Function at 0x1800095b0
Capabilities:
Check for debugger via api
Connect pipe
Manipulate console buffer
Terminate process

Disassembly:
sub rsp, 0x68
cmp edx, 1
jne 0x18000988a
cmp dword [0x1800e0678], 0xa9625cbc
je 0x18000972f
lea rax, [0x180008960]
mov dword [rsp + 0x38], 0x1cf
add rax, 0x1cf
mov dword [0x1800e0678], 0xdb2180be
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x50]
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.18000edf0
lea rax, [0x180009290]
mov dword [rsp + 0x48], 0x1d9
add rax, 0x1d9
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.180014e80
mov r10d, eax
mov ecx, 0xfffa6ae3
nop dword [rax]
inc ecx
test cl, 1
jne 0x180009640
add ecx, ecx
mov r8d, 0x59748
sub r8d, ecx
mov eax, r8d
lea r9d, [rcx + 0x35bc]
and eax, 0x80000003
jge 0x18000966a
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x18000967c
test r8d, r8d
jle 0x18000967c
add r8d, 0xaff
jmp 0x180009683
add r8d, 0xfffff501
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
je 0x1800096ba
nop word [rax + rax]
inc r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
jne 0x1800096a0
mov eax, 0x55555556
imul r9d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r9d, ecx
je 0x1800096da
sub r9d, 0x154c
jmp 0x1800096e1
add r9d, 0x154c
mov ecx, r9d
mov eax, 0xffffe40b
sub eax, r9d
sub ecx, r8d
add ecx, 0x5d700
add ecx, eax
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
je 0x180009727
nop dword [rax]
inc ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
jne 0x180009710
test r10d, r10d
jmp 0x1800095b7
xor ecx, ecx
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ValidateRgn]
lea r9, [0x1800f7ca0]
mov dword [rsp + 0x20], 0
xor r8d, r8d
lea rdx, [0x1800f7cd0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerifyScripts]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeUserPhysicalPages]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreatePrivateNamespaceW]
call qword [sym.imp.USER32.dll_InSendMessage]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetNextDlgTabItem]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetIconInfoExW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_TranslateMessage]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMenuItemInfoW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CharPrevW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_KillTimer]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteProfileStringW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_TileWindows]
xor ecx, ecx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetProcessorSystemCycleTime]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetScrollBarInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalFree]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov edx, dword [rsp + 0x78]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolWait]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetDefaultDllDirectories]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteProfileStringW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 1
add rsp, 0x68
ret