Function at 0x1800035d0
Capabilities:
Extract resource via kernel32 functions
Move file
Read pipe
Terminate process
Write pipe

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
cmp dword [rcx + 0x18], 0
mov rbx, rcx
jne 0x1800038d9
call fcn.1800487c8
mov r9d, eax
mov eax, 0x55555556
imul r9d
mov r8d, edx
shr r8d, 0x1f
add edx, r8d
lea ecx, [rdx + rdx*2]
sub r9d, ecx
mov ecx, 1
inc r9d
mov dword [rbx + 0x18], r9d
call fcn.18004296c
mov edx, dword [rbx + 0x18]
mov rsi, rax
sub edx, 1
je 0x1800038bc
sub edx, 1
je 0x180003655
cmp edx, 1
jne 0x1800038cc
mov edx, 0x3ec0
mov rcx, rax
call fcn.180004e20
mov qword [rbx + 0x10], rax
jmp 0x1800038cc
mov r8d, 0xffffe43c
nop dword [rax + rax]
inc r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
jne 0x180003660
mov edi, 0x369e
lea r15d, [r8 - 0x1b2b]
sub edi, r8d
mov r11d, 0x6c9
sub r11d, r8d
mov r10d, 0xb8f1
add r11d, 0x15e
lea r9d, [rdi + 0x158a]
add r9d, r8d
nop dword [rax]
inc r10d
test r10b, 1
jne 0x1800036b0
mov eax, 0x55555556
mov r8d, 0xb4f5
imul r9d
mov ebp, 0xffffbd8c
sub r8d, r9d
mov eax, edx
sub ebp, r15d
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r9d, ecx
je 0x18000370a
nop dword [rax]
nop word [rax + rax]
inc r9d
mov eax, 0x55555556
imul r9d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r9d, ecx
jne 0x1800036f0
lea ecx, [r11 + rdi]
add r9d, 0x1505
lea r12d, [rbp + 0x415c]
add ecx, r9d
sub r9d, r10d
lea edx, [r15 - 0xe80]
lea r15d, [rbp + 0x2167]
sub r11d, r9d
lea r14d, [r8 - 0x2ad8]
sub r10d, r12d
sub r8d, r12d
lea r13d, [r14 - 0x2076]
add r13d, r11d
add ecx, 0xffffed4e
add r12d, 0x24bf
add r10d, 0xfffff8ee
mov eax, 0xffffc9e9
mov edi, 0xffff9b35
sub eax, r14d
sub edi, r11d
add edx, eax
sub r11d, edi
add eax, 0xf89
mov dword [rsp + 0x88], edx
add eax, r15d
sub edi, 0x34
sub r15d, edi
add eax, r13d
sub edi, r12d
mov dword [rsp + 0x80], eax
add r10d, edi
add r15d, 0x2172
mov ebp, r13d
add r8d, 0x1dfe
sub ebp, r11d
sub r15d, edi
add ebp, ecx
mov ecx, r10d
and ecx, 0x80000003
jge 0x1800037c3
dec ecx
or ecx, 0xfffffffc
inc ecx
add r11d, r8d
mov eax, 0xffffc358
sub eax, r8d
add ebp, eax
mov eax, r11d
and eax, 0x80000003
jge 0x1800037e1
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x1800037f1
test r11d, r11d
jle 0x1800037f1
add r11d, 0x1921
sub r11d, r14d
mov eax, 0xffffef71
test ecx, ecx
mov edx, 0xffffe54d
cmove edx, eax
add r8d, 0x2298
sub edi, 0x1a8
mov eax, r8d
sub eax, edi
add edx, r10d
add eax, ebp
add eax, dword [rsp + 0x80]
add eax, r15d
cmp eax, 0x3c274
jne 0x1800038b0
cmp r12d, 0x5a95
jne 0x1800038b0
cmp r8d, 0x738d
jne 0x1800038b0
cmp r14d, 0x3df5
jne 0x1800038b0
sub r9d, edx
sub r9d, r14d
cmp r9d, 0x3a0e
jne 0x1800038b0
mov eax, dword [rsp + 0x88]
add eax, r11d
cmp eax, 0xb5ad
jne 0x1800038b0
cmp r15d, 0x25342
jne 0x1800038b0
cmp r13d, 0x992d
jne 0x1800038b0
cmp r11d, 0x16f27
jne 0x1800038b0
cmp edi, 0xfffec316
jne 0x1800038b0
cmp ebp, 0xffff7430
jne 0x1800038b0
cmp edx, 0xffff3039
jne 0x1800038b0
mov edx, 0x3ec0
mov rcx, rsi
call fcn.180004e20
mov qword [rbx + 8], rax
jmp 0x1800038cc
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, 0x3ec0
mov rcx, rsi
call fcn.180004e20
mov qword [rbx], rax
mov edx, 1
mov rcx, rsi
call fcn.180042880
mov edx, dword [0x1800d1574]
cmp edx, 0x1f7784ae
jne 0x180003980
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
xor edi, edi
xor r9d, r9d
mov dword [rsp + 0x30], edi
xor r8d, r8d
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.USER32.dll_DdeCreateDataHandle]
call qword [sym.imp.USER32.dll_CountClipboardFormats]
mov rdx, qword [rsp + 0x80]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RequestWakeupLatency]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetRawInputDeviceList]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualLock]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [rbx + 0x18]
xor edi, edi
mov esi, edi
sub ecx, 1
je 0x1800039a2
sub ecx, 1
je 0x18000399c
cmp ecx, 1
jne 0x1800039a5
mov rsi, qword [rbx + 0x10]
jmp 0x1800039a5
mov rsi, qword [rbx + 8]
jmp 0x1800039a5
mov rsi, qword [rbx]
cmp edx, 0xc7935965
jne 0x180003a90
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetWindowRgn]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiberEx]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
call qword [sym.imp.USER32.dll_CloseClipboard]
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMaskEx]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetLastActivePopup]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUserGeoID]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetProcessDefaultLayout]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_AnimateWindow]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, str.yoKseqFUf7tgnhO14
xor ecx, ecx
lea rdx, str.rJ9uM79kK93rx8Au5yzB2iM8LJdU
call qword [sym.imp.KERNEL32.dll_NotifyUILanguageChange]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransactNamedPipe]
mov rbx, qword [rsp + 0x90]
mov rax, rsi
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret