Function at 0x180006c40
Capabilities:
Create mailslot
Create process on windows
Delete directory
Delete file
Get common file path
Read .ini file
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
lea rbp, [rsp - 0x4f]
sub rsp, 0x88
xor ecx, ecx
call fcn.18008864c
mov ecx, eax
call fcn.180085244
call fcn.180085218
and eax, 0x80000003
jge 0x180006c79
dec eax
or eax, 0xfffffffc
inc eax
xor edi, edi
test eax, eax
jne 0x180006dc5
cmp dword [0x180125cf0], 0x8fe77b91
jne 0x180006db2
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolWork]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DefWindowProcW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommTimeouts]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_KillTimer]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxIndirectW]
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
call qword [sym.imp.KERNEL32.dll_FlushProcessWriteBuffers]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
xor ecx, ecx
call qword [sym.imp.USER32.dll_EndDeferWindowPos]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapUnlock]
lea rax, str.wz2tss2zPLRa5TnTrBNL65VaJ
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
lea r8, str.P6DU77487LAvlSn2KhgfcFUYpHUC
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNLSString]
call qword [sym.imp.USER32.dll_GetClipboardViewer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMemoryErrorHandlingCapabilities]
xor ecx, ecx
call qword [sym.imp.USER32.dll_TranslateMessage]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetScrollBarInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DiscardVirtualMemory]
mov edx, dword [rbp + 0x67]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetLastActivePopup]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeQueryNextServer]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ShowCaret]
mov rdx, qword [rbp + 0x6f]
call fcn.180001fb0
add rsp, 0x88
pop rdi
pop rbp
ret
cmp eax, 1
jne 0x180006e25
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea r9, [rbp + 0x77]
add rax, 0x237
mov dword [rbp + 0x2f], 0x237
mov qword [rbp + 0x27], rax
lea r8, [rbp + 0x6f]
movaps xmm0, xmmword [rbp + 0x27]
lea rax, [rbp + 0x67]
lea rdx, [rbp + 0x7f]
movdqa xmmword [rbp + 0x37], xmm0
lea rcx, [rbp + 0x37]
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x67], 4
mov dword [rbp + 0x77], 0x3000
mov qword [rbp + 0x7f], rdi
call fcn.180011b00
add rsp, 0x88
pop rdi
pop rbp
ret
cmp eax, 2
jne 0x180006ffa
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea rcx, [rbp + 0x37]
add rax, 0x18d
mov dword [rbp + 0x2f], 0x18d
mov qword [rbp + 0x27], rax
movaps xmm0, xmmword [rbp + 0x27]
movdqa xmmword [rbp + 0x37], xmm0
call fcn.180011ce0
cmp dword [0x180125cf0], 0xaffd6772
mov qword [rbp + 0x77], rax
jne 0x180006fb3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64SuspendThread]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetTapePosition]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CheckTokenCapability]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemFileCacheSize]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x30], edi
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSearchPathMode]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMailslotW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrefetchVirtualMemory]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
mov qword [rsp + 0x40], rdi
lea rax, str.tuJSwkETfsjHZ5BuSd1G
mov qword [rsp + 0x38], rdi
lea r8, str.O4jG2D2jY5RObF2yEigAB8
mov qword [rsp + 0x30], rdi
lea rcx, str.1kHtQC3ZWL9zfKr1BH
mov dword [rsp + 0x28], edi
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetTimeZoneInformation]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIdealProcessorEx]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStringTypeExW]
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r9, [rbp + 0x6f]
add rax, 0x24b
mov dword [rbp + 0x2f], 0x24b
mov qword [rbp + 0x27], rax
lea r8, [rbp + 0x67]
movaps xmm0, xmmword [rbp + 0x27]
lea rdx, [rbp + 0x77]
lea rcx, [rbp + 0x37]
movdqa xmmword [rbp + 0x37], xmm0
mov dword [rbp + 0x67], 8
call fcn.180011e90
add rsp, 0x88
pop rdi
pop rbp
ret
cmp eax, 3
jne 0x180007298
mov rax, qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea r8, [rbp + 0x6f]
add rax, 0x254
mov dword [rbp + 0x2f], 0x254
mov qword [rbp + 0x27], rax
lea rdx, [rbp + 0x67]
movaps xmm0, xmmword [rbp + 0x27]
lea rcx, [rbp + 0x37]
movdqa xmmword [rbp + 0x37], xmm0
mov qword [rsp + 0x80], rbx
mov dword [rbp + 0x67], edi
call fcn.18000f470
mov qword [rbp + 0x1f], rax
lea r9, [rbp + 0x77]
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea r8, [rbp + 0x7f]
add rax, 0x160
mov dword [rbp + 0x3f], 0x160
mov qword [rbp + 0x37], rax
lea rdx, [rbp + 0x17]
movaps xmm0, xmmword [rbp + 0x37]
lea rax, [rbp + 0x67]
lea rcx, [rbp + 0x37]
movdqa xmmword [rbp + 0x37], xmm0
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x67], 4
mov dword [rbp + 0x77], 0x3000
mov dword [rbp + 0x7f], 0x400
mov qword [rbp + 0x17], rdi
call fcn.180012070
mov qword [rbp + 0x27], rax
lea rdx, [rbp + 0x1f]
mov rax, qword [sym.imp.KERNEL32.dll_LocalLock]
lea rcx, [rbp + 0x37]
mov dword [rbp + 0x3f], 0x288
add rax, 0x288
mov qword [rbp + 0x37], rax
movaps xmm0, xmmword [rbp + 0x37]
movdqa xmmword [rbp + 0x37], xmm0
call fcn.18000f640
cmp dword [0x180125cf0], 0x16d79ff9
mov rbx, rax
jne 0x180007243
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSizeEx]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDevicePowerState]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPreferredUILanguages]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPreferredUILanguages]
call qword [sym.imp.KERNEL32.dll_GetThreadLocale]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsValidLocale]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PowerCreateRequest]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeServerProcessId]
mov r9d, dword [rbp + 0x67]
xor edx, edx
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNodeEx]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddResourceAttributeAce]
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
lea r9, [rbp + 0x67]
mov dword [rbp + 0x3f], 0x219
lea r8, [rbp + 0x77]
add rax, 0x219
mov dword [rbp + 0x67], 0x8000
mov qword [rbp + 0x37], rax
lea rdx, [rbp + 0x27]
movaps xmm0, xmmword [rbp + 0x37]
lea rcx, [rbp + 0x37]
movdqa xmmword [rbp + 0x37], xmm0
mov dword [rbp + 0x77], edi
call fcn.180012250
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x88
pop rdi
pop rbp
ret
mov rax, rdi
add rsp, 0x88
pop rdi
pop rbp
ret