Function at 0x1800055e0
Capabilities:
Terminate process

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
push rdi
sub rsp, 0x68
call fcn.180047788
mov r8d, dword [0x1800cbfa0]
mov ebx, eax
mov eax, 0x51eb851f
xor edi, edi
imul ebx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub ebx, ecx
inc ebx
cmp r8d, 0x3128ddaf
jne 0x18000578d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolWaitEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUserGeoID]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCPInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentConsoleFont]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemPowerState]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameTransactedW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_UnregisterClassW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommState]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_CreateTimerQueue]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetOverlappedResultEx]
call qword [sym.imp.USER32.dll_GetClipboardViewer]
mov qword [rsp + 0x40], rdi
lea r8, str.qokdBi29EMaF8BOhNhe34tR3
mov qword [rsp + 0x38], rdi
lea rcx, str.qap9w82utZd5XqEAVx63
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_LCMapStringEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CheckMenuItem]
mov qword [rsp + 0x48], rdi
lea rax, str.VcdlDMc49X11pju7eJS5xpN18
mov qword [rsp + 0x40], rdi
lea r8, str.c867q3cZzOzh92OhmrbJY
mov qword [rsp + 0x38], rdi
lea rcx, str.K8RBunEaMT3BZm7OG2qgz76WB6VnT
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FindNLSStringEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemPreferredUILanguages]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsWindowEnabled]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemGeoID]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeAddData]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsWindowUnicode]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_keybd_event]
mov r8d, dword [0x1800cbfa0]
mov eax, 0x55555556
mov qword [rsp + 0x98], rbp
imul ebx
mov qword [rsp + 0x60], rsi
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp ebx, ecx
jne 0x1800058aa
cmp r8d, 0xae7030a4
jne 0x18000587b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommConfig]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumberOfConsoleInputEvents]
call qword [sym.imp.KERNEL32.dll_CreateTimerQueue]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTimeEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
lea rax, str.zfRPYoUD4p63umqa6Zz8Qs
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rdi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDurationFormat]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BindIoCompletionCallback]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessDEPPolicy]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
call qword [sym.imp.KERNEL32.dll_GetVersion]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPhysicallyInstalledSystemMemory]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov edx, dword [rsp + 0x88]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x98]
add rsp, 0x68
pop rdi
pop rbx
ret
test bl, 1
jne 0x180005941
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x58], 0x117
add rax, 0x117
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.18000bda0
mov qword [rsp + 0x90], rax
lea r9, [rsp + 0x88]
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r8, [rsp + 0x80]
mov dword [rsp + 0x58], 0x264
lea rdx, [rsp + 0x90]
add rax, 0x264
mov dword [rsp + 0x80], 8
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.18000bf50
jmp 0x180005896
mov ecx, 0x3dc0
mov r10d, 0xffffed69
nop dword [rax]
inc ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
jne 0x180005950
lea r11d, [rcx + 0x88e]
mov eax, 0x55555556
lea r8d, [r11 - 0x6df4]
mov r9d, 0x1801
imul r8d
sub r9d, ecx
mov esi, 0xfffff135
mov eax, edx
sub esi, r9d
shr eax, 0x1f
mov edi, 0x39f8
add edx, eax
mov eax, 0x674
lea ebp, [r9 + 0x5099]
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
cmove edi, eax
add edi, r8d
lea r8d, [r9 - 0x939]
nop dword [rax]
inc r10d
test r10b, 1
jne 0x1800059c0
add r11d, 0xffffabc5
mov eax, 0x55555556
imul r8d
mov ebx, 0xa24b
mov r9d, esi
mov eax, edx
sub ebx, r8d
shr eax, 0x1f
sub ebx, r11d
add edx, eax
sub r11d, r8d
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
je 0x180005a06
test r8d, r8d
jle 0x180005a06
sub r8d, 0xfde
jmp 0x180005a0d
add r8d, 0xfde
add r9d, ebx
lea ecx, [r9 - 0x1e4c]
and ecx, 0x80000003
jge 0x180005a26
dec ecx
or ecx, 0xfffffffc
inc ecx
add esi, 0xffffb5ee
lea edx, [rdi + r8]
cmp esi, 0xffffcce4
jne 0x180005adf
lea eax, [r10 + rdx]
cmp eax, 0xffffe0a2
jne 0x180005adf
cmp edx, 0xfffff338
jne 0x180005adf
cmp r8d, 0xffffe0e4
jne 0x180005adf
test ecx, ecx
mov eax, 0x22dd
mov edx, 0x1e4c
cmove eax, edx
sub r9d, eax
sub r9d, ebp
cmp r9d, 0xa871
jne 0x180005adf
cmp ebx, 0xdf30
jne 0x180005adf
sub r11d, esi
cmp r11d, 0x542b
jne 0x180005adf
cmp ebp, 0x2ad8
jne 0x180005adf
cmp r10d, 0xffffed6a
jne 0x180005adf
mov dword [rsp + 0x58], 0x223
lea rax, [fcn.18004bc14]
add rax, 0x223
lea rdx, [rsp + 0x88]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.18000c130
jmp 0x180005896
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]