Function at 0x1800070d0
Capabilities:
Copy file
Manipulate console buffer
Query or enumerate registry value
Swap mouse buttons
Terminate process

Disassembly:
push rbx
sub rsp, 0x50
xor ebx, ebx
cmp dword [0x1800d9988], 0x65d590e6
jne 0x180007288
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsThreadpoolTimerSet]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CheckMenuItem]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AllocateUserPhysicalPages]
mov r9d, dword [rsp + 0x60]
xor edx, edx
mov r8d, dword [rsp + 0x60]
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CloseWindow]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ShowOwnedPopups]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNode]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BackupSeek]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeImpersonateClient]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsGUIThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemFileCacheSize]
xor ecx, ecx
call qword [sym.imp.USER32.dll_PaintDesktop]
mov r9d, dword [rsp + 0x60]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferW]
mov dword [rsp + 0x38], ebx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_TabbedTextOutW]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_TileWindows]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetListBoxInfo]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIdealProcessorEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DrawFocusRect]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SwapMouseButton]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateBoundaryDescriptorW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WakeConditionVariable]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeSetUserHandle]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetCoalescableTimer]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CopyFileW]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateDialogParamW]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x68], ebx
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x60], ebx
lea rdx, [0x1800ef768]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1800073dd
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [0x1800ef788]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180007330
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x48], 0x252
lea rcx, [rsp + 0x40]
add rax, 0x252
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000fb00
mov al, 1
add rsp, 0x50
pop rbx
ret
mov r8d, 0x19
nop word [rax + rax]
inc r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
jne 0x180007340
lea ecx, [r8 + 0x1f8]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
je 0x180007397
nop word [rax + rax]
inc ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
jne 0x180007380
lea eax, [rcx + rcx]
cmp eax, 0x426
jne 0x1800073e5
cmp ecx, 0x213
jne 0x1800073e5
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x48], 0x262
lea rcx, [rsp + 0x40]
add rax, 0x262
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000fb00
xor al, al
add rsp, 0x50
pop rbx
ret
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]