Function at 0x180006880
Capabilities:
Accept command line arguments
Get disk information
Get geographical location
Get hostname
Identify system language via api
Manipulate console buffer

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x20]
sub rsp, 0x120
xor ecx, ecx
call fcn.18007fabc
mov ecx, eax
call fcn.18007c6b4
call fcn.18007c688
and eax, 0x80000003
jge 0x1800068ba
dec eax
or eax, 0xfffffffc
inc eax
xor edi, edi
test eax, eax
jne 0x1800069ed
cmp dword [0x18011ccd8], 0x52de72ee
jne 0x1800069d9
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMenuItemID]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
mov edx, dword [rbp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeSListHead]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_BeginDeferWindowPos]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetFocus]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplaySettingsW]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateCursor]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemLanguageGroupsW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryProtectedPolicy]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CheckMenuItem]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DlgDirListComboBoxW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CheckTokenCapability]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, qword [rbp + 0x48]
call fcn.180001fb0
add rsp, 0x120
pop rdi
pop rbx
pop rbp
ret
cmp eax, 1
jne 0x180006b98
mov dword [rbp + 0x50], 4
mov dword [rbp + 0x58], 0x3000
mov qword [rbp - 0x40], rdi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x1b8
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x30], 0x1b8
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rdi
mov ecx, 0x10
call fcn.180076898
mov qword [rax + 8], rdi
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x78]
mov qword [rax], rcx
mov word [rbp - 0x58], di
mov qword [rbp - 0x52], rdi
mov qword [rbp - 0x4a], rdi
xor eax, eax
mov word [rbp - 0x55], ax
mov byte [rbp - 0x53], al
mov word [rbp - 0x52], ax
mov byte [rbp - 0x50], al
mov word [rbp - 0x4f], ax
mov byte [rbp - 0x4d], al
mov word [rbp - 0x4c], ax
mov byte [rbp - 0x4a], al
mov word [rbp - 0x49], ax
mov byte [rbp - 0x47], al
mov word [rbp - 0x46], ax
mov byte [rbp - 0x44], al
mov dword [rbp - 0x5c], edi
mov dword [rsp + 0x74], edi
lea rcx, [rsp + 0x60]
call fcn.180027020
test al, al
je 0x180006add
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.1800271b0
mov byte [rbp - 0x58], 0
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x50], rcx
and al, 1
mov byte [rsp + 0x58], al
mov dl, 1
lea rcx, [rsp + 0x50]
call fcn.180014cc0
lea rcx, [rsp + 0x60]
call fcn.180029ba0
lea rax, [rsp + 0x60]
mov qword [rbp + 0x40], rax
lea rdx, [rbp + 0x40]
call fcn.180017850
mov byte [rbp + 0x40], 0
mov r8b, 1
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.18001ee30
mov byte [rbp + 0x40], 0
mov r8b, 1
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.18001ef00
mov byte [rbp + 0x40], 0
mov r8b, 1
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.18001f0a0
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [rbp - 0x20], xmm0
lea rax, [rbp + 0x50]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x58]
mov qword [rbp - 8], rax
lea rax, [rbp + 0x48]
mov qword [rbp], rax
lea rax, [rbp - 0x40]
mov qword [rbp + 8], rax
mov r8b, 1
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x60]
call fcn.18001f170
mov rbx, qword [rsp + 0x68]
lea rcx, [rsp + 0x78]
call fcn.1800140a0
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x78], rdi
mov edx, 0x10
call fcn.1800767ac
mov rax, rbx
add rsp, 0x120
pop rdi
pop rbx
pop rbp
ret
cmp eax, 2
jne 0x180006d56
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
add rax, 0x1ce
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x1ce
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.1800115f0
mov qword [rbp + 0x50], rax
cmp dword [0x18011ccd8], 0xcf1c0023
jne 0x180006d09
lea rdx, str.nl75T7miKNMY6bXlgQaJo1BD
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
call qword [sym.imp.KERNEL32.dll_GetErrorMode]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ApplicationRecoveryInProgress]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolWait]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AttachConsole]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetWaitableTimerEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OfferVirtualMemory]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
