Function at 0x180004da0
Capabilities:
Delete directory
Query environment variable
Set environment variable

Disassembly:
push rbx
sub rsp, 0x60
mov dword [rsp + 0x58], 0x25d
lea rax, [fcn.180005030]
add rax, 0x25d
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.180010ac0
mov rax, qword [0x180125258]
xor ebx, ebx
mov r8d, dword [0x180125260]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx + 0x3b50]
mov dword [rax + 4], 0x4d4d4a68
cmp r8d, 0x50f386e3
jne 0x180004ed3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpool]
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNodeEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetPixel]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetRasterizerCaps]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_FloodFill]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapSize]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetTextFaceW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetDefaultDllDirectories]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientProcessId]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_ExtSelectClipRgn]
mov r8d, dword [0x180125260]
mov rax, qword [0x180125268]
mov rcx, qword [rax + 0x10]
mov rax, qword [0x180125258]
mov edx, dword [rcx + 0x2468]
mov rcx, qword [rax + 0x10]
add edx, 0xf6687b5
mov rax, qword [rcx + 0x3b50]
mov dword [rax], edx
cmp r8d, 0xdf4ee5c7
jne 0x180004fcf
xor ecx, ecx
call qword [sym.imp.GDI32.dll_UpdateColors]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateDiscardableBitmap]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_ResizePalette]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreatePolyPolygonRgn]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenPrivateNamespaceW]
mov dword [rsp + 0x40], ebx
xor r9d, r9d
mov dword [rsp + 0x38], ebx
xor r8d, r8d
mov dword [rsp + 0x30], ebx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.GDI32.dll_Arc]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileShortNameW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateScalableFontResourceW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_PtVisible]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemCodePagesW]
mov rax, qword [0x180125258]
mov rcx, qword [rax + 0x10]
mov rax, qword [0x180125268]
mov rdx, qword [rcx + 0x3b50]
mov rcx, qword [rax + 0x10]
mov eax, dword [rcx + 0x2468]
add dword [rdx + 4], eax
mov rax, qword [0x180125250]
mov r8, qword [rax + 0x10]
mov rax, qword [0x180125258]
mov rcx, qword [rax + 0x10]
mov eax, dword [r8 + 0x4418]
mov rdx, qword [rcx + 0x3b50]
mov dword [rdx + 8], eax
add rsp, 0x60
pop rbx
ret