Function at 0x180005660
Capabilities:
Check for debugger via api
Identify system language via api
Read .ini file
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
call fcn.1800458b8
mov r8d, dword [0x1800c8fa0]
mov ebx, eax
mov eax, 0x51eb851f
xor edi, edi
imul ebx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub ebx, ecx
inc ebx
cmp r8d, 0xa745c876
jne 0x1800057d7
call qword [sym.imp.USER32.dll_CountClipboardFormats]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DestroyIcon]
xor ecx, ecx
call qword [sym.imp.USER32.dll_EndDeferWindowPos]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadDescription]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor ecx, ecx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformationForYear]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsCharAlphaW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ToAscii]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetPriorityClipboardFormat]
mov dword [rsp + 0x38], edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov qword [rsp + 0x28], rdi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationByHandleW]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EndPaint]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadStackGuarantee]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetLastErrorEx]
xor r9d, r9d
lea rdx, str.9yyi8ig3v1XL13Ja57GP1t3og3
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumDateFormatsExEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
mov r8d, dword [0x1800c8fa0]
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp ebx, ecx
jne 0x18000591c
cmp r8d, 0x76f05ef4
jne 0x1800058f9
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumberOfConsoleMouseButtons]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolIo]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PurgeComm]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeServerProcessId]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov edx, dword [rsp + 0x68]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
test bl, 1
jne 0x1800059aa
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x48], 0x15b
add rax, 0x15b
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000c740
mov qword [rsp + 0x70], rax
lea r9, [rsp + 0x68]
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r8, [rsp + 0x60]
mov dword [rsp + 0x48], 0x1e7
lea rdx, [rsp + 0x70]
add rax, 0x1e7
mov dword [rsp + 0x60], 8
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000c8b0
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov eax, 0x15d9
nop
inc eax
test al, 1
jne 0x1800059b0
mov ecx, 0xffffe22d
nop dword [rax + rax]
inc ecx
test cl, 1
jne 0x1800059c0
cmp eax, 0x15da
jne 0x180005a15
cmp ecx, 0xffffe22e
jne 0x180005a15
mov dword [rsp + 0x48], 0x15e
lea rax, [fcn.180049d44]
add rax, 0x15e
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000ca50
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]