Function at 0x1800026d0
Capabilities:
Create mailslot
Create thread
Get common file path
Get hostname

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [0x18007ada8], 0
cmp dword [0x18007ada4], 0x7af591da
jne 0x1800028a9
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemRegistryQuota]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LCMapStringW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueueEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadPreferredUILanguages]
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x40]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputAttribute]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddSIDToBoundaryDescriptor]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FatalExit]
mov rcx, qword [rsp + 0x60]
call fcn.180009b30
movzx eax, al
test eax, eax
jne 0x180002b7c
mov rcx, qword [rsp + 0x60]
call fcn.180009b10
mov eax, dword [rax]
mov ecx, dword [0x18007ada8]
add ecx, eax
mov eax, ecx
mov dword [0x18007ada8], eax
cmp dword [0x18007ada4], 0x1e7a2b14
jne 0x1800029fc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WakeConditionVariable]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetVolumeLabelW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadGroupAffinity]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SleepConditionVariableCS]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommProperties]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockShared]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SleepConditionVariableSRW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FatalAppExitW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsThreadpoolTimerSet]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CompareStringW]
mov rcx, qword [rsp + 0x60]
call fcn.180009ac0
cmp dword [0x18007ada4], 0x31a0571e
jne 0x180002b77
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileCompletionNotificationModes]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleCP]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeSRWLock]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.jWewDLkuZnPPxIbIPhWgSajIF
xor edx, edx
lea rcx, str.kuHhtICTPdivjVUBGSLIBOfTZMWyg
call qword [sym.imp.KERNEL32.dll_GetCalendarInfoEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNodeEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommState]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCurrentConsoleFontEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64SuspendThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDynamicTimeZoneInformation]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolWait]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapePosition]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.QWpNhgmEMGhEYfkKgHFWs
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStringTypeA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualLock]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMailslotW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleHistoryInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TerminateJobObject]
jmp 0x1800028a9
add rsp, 0x58
ret