Function at 0x180005fc0
Capabilities:
Check for debugger via api
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
xor r9d, r9d
xor ecx, ecx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsDialogMessageW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFirmwareType]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowPlacement]
xor edi, edi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetMenuItemBitmaps]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumWindows]
call qword [sym.imp.USER32.dll_ReleaseCapture]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteBoundaryDescriptor]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenPrivateNamespaceW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapUnlock]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetClassLongW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EndPaint]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetScrollInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemGeoID]
xor ecx, ecx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformationForYear]
mov qword [rsp + 0x38], rdi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [rsp + 0x40], edi
xor r9d, r9d
mov dword [rsp + 0x38], edi
xor r8d, r8d
mov dword [rsp + 0x30], edi
xor edx, edx
mov dword [rsp + 0x28], edi
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_GrayStringW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetRectEmpty]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadAcceleratorsW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeDisconnectList]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CloseWindow]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InternalGetWindowText]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov ecx, 0xfffffabe
inc ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
jne 0x180006130
lea edx, [rcx + 0xa0a]
mov r8d, 0xffffffd3
sub r8d, ecx
lea eax, [rdx + 0x3c36]
sub edx, r8d
test al, 1
je 0x180006169
inc eax
test al, 1
jne 0x180006163
cmp edx, 0xffffffb7
jne 0x18000618f
cmp r8d, 0x513
jne 0x18000618f
cmp edx, edx
jne 0x18000618f
cmp eax, 0x4100
jne 0x18000618f
mov eax, dword [rbx]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov rbx, qword [rsp + 0x60]
mov eax, 1
add rsp, 0x50
pop rdi
ret