Function at 0x14005c220
Capabilities:
Link many functions at runtime

Disassembly:
push rdi
sub rsp, 0x20
mov edi, ecx
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x140105c10], rax
test rax, rax
je 0x14005c557
lea rcx, [0x1400b8140]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x140105c90], rax
test rax, rax
je 0x14005c557
xor edx, edx
mov qword [rsp + 0x30], rbx
mov r8d, 0x11c
lea rcx, [0x140105af0]
call sym.vkat.exe_nocrt_memset
mov rcx, qword [0x140105c90]
lea rdx, str.RtlGetVersion
mov dword [0x140105af0], 0x11c
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005c2b3
lea rcx, [0x140105af0]
call qword [case.0x140035d81.0]
test eax, eax
je 0x14005c349
xor edx, edx
lea rcx, [0x140105af0]
mov r8d, 0x11c
call sym.vkat.exe_nocrt_memset
mov rcx, qword [0x140105c10]
lea rdx, str.GetVersionExW
mov dword [0x140105af0], 0x11c
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14005c2fe
lea rcx, [0x140105af0]
call qword [case.0x140035d81.0]
test eax, eax
jne 0x14005c349
xor edx, edx
lea rcx, [0x140105af0]
mov r8d, 0x11c
call sym.vkat.exe_nocrt_memset
mov dword [0x140105af0], 0x114
test rbx, rbx
je 0x14005c335
lea rcx, [0x140105af0]
mov rax, rbx
call qword [case.0x140035d81.0]
test eax, eax
jne 0x14005c349
xor edx, edx
lea rcx, [0x140105af0]
mov r8d, 0x11c
call sym.vkat.exe_nocrt_memset
cmp dword [0x140105af0], 0
je 0x14005c364
lea rcx, [0x140105af0]
call fcn.14005c6f0
mov dword [0x140105ae4], eax
xor ebx, ebx
test dil, 8
jne 0x14005c375
mov ecx, edi
call fcn.14005c580
mov ebx, eax
mov rcx, qword [0x140105c10]
lea rdx, str.GetSystemWindowsDirectoryW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140105c18], rax
test rax, rax
je 0x14005c3b0
mov rcx, qword [0x140105c10]
lea rdx, str.GetWindowsDirectoryW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140105c18], rax
mov rcx, qword [0x140105c10]
lea rdx, str.SystemTimeToTzSpecificLocalTime
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140105c10]
lea rdx, str.CreateWaitableTimerExW
mov qword [0x140105c28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140105c10]
lea rdx, str.GetHandleInformation
mov qword [0x140105c20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140105c10]
lea rdx, str.SetHandleInformation
mov qword [0x140105c30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140105c10]
lea rdx, str.IsDebuggerPresent
mov qword [0x140105c38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140105c10]
lea rdx, str.GetSystemTimeAsFileTime
mov qword [0x140105c40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140105c10]
lea rdx, str.GetProcessAffinityMask
mov qword [0x140105c48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140105c10]
lea rdx, str.SetThreadAffinityMask
mov qword [0x140105c50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140105c10]
lea rdx, str.CreateIoCompletionPort
mov qword [0x140105c58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140105c10]
lea rdx, str.GetQueuedCompletionStatus
mov qword [0x140105c60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140105c10]
lea rdx, str.PostQueuedCompletionStatus
mov qword [0x140105c68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140105c10]
lea rdx, str.IsProcessorFeaturePresent
mov qword [0x140105c70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140105c90]
lea rdx, str.NtQueryFullAttributesFile
mov qword [0x140105c88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140105c90]
lea rdx, str.NtDuplicateToken
mov qword [0x140105c98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140105c90]
lea rdx, str.NtAlertThread
mov qword [0x140105ca0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140105ca8], rax
call fcn.14005c8c0
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 0xffffff1e
add rsp, 0x20
pop rdi
ret