Function at 0x180002ce0
Capabilities:
Check for debugger via api
Copy file
Create directory
Create mailslot
Enumerate gui resources
Get common file path
Get disk information
Get disk size
Get geographical location
Get system firmware table
Get uefi variable
Manipulate console buffer
Move file
Read .ini file
Read file on windows
Set console window title
Terminate process
Timestomp file

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x128
mov rcx, qword [rsp + 0x140]
call fcn.180009bf0
mov rax, qword [rax]
mov qword [rsp + 0xf0], rax
mov eax, dword [0x18007bda4]
mov ecx, 0xc231523e
cmp rax, rcx
jne 0x180002ebb
xor edx, edx
lea rcx, str.LBXAwCIudOWmOVXOafXfPrKw
call qword [sym.imp.KERNEL32.dll_LoadPackagedLibrary]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnlockFile]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientProcessId]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadErrorMode]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolWait]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockFile]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProximityNodeEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolWaitEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CompareStringW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForThreadpoolIoCallbacks]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetAppContainerNamedObjectPath]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalSize]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov rax, qword [0x18007bdb8]
mov qword [rsp + 0x80], rax
mov eax, 4
imul rax, rax, 0
mov dword [rsp + rax + 0x78], 0x70797243
cmp dword [0x18007bda4], 0xbcae494
jne 0x18000309d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleHistoryInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddSecureMemoryCacheCallback]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockFileEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemGeoID]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaNodeNumberFromHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientSessionId]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCurrentConsoleFontEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.LAUjAFkrlbEeciuUqAWBsUKdtUP
xor edx, edx
lea rcx, str.dUJOjzvbxhHyazYS
call qword [sym.imp.KERNEL32.dll_GetCalendarInfoEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.HozoBGFtOwBvYJrDHVqZoNMHZCXZ
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalFlags]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolThreadMinimum]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolWork]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryTransactedW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexExW]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rax, str.PIgoRUsRbzhosUeFzAmI
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, str.ARDIdVAucRoyifczfL
xor edx, edx
lea rcx, str.rPqpgpDdMNcYxOfyPEyR
call qword [sym.imp.KERNEL32.dll_FindNLSStringEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
call fcn.180004f40
mov eax, 4
imul rax, rax, 1
mov dword [rsp + rax + 0x78], 0x2e323374
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x78]
mov qword [rsp + rax + 0x88], rcx
mov eax, dword [0x18007bda4]
mov ecx, 0x9f07228e
cmp rax, rcx
jne 0x18000329d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadLocale]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetAppContainerNamedObjectPath]
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileTransactedW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov qword [rsp + 0xc0], 0x6c6c64
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + rax + 0x88], rcx
cmp dword [0x18007bda4], 0x5aa860b9
jne 0x18000343f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapUnlock]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesTransactedW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForThreadpoolWaitCallbacks]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rax, str.dMBkKNLtlnfiScKDZOEzbaqDo
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, str.nbvnFOuNadSZQowmvfKNLjSVEJwoX
xor edx, edx
lea rcx, str.aipmtAMoZtuCFCNWZFTwnwVobj
call qword [sym.imp.KERNEL32.dll_CompareStringEx]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNode]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsThreadpoolTimerSet]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TerminateJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalSize]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTimeEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLocalTime]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetAppContainerNamedObjectPath]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PowerCreateRequest]
lea rcx, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0xc8], rax
jmp 0x1800035fd
mov eax, 8
imul rax, rax, 0
movabs rcx, 0x7274537470797243
mov qword [rsp + rax + 0x88], rcx
cmp dword [0x18007bda4], 0x454684e8
jne 0x180003781
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutexWhenCallbackReturns]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommTimeouts]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CopyFileTransactedW]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockFile]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddSecureMemoryCacheCallback]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemPreferredUILanguages]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnregisterWaitEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TrySubmitThreadpoolCallback]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov word [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesExW]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
mov eax, dword [rsp + 0xac]
mov dword [rsp + 0x5c], eax
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x5c]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputAttribute]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadProfiling]
mov eax, 8
imul rax, rax, 1
movabs rcx, 0x6e69426f54676e69
mov qword [rsp + rax + 0x88], rcx
mov eax, dword [0x18007bda4]
mov ecx, 0xe9d2010b
cmp rax, rcx
jne 0x180003a3f
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0xb4]
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x60]
mov r8d, dword [rsp + 0x64]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStringTypeExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleHistoryInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolTimerEx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BackupRead]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadId]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.dBaqUsuTSuqIzizrCsbofU
xor edx, edx
lea rcx, str.tmkiEoIQzyjEVah
call qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCompressedFileSizeTransactedW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
xor r8d, r8d
lea rdx, str.mNaONwYNHoBMyqNlHNzts
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsValidNLSVersion]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.IDqKopMCYZTfFwRhvuPKpBavBhb
xor edx, edx
lea rcx, str.OngiHaHGmuMbipmQGFXUEmBgNj
call qword [sym.imp.KERNEL32.dll_LCMapStringEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadPreferredUILanguages]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CopyFileTransactedW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadSelectorEntry]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SleepConditionVariableCS]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadStackGuarantee]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, 8
imul rax, rax, 2
mov qword [rsp + rax + 0x88], 0x41797261
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18007bdc8], rax
mov eax, dword [0x18007bda4]
mov ecx, 0xa7162550
cmp rax, rcx
jne 0x180003c08
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.YNBmAvXRDPbgxPFRn
call qword [sym.imp.KERNEL32.dll_FindFirstFileNameW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolTimer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommProperties]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSizeEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.wAAbdwQhQcUhdVign
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMailslotW]
call qword [sym.imp.KERNEL32.dll_GetACP]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
call qword [sym.imp.KERNEL32.dll_UnregisterApplicationRestart]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClosePrivateNamespace]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSectionWhenCallbackReturns]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapSize]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
lea rcx, str.NoWntKiENSUorvKkMzBhZVqkEJsdK
call qword [sym.imp.KERNEL32.dll_IsValidLocaleName]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalFlags]
xor r9d, r9d
xor r8d, r8d
lea rdx, str.aUTZJbrUaDQRXpEwTZ
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumDateFormatsExEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumLanguageGroupLocalesW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProtectedPolicy]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalReAlloc]
mov eax, dword [0x18007bda0]
mov dword [rsp + 0x68], eax
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0xe8], rax
mov dword [rsp + 0x6c], 1
mov dword [rsp + 0x70], 0x30de1
mov r8d, 0x11d
mov rdx, qword [0x18007bdc8]
lea rcx, [rsp + 0x110]
call fcn.18000acc0
lea rcx, [rsp + 0x100]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x6c]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x100]
call fcn.18000ad00
mov dword [rsp + 0xb8], eax
cmp dword [0x18007bda4], 0x8fa1b17
jne 0x180003f58
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetOverlappedResultEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.xaOhuSPmWKpCFMNLKLtmjY
xor edx, edx
lea rcx, str.GJXRVhzOSXMIjreuN
call qword [sym.imp.KERNEL32.dll_LCMapStringEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RaiseException]
call fcn.180003fb0
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0xf8], rax
mov rcx, qword [rsp + 0x140]
call fcn.180003f90
mov rax, qword [rsp + 0xf8]
add rsp, 0x128
pop rdi
pop rsi
ret