lea rdx, str.x1PQivzPC63LKSB2hNU1a13gcX
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadDescription]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForThreadpoolTimerCallbacks]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddSIDToBoundaryDescriptor]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadThreadProfilingData]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNodeEx]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSymbolicLinkTransactedW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryThreadProfiling]
mov dword [rbp + 0x40], 8
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
add rax, 0x217
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x217
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x40], xmm0
lea r9, [rbp + 0x48]
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.180011760
add rsp, 0x120
pop rdi
pop rbx
pop rbp
ret
cmp eax, 3
jne 0x180007086
mov dword [rbp + 0x40], edi
mov rax, qword [sym.imp.KERNEL32.dll_LocalAlloc]
add rax, 0x25b
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x25b
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x48]
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.18000f520
mov qword [rbp - 0x38], rax
mov dword [rbp + 0x50], 4
mov dword [rbp + 0x58], 0x3000
mov dword [rbp - 0x40], 0x400
mov qword [rbp - 0x28], rdi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x13e
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x13e
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rdi
mov ecx, 0x10
call fcn.180076898
mov qword [rax + 8], rdi
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x78]
mov qword [rax], rcx
mov word [rbp - 0x58], di
mov qword [rbp - 0x52], rdi
mov qword [rbp - 0x4a], rdi
xor eax, eax
mov word [rbp - 0x55], ax
mov byte [rbp - 0x53], al
mov word [rbp - 0x52], ax
mov byte [rbp - 0x50], al
mov word [rbp - 0x4f], ax
mov byte [rbp - 0x4d], al
mov word [rbp - 0x4c], ax
mov byte [rbp - 0x4a], al
mov word [rbp - 0x49], ax
mov byte [rbp - 0x47], al
mov word [rbp - 0x46], ax
mov byte [rbp - 0x44], al
mov dword [rbp - 0x5c], edi
mov dword [rsp + 0x74], edi
lea rcx, [rsp + 0x60]
call fcn.1800277d0
test al, al
je 0x180006e8a
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.180027960
mov byte [rbp - 0x58], 0
lea rcx, [rsp + 0x60]
mov qword [rbp + 0x10], rcx
and al, 1
mov byte [rbp + 0x18], al
mov dl, 1
lea rcx, [rbp + 0x10]
call fcn.180014e10
lea rcx, [rsp + 0x60]
call fcn.180029ba0
lea rax, [rsp + 0x60]
mov qword [rbp + 0x40], rax
lea rdx, [rbp + 0x40]
call fcn.180017310
mov byte [rbp + 0x40], 0
mov r8b, 1
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.18001e200
mov byte [rbp + 0x40], 0
mov r8b, 1
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.18001e2d0
mov byte [rbp + 0x40], 0
mov r8b, 1
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.18001e470
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbp - 0x20], xmm0
lea rax, [rbp + 0x50]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x58]
mov qword [rbp - 8], rax
lea rax, [rbp - 0x40]
mov qword [rbp], rax
lea rax, [rbp - 0x28]
mov qword [rbp + 8], rax
mov r8b, 1
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x60]
call fcn.18001e540
mov rbx, qword [rsp + 0x68]
lea rcx, [rsp + 0x78]
call fcn.1800140a0
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x78], rdi
mov edx, 0x10
call fcn.1800767ac
mov qword [rsp + 0x50], rbx
mov rax, qword [sym.imp.KERNEL32.dll_LocalLock]
add rax, 0x1bd
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x1bd
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x40]
call fcn.18000f6b0
mov rbx, rax
cmp dword [0x18011ccd8], 0xedb2889c
jne 0x180007032
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommConfig]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolTimer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUserGeoID]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetComputerNameW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov dword [rbp + 0x40], 0x8000
mov dword [rbp + 0x50], edi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
add rax, 0x293
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x293
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea r9, [rbp + 0x40]
lea r8, [rbp + 0x50]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.180011900
mov rax, rbx
add rsp, 0x120
pop rdi
pop rbx
pop rbp
ret
mov rax, rdi
add rsp, 0x120
pop rdi
pop rbx
pop rbp
ret