
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.18000e3c0
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
mov dword [rsp + 0x58], 0x163
lea rax, [fcn.180053ce4]
add rax, 0x163
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.18000e5e0
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret