Function at 0x18000c330
Capabilities:
Create pipe
Get memory capacity
Get system firmware table
Get system information on windows
Hash data with crc32
Log keystrokes
Manipulate console buffer
Print debug messages
Set current directory
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x440
mov ebx, dword [rsp + 0x478]
lea r13, [0x1800c48a0]
mov edi, dword [rsp + 0x478]
lea r12, [rsp + 0x40]
xor esi, esi
mov r15d, 0x5c
mov r14d, esi
nop dword [rax]
cmp dword [0x18010d350], 0xd508e64c
jne 0x18000c4bc
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetClipboardViewer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetMenuItemInfoW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_PrintWindow]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCPInfoExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeDisconnectList]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LookupIconIdFromDirectoryEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNLSVersion]
mov r9d, ebx
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputAttribute]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov edx, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilter]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetClassLongW]
mov qword [rsp + 0x38], rsi
xor r9d, r9d
mov dword [rsp + 0x30], esi
xor r8d, r8d
mov dword [rsp + 0x28], esi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeLibraryWhenCallbackReturns]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov esi, r14d
mov ebp, 8
xor ebx, ebx
nop word [rax + rax]
cmp dword [0x18010d350], 0xb3235951
jne 0x18000c5f2
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapQueryInformation]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockFile]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadProfiling]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleHistoryInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileIoOverlappedRange]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStringTypeExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ApplicationRecoveryInProgress]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMaskEx]
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnterSynchronizationBarrier]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetComputerNameExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, esi
mov eax, esi
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov esi, ecx
xor esi, eax
sub rbp, 1
jne 0x18000c4d0
mov ebx, dword [rsp + 0x478]
inc r14d
mov dword [r12], esi
add r12, 4
mov rsi, rbp
cmp r14d, 0x100
jl 0x18000c380
mov ebx, 0xffffffff
nop dword [rax + rax]
dec r15
cmp dword [0x18010d350], 0x1ef4140c
jne 0x18000c761
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryIdleProcessorCycleTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RequestWakeupLatency]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryThreadProfiling]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DiscardVirtualMemory]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextStreamW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleOriginalTitleW]
xor r9d, r9d
mov dword [rsp + 0x28], esi
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDateFormatW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolIo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlCaptureStackBackTrace]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FatalExit]
movzx edx, byte [r13]
mov ecx, ebx
xor rdx, rcx
shr ebx, 8
movzx ecx, dl
inc r13
xor ebx, dword [rsp + rcx*4 + 0x40]
test r15, r15
jne 0x18000c640
lea r11, [rsp + 0x440]
not ebx
mov rbp, qword [r11 + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret