Function at 0x1800028b0
Capabilities:
Accept command line arguments
Clear file content
Delete directory
Enumerate files on windows
Get disk information
Get system firmware table
Identify system language via api
Read .ini file
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [0x18007bda8], 0
cmp dword [0x18007bda4], 0x7821a27
jne 0x180002a85
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180028dd0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleActiveScreenBuffer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapValidate]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelSynchronousIo]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.USKRFbLUlzLiIxc
call qword [sym.imp.KERNEL32.dll_FindFirstFileNameTransactedW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleSelectionInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadSelectorEntry]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.PztYJFuIsGWpKdHKPLHsid
call qword [sym.imp.KERNEL32.dll_FindFirstFileNameW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rax, str.ZkSLImARePWwBFTLOVCPPYkoGzX
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, str.kYWtqWxdzwSfNOpdeA
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNLSString]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSizeEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalFlags]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov qword [rsp + 0x38], 0
lea rax, str.ZUbPLBZEeIpualTKpVmUb
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.FQSvlggsYkZqjTZRIhCVMMb
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
mov dword [rsp + 0x40], eax
mov rcx, qword [rsp + 0x60]
call fcn.180009e50
movzx eax, al
test eax, eax
jne 0x180002cc1
mov rcx, qword [rsp + 0x60]
call fcn.180009e30
mov eax, dword [rax]
mov ecx, dword [0x18007bda8]
add ecx, eax
mov eax, ecx
mov dword [0x18007bda8], eax
mov eax, dword [0x18007bda4]
mov ecx, 0x9227831c
cmp rax, rcx
jne 0x180002c52
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetComputerNameW]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapePosition]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadGroupAffinity]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnlockFile]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTime]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadFile]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsValidLanguageGroup]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsValidCodePage]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadGroupAffinity]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rax, str.PfsVqGCgDeKsOTB
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDurationFormat]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov dword [rsp + 0x20], 0
lea r9, str.xxAeFclRszYzVUuuxYXRZNiQekAOJ
xor r8d, r8d
lea rdx, str.krvrZgUhuYyGoxNaasAjPitvu
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerifyScripts]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64EnableWow64FsRedirection]
mov rcx, qword [rsp + 0x60]
call fcn.180009de0
cmp dword [0x18007bda4], 0x536d30d6
jne 0x180002cbc
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesTransactedW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
xor eax, eax
mov qword [rsp + 0x48], rax
xor ecx, ecx
xor eax, eax
mov rdx, qword [rsp + 0x48]
lock cmpxchg qword [rcx], rdx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
jmp 0x180002a85
add rsp, 0x58
ret