Function at 0x180005910
Capabilities:
Create thread
Terminate process
Write clipboard data

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
call fcn.18004de78
mov r8d, dword [0x1800d2fa0]
mov ebx, eax
mov eax, 0x51eb851f
xor edi, edi
imul ebx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub ebx, ecx
inc ebx
cmp r8d, 0xfc521532
jne 0x180005a90
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameTransactedW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolWait]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSysColor]
xor r8d, r8d
lea rcx, str.beIZItXQ2VwOt5or6ZTXMB6p5kE7
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ResolveLocaleName]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCPInfo]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeServerSessionId]
call qword [sym.imp.KERNEL32.dll_GetThreadUILanguage]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DiscardVirtualMemory]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolThreadMaximum]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetTimeZoneInformation]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientComputerNameW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalLock]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddIntegrityLabelToBoundaryDescriptor]
mov r8d, dword [0x1800d2fa0]
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp ebx, ecx
jne 0x180005b86
cmp r8d, 0x2d292b68
jne 0x180005b63
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AttachConsole]
call qword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueue]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileBandwidthReservation]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolIo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
call qword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatusEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, dword [rsp + 0x68]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
test bl, 1
jne 0x180005c14
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x48], 0x13b
add rax, 0x13b
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000c610
mov qword [rsp + 0x70], rax
lea r9, [rsp + 0x68]
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r8, [rsp + 0x60]
mov dword [rsp + 0x48], 0x1d3
lea rdx, [rsp + 0x70]
add rax, 0x1d3
mov dword [rsp + 0x60], 8
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000c7c0
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov eax, 0x268f
nop dword [rax]
inc eax
test al, 1
jne 0x180005c20
mov ecx, 0xffffdd99
nop dword [rax + rax]
inc ecx
test cl, 1
jne 0x180005c30
add ecx, 0xff5
test cl, 1
je 0x180005c49
inc ecx
test cl, 1
jne 0x180005c42
sub ecx, 0x120a
mov r10d, 0xffffb9c4
sub eax, ecx
mov ebx, 0xfffff513
add ecx, 0x909
sub r10d, ecx
sub ebx, ecx
lea r9d, [rax*2 + 0x24b08]
mov eax, 0x55555556
imul r10d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp r10d, edx
je 0x180005caa
nop word [rax + rax]
inc r10d
mov eax, 0x55555556
imul r10d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp r10d, edx
jne 0x180005c90
lea edx, [r9 - 0x83be]
mov eax, 0xae2
sub eax, edx
lea r8d, [r9 + 0x5bd0]
add ebx, eax
lea r9d, [rdx - 0x2232]
lea eax, [r8*2 + 0x2596]
sub eax, ebx
sub ebx, 0xd14
add r10d, eax
sub r8d, ebx
mov eax, 0xffffdcc8
lea ebx, [rbx*2 - 0x4b8]
sub eax, ebx
lea r11d, [r8 - 0x265f]
add r11d, ecx
mov ecx, 0xffffce97
add r11d, eax
mov eax, 0x55555556
imul r9d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov edx, 0x2d3f
cmp r9d, eax
mov eax, r11d
cmove ecx, edx
lea r8d, [rcx + r9*2]
sub r8d, ebx
and eax, 0x80000003
jge 0x180005d33
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x180005d4c
test r11d, r11d
jle 0x180005d4c
lea eax, [r11 - 0x1149]
add r11d, 0x3195
jmp 0x180005d5a
lea eax, [r11 + 0x38eb]
add r11d, 0x7bc9
lea r9d, [r11 + r10*2]
add r8d, r8d
lea edi, [r10 - 0x8dd]
add edi, eax
lea r11d, [rbx*2 + 0x2c8e]
lea r10d, [r9 + 0x704]
test r9b, 1
je 0x180005d89
nop
inc r9d
test r9b, 1
jne 0x180005d80
add r10d, r8d
mov eax, 0xffffdf92
sub eax, edi
add r8d, eax
mov eax, 0x1077
sub eax, r8d
sub r9d, r8d
add r11d, eax
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
je 0x180005dc7
lea ebx, [r8 + 0x17c4]
test r8d, r8d
jg 0x180005dce
lea ebx, [r8 - 0x1960]
sub r10d, r11d
lea r8d, [r10 - 0x12d5]
add r8d, edi
test r8b, 1
je 0x180005dea
inc r8d
test r8b, 1
jne 0x180005de1
mov eax, 0x55555556
add r10d, ebx
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
je 0x180005e2a
nop dword [rax]
nop dword [rax + rax]
inc r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
jne 0x180005e10
add r11d, 0xffffdd07
lea edx, [r10 + rbx]
add r8d, r8d
test r10b, 1
je 0x180005e49
nop
inc r10d
test r10b, 1
jne 0x180005e40
add r9d, 0xf66
mov eax, r9d
and eax, 0x80000003
jge 0x180005e61
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
lea ecx, [r9 + 0x785]
lea eax, [r11 + rdx]
cmove ecx, r9d
lea r9d, [rax + 0x325a]
add r9d, r10d
add eax, 0x13c
sub r8d, r9d
lea edx, [r8 + r11*2]
add eax, edx
cmp eax, 0x4aa38e
jne 0x180005ef9
lea eax, [r8 + rcx]
add eax, r11d
cmp eax, 0x422ecf
jne 0x180005ef9
cmp edx, 0x1d398c
jne 0x180005ef9
lea eax, [rcx + r9]
cmp eax, 0x805694
jne 0x180005ef9
cmp ecx, 0x1c0dba
jne 0x180005ef9
mov dword [rsp + 0x48], 0x1d4
lea rax, [fcn.180052304]
add rax, 0x1d4
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000c9a0
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]