Function at 0x18005fa20
Capabilities:
Log keystrokes
Manipulate console buffer

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x180084080]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edx, dword [rcx + 0x58]
mov rbx, rcx
mov ecx, edx
btr ecx, 0xc
mov eax, ecx
sub dword [rbx + 0x7c], 1
mov dword [rbx + 0x58], ecx
jne 0x18005fa71
test cl, 1
jne 0x18005fa71
test dl, 4
je 0x18005fa71
mov eax, edx
and eax, 0xffffeffb
mov dword [rbx + 0x58], eax
test al, 8
je 0x18005fa71
mov rax, qword [rbx + 8]
dec dword [rax + 8]
mov eax, dword [rbx + 0x58]
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0x88], rdi
bt eax, 0x10
jae 0x18005fb03
bt eax, 0x19
jae 0x18005facc
mov rcx, qword [rbx + 0x110]
lea r9, [rsp + 0x40]
xor eax, eax
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x70], eax
xorps xmm0, xmm0
mov eax, reloc.WS2_32.dll_recv
movups xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x60], ax
lea r8d, [rax - 0xf]
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x18005fb03
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18005fb05
bt eax, 0x15
jb 0x18005fb03
lea rcx, [0x18009ae50]
xor edi, edi
call fcn.18005ace0
mov eax, 2
xchg dword [0x18009ae08], eax
cmp eax, 1
je 0x18005fb2b
lea rcx, [0x18009ae50]
call fcn.18005acb0
or dword [rbx + 0x58], 0x200000
xor eax, eax
mov rdi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180062330
add rsp, 0x90
pop rbx
ret
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0xb0], rsi
lea rcx, str.conout_
mov dword [rsp + 0x28], 0x80
mov edx, 0xc0000000
mov qword [rsp + 0x80], r14
lea r8d, [r9 + 3]
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18005fb8e
lea rdx, [0x18009ae10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x18005fb8e
lock or dword [0x18009ae0c], 1
mov ebp, 1
mov dword [rsp + 0x50], 0xd0001
mov r14d, reloc.WS2_32.dll_listen
mov word [rsp + 0x48], bp
mov ecx, r14d
mov dword [rsp + 0x4c], ebp
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov rcx, qword [rbx + 0x110]
lea r9, [rsp + 0x44]
mov r8d, ebp
mov word [rsp + 0x54], ax
lea rdx, [rsp + 0x48]
mov word [rsp + 0x56], r14w
mov dword [rsp + 0x58], edi
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov r14, qword [rsp + 0x80]
test eax, eax
jne 0x18005fbf2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp rsi, 0xffffffffffffffff
je 0x18005fc01
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0xb0]
test edi, edi
je 0x18005fafc
mov eax, edi
jmp 0x18005fb05

Function at 0x180060660
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x48]
lea rcx, [0x18009ae90]
mov dword [0x18009aeb8], eax
call fcn.18005ab90
test eax, eax
jne 0x1800606bd
lea rax, [0x180322ec8]
mov edx, 0x100
lea rcx, [0x18009aec0]
xor r8d, r8d
nop
mov qword [rax], rcx
add rcx, 0x2880
mov qword [rax - 8], r8
lea rax, [rax + 0x10]
sub rdx, 1
jne 0x1800606a0
add rsp, 0x58
ret
lea rdx, str.uv_mutex_init
mov ecx, eax
call fcn.18005c860
int3