Function at 0x180004c90
Capabilities:
Accept command line arguments
Enumerate gui resources
Get disk information
Read .ini file
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
call fcn.18004d298
mov r8d, dword [0x1800d6574]
mov ebx, eax
mov eax, 0x51eb851f
xor edi, edi
imul ebx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub ebx, ecx
inc ebx
cmp r8d, 0xfe332a5
jne 0x180004e0e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLongPathNameTransactedW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetListBoxInfo]
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterPointerInputTargetEx]
call qword [sym.imp.USER32.dll_GetClipboardOwner]
call qword [sym.imp.USER32.dll_GetDialogBaseUnits]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetTapePosition]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadErrorMode]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockFile]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDesktopsW]
mov dword [rsp + 0x38], edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov qword [rsp + 0x28], rdi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTimeEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_IntersectRect]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_AdjustWindowRect]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LCMapStringW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadPreferredUILanguages]
mov r8d, dword [0x1800d6574]
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp ebx, ecx
jne 0x180004f7f
cmp r8d, 0x3c00efd6
jne 0x180004f5c
mov dword [rsp + 0x28], edi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LCMapStringW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsAlloc]
lock dec dword [rdi]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolTimerEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleFontSize]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
xor r8d, r8d
lea rdx, str.BM8K3d9j3cAD9dUuOK4LR82
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsValidNLSVersion]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
mov r9d, dword [rsp + 0x60]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputAttribute]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadStackGuarantee]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsBadWritePtr]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolTimer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroup]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeServerSessionId]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RegisterBadMemoryNotification]
mov edx, dword [rsp + 0x68]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
test bl, 1
jne 0x18000500d
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x48], 0x1a2
add rax, 0x1a2
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000d0a0
mov qword [rsp + 0x70], rax
lea r9, [rsp + 0x68]
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r8, [rsp + 0x60]
mov dword [rsp + 0x48], 0x1b4
lea rdx, [rsp + 0x70]
add rax, 0x1b4
mov dword [rsp + 0x60], 8
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000d2d0
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov ecx, 0xb7b
inc ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
jne 0x180005012
cmp ecx, 0xb7c
jne 0x180005070
mov dword [rsp + 0x48], 0x23b
lea rax, [fcn.18005255c]
add rax, 0x23b
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000d520
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